Approximately 64,000 Bitcoin mining machines were redirected to the OCEAN mining pool on November 14, sending an estimated 13 exahashes per second (EH/s) of computing power to the pool without their owners’ permission.
The incident began at about 8 p.m. Central Time and was quickly visible in public mining data. OCEAN’s reported hashrate surged to around 50 EH/s before settling near 40 EH/s. The redirected computing power later dropped to approximately 100 petahashes per second (PH/s)—a small fraction of an exahash—suggesting that most of the affected machines had been returned to their original settings or had otherwise stopped contributing to the pool.
The attackers appear to have gained no mining rewards. No blocks were mined during the incident, and the single attacker-controlled payout address that received the redirected output was not paid. The affected machine owners, however, may have permanently lost revenue generated while their equipment was working for the wrong pool. Mining rewards depend on computing work contributed in real time; that lost opportunity cannot be recovered afterward.
Operators first became aware of the problem after CoreX Hosting detected unauthorized changes to pool settings on affected machines. One mining operator said their entire operation had been hit. Luxor Commander, software used to manage mining fleets, is suspected as a possible entry point, but that connection has not been confirmed.
The incident may also follow earlier signs of unauthorized activity. Reports of mining machines being switched to different pools had surfaced in the days before November 14, raising the possibility that the attack was part of a broader or continuing effort.
The episode did not involve a failure of Bitcoin’s protocol or its consensus rules. Instead, it points to risks in the operational systems used to manage mining hardware. The machines were directed to a legitimate pool, and the apparent aim was to redirect potential payouts rather than disrupt the Bitcoin network. Even so, the incident shows how quickly a large amount of mining power can be moved without its owners’ consent.
For mining operators, identifying how the pool settings were changed is now a priority. If Luxor Commander is confirmed as the point of entry, users will need to know what was exposed and whether a security fix is available. Until the cause is established, operators may consider checking pool configurations regularly. CoreX Hosting detected the incident after noticing that the settings had changed, while the earlier reports of unauthorized pool switches warrant further attention.
