{"id":89926,"date":"2025-10-15T16:10:37","date_gmt":"2025-10-15T13:10:37","guid":{"rendered":"https:\/\/forklog.com\/en\/?p=89926"},"modified":"2025-10-15T16:16:30","modified_gmt":"2025-10-15T13:16:30","slug":"dormant-lubian-pool-wallet-moves-9757-btc-after-three-years","status":"publish","type":"post","link":"https:\/\/forklog.com\/en\/dormant-lubian-pool-wallet-moves-9757-btc-after-three-years\/","title":{"rendered":"Dormant LuBian Pool Wallet Moves 9,757 BTC After Three Years"},"content":{"rendered":"<p>On October 15th, a wallet associated with the LuBian mining pool, hacked in 2020, became active. After three years of inactivity, 9,757 BTC, valued at $1.1 billion, were transferred from the address, according to Lookonchain.\u00a0<\/p>\n<blockquote class=\"twitter-tweet\">\n<p lang=\"en\" dir=\"ltr\"><a href=\"https:\/\/twitter.com\/hashtag\/PeckShieldAlert?src=hash&#038;ref_src=twsrc%5Etfw\">#PeckShieldAlert<\/a> A <a href=\"https:\/\/twitter.com\/hashtag\/LuBian?src=hash&#038;ref_src=twsrc%5Etfw\">#LuBian<\/a>-labeled address (39DUz\u2026) has woken up after 3 years of dormancy and transferred 9,757 <a href=\"https:\/\/twitter.com\/search?q=%24BTC&#038;src=ctag&#038;ref_src=twsrc%5Etfw\">$BTC<\/a> (worth ~$1.1 billion) to 2 new wallets\uff0c34kn9z\u2026s9tef &#038; bc1q4c\u202677s0<\/p>\n<p>This comes as the U.S. government prepares to forfeit 127,271 BTC ($14.3B) \u2014 the funds\u2026 <a href=\"https:\/\/t.co\/je3KToiN9V\">pic.twitter.com\/je3KToiN9V<\/a><\/p>\n<p>\u2014 PeckShieldAlert (@PeckShieldAlert) <a href=\"https:\/\/twitter.com\/PeckShieldAlert\/status\/1978379955571732572?ref_src=twsrc%5Etfw\">October 15, 2025<\/a><\/p><\/blockquote>\n<p> <script async src=\"https:\/\/platform.twitter.com\/widgets.js\" charset=\"utf-8\"><\/script><\/p>\n<p>According to <a href=\"https:\/\/x.com\/PeckShieldAlert\/status\/1978428621917163676\">PeckShield<\/a>, the funds were distributed between two new wallets.\u00a0<\/p>\n<p>Hours later, on-chain specialists noticed another address linked to LuBian. It transferred 2,129 BTC worth $238 million.\u00a0<\/p>\n<blockquote class=\"twitter-tweet\" data-conversation=\"none\">\n<p lang=\"en\" dir=\"ltr\"><a href=\"https:\/\/twitter.com\/hashtag\/PeckShieldAlert?src=hash&#038;ref_src=twsrc%5Etfw\">#PeckShieldAlert<\/a> A <a href=\"https:\/\/twitter.com\/hashtag\/LuBian?src=hash&#038;ref_src=twsrc%5Etfw\">#LuBian<\/a>-labeled addresses (3FYHWu\u2026dKb) has transferred another 2,129 <a href=\"https:\/\/twitter.com\/search?q=%24BTC&#038;src=ctag&#038;ref_src=twsrc%5Etfw\">$BTC<\/a> (worth ~$238.6M) to a new address bc1q42ltpxsc6s8fne0jz474tvuvyq2sqw26ud80xy <a href=\"https:\/\/t.co\/Oa7H3XLjvf\">pic.twitter.com\/Oa7H3XLjvf<\/a><\/p>\n<p>\u2014 PeckShieldAlert (@PeckShieldAlert) <a href=\"https:\/\/twitter.com\/PeckShieldAlert\/status\/1978428621917163676?ref_src=twsrc%5Etfw\">October 15, 2025<\/a><\/p><\/blockquote>\n<p> <script async src=\"https:\/\/platform.twitter.com\/widgets.js\" charset=\"utf-8\"><\/script><\/p>\n<p>The account, identified by Arkham as belonging to the LuBian hacker, retains assets worth $12.\u00a0<\/p>\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"733\" src=\"https:\/\/forklog.com\/wp-content\/uploads\/img-1e83ddd528fc7942-6926390241351989-1024x733.png\" alt=\"image\" class=\"wp-image-267605\" srcset=\"https:\/\/forklog.com\/wp-content\/uploads\/img-1e83ddd528fc7942-6926390241351989-1024x733.png 1024w, https:\/\/forklog.com\/wp-content\/uploads\/img-1e83ddd528fc7942-6926390241351989-300x215.png 300w, https:\/\/forklog.com\/wp-content\/uploads\/img-1e83ddd528fc7942-6926390241351989-768x550.png 768w, https:\/\/forklog.com\/wp-content\/uploads\/img-1e83ddd528fc7942-6926390241351989.png 1442w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><figcaption class=\"wp-element-caption\">Source: <a href=\"https:\/\/intel.arkm.com\/explorer\/entity\/lubian-hacker\">Arkham<\/a>.\u00a0<\/figcaption><\/figure>\n<h2 class=\"wp-block-heading\">LuBian Hack May Not Have Occurred\u00a0<\/h2>\n<p>The activity intensified a day after reports of the U.S. authorities&#8217; intention to seize 127,271 BTC worth $14.4 billion, allegedly stolen from LuBian. On October 15th, Arkham Intelligence experts confirmed that the funds had come under government control.\u00a0<\/p>\n<blockquote class=\"twitter-tweet\">\n<p lang=\"en\" dir=\"ltr\">BREAKING: US Government Seized $14B BTC Tied to LuBian and Chen Zhi\u2019s Pig Butchering Operation<\/p>\n<p>The US Government has submitted today a filing for the forfeiture of 127,271 <a href=\"https:\/\/twitter.com\/search?q=%24BTC&#038;src=ctag&#038;ref_src=twsrc%5Etfw\">$BTC<\/a> ($14.2 BILLION) connected to Chen Zhi, chairman of Prince Group, who allegedly ran large-scale\u2026 <a href=\"https:\/\/t.co\/GjyE7CWz2e\">pic.twitter.com\/GjyE7CWz2e<\/a><\/p>\n<p>\u2014 Arkham (@arkham) <a href=\"https:\/\/twitter.com\/arkham\/status\/1978228851407810956?ref_src=twsrc%5Etfw\">October 14, 2025<\/a><\/p><\/blockquote>\n<p> <script async src=\"https:\/\/platform.twitter.com\/widgets.js\" charset=\"utf-8\"><\/script><\/p>\n<p>The assets were seized as part of an investigation against the criminal group Prince Group and its leader Chen Zhi. The Department of Justice accused him of creating a money laundering scheme through a network of pseudo-legal businesses, including mining companies.\u00a0<\/p>\n<p>Cryptocurrency mining allowed criminals to obtain &#8220;clean&#8221; bitcoins, not directly linked to their illegal activities. LuBian was one such company.\u00a0<\/p>\n<p>Official documents state that the pool was initially funded by proceeds from fraud, human trafficking, and the <a href=\"https:\/\/ru.wikipedia.org\/wiki\/%D0%97%D0%B0%D0%B1%D0%BE%D0%B9_%D1%81%D0%B2%D0%B8%D0%BD%D0%B5%D0%B9_(%D0%BC%D0%BE%D1%88%D0%B5%D0%BD%D0%BD%D0%B8%D1%87%D0%B5%D1%81%D1%82%D0%B2%D0%BE)\">&#8220;pig butchering&#8221;<\/a> scheme. It is also noted that the assets confiscated from Chen are the same ones allegedly stolen from LuBian in 2020.\u00a0<\/p>\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\">\n<p><em>&#8220;The US Department of Justice does not specify how the bitcoins came under government control \u2014 whether private keys were compromised, voluntarily handed over, or if the 2020 &#8216;hack&#8217; was actually a U.S. special operation,&#8221; Arkham noted.\u00a0<\/em><\/p>\n<\/blockquote>\n<p>Elliptic specialists <a href=\"https:\/\/www.elliptic.co\/blog\/15-billion-us-seizure-reveals-prince-groups-connection-to-iran-china-bitcoin-mining-theft\">suggested<\/a> that the transfer of funds in June-July 2024 indicated the bitcoins were placed under U.S. government control.\u00a0<\/p>\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\">\n<p><em>&#8220;However, it remains unclear how exactly the coins came into the possession of the U.S. authorities, and who exactly &#8216;stole&#8217; them from Chen\/LuBian \u2014 or if a theft even occurred. If a hack did indeed take place, it is most likely that an independent hacker exploited a vulnerability to steal LuBian&#8217;s bitcoins, subsequently attracting the attention of the U.S. government,&#8221; experts speculated.\u00a0<\/em><\/p>\n<\/blockquote>\n<p>Back in August 2025, the attack on the mining pool <a href=\"https:\/\/forklog.com\/en\/news\/researchers-uncover-undisclosed-lubian-mining-pool-hack-involving-127426-btc\">was discovered<\/a>. Until Arkham Intelligence&#8217;s publication, neither LuBian representatives nor the hacker had publicly disclosed the breach.\u00a0<\/p>\n<p>The stolen amount represents the largest loss in the industry&#8217;s history.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>On October 15th, a wallet associated with the LuBian mining pool, hacked in 2020, became active. 9,757 BTC were moved.<\/p>\n","protected":false},"author":1,"featured_media":89927,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"select":"1","news_style_id":"1","cryptorium_level":"","_short_excerpt_text":"A wallet linked to LuBian pool moved 9,757 BTC after three years of dormancy.","creation_source":"","_metatest_mainpost_news_update":false,"footnotes":""},"categories":[3],"tags":[18,1246,26],"class_list":["post-89926","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news-and-analysis","tag-bitcoin","tag-scammers","tag-usa"],"aioseo_notices":[],"amp_enabled":true,"views":"295","promo_type":"1","layout_type":"1","short_excerpt":"A wallet linked to LuBian pool moved 9,757 BTC after three years of dormancy.","is_update":"","_links":{"self":[{"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/posts\/89926","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/comments?post=89926"}],"version-history":[{"count":1,"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/posts\/89926\/revisions"}],"predecessor-version":[{"id":89928,"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/posts\/89926\/revisions\/89928"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/media\/89927"}],"wp:attachment":[{"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/media?parent=89926"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/categories?post=89926"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/tags?post=89926"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}