Roughly 13 exahashes per second of Bitcoin mining capacity was diverted to the OCEAN pool on Nov. 14 after an unauthorized change to pool settings, according to infrastructure provider CoreX Hosting, an incident that briefly pushed the pool's hashrate toward 50 EH/s but produced no block rewards for those responsible.
CoreX said it flagged the tampering at 10:08 p.m. Eastern and alerted affected operators. By 10:57 p.m., the address receiving credit for the diverted work still accounted for about 13 EH/s. The company reported at 1:40 a.m. on Nov. 15 that the diversion appeared to be over, with the flagged address down to roughly 100 petahashes per second, less than 1% of the earlier figure.
Reports circulating over the weekend put the number of affected machines at about 64,000, with the activity beginning around 8 p.m. U.S. Central Time. Pool records confirm the shift in computing power, but they cannot establish a precise machine count, and the 64,000 figure has not been independently verified.
Attackers also replaced the mining payout address with a Bitcoin wallet they controlled, so any rewards earned would have gone to them rather than to the machines' owners. OCEAN's dashboard briefly showed hashrate approaching 50 EH/s before retreating toward 40 EH/s, and later displayed 41.59 EH/s. That jump reflected redirected capacity rather than any expansion of Bitcoin's total mining power.
According to OCEAN's dashboard, no payouts had been made to the flagged address as of Sunday morning. The pool separately estimated that eligible work could be worth about 0.66 BTC before transaction fees, a figure that represents neither a payment nor a verified measure of what operators lost.
Under OCEAN's TIDES rules, a miner can still share in a block reward after disconnecting. If the pool finds a block while earlier submitted work remains eligible, the address credited for that work can receive a share. That mechanism means previously submitted work could earn rewards even after operators restored their pool settings, though whether that happens depends on the pool's future block discoveries.
The entry point for the breach remains unconfirmed. One affected operator blamed Luxor Commander, a tool used to manage mining fleets, but CoreX declined to name the software it suspects, and no independent finding has established that Commander was responsible. CoreX has said the incident was not linked to LuxOS itself.
Other operators reported similar unauthorized changes to pool configurations in the days before the Nov. 14 event, raising questions about whether the compromise extended beyond the machines identified in initial reports. Neither the full scope of the attack nor the alleged Commander vulnerability has received independent confirmation.
Despite controlling a substantial slice of network capacity, the attackers mined no Bitcoin blocks during the incident and collected no block rewards. Affected operators, by contrast, lost hashing time that could have generated revenue through their intended pools. Unlike redirected computing power, which can be pointed back to its owners, lost mining time cannot be recovered. Available reports did not quantify the financial damage or establish the total number of affected facilities.
Bitcoin's blockchain itself was not compromised. The incident targeted mining infrastructure and pool configurations rather than the network's consensus mechanism.
Note: Hashrate and payout figures are as reported by CoreX Hosting and OCEAN pool data; the machine count has not been independently verified.
The episode highlights how much leverage sits in fleet-management software, where a single configuration change can redirect tens of thousands of remotely controlled machines at once. For pool operators, it also illustrates the tension built into payout schemes that credit work already submitted: protecting honest miners from forfeiting rewards leaves room for a compromised address to claim a share.
For miners, the practical exposure is revenue timing rather than lost coins, since redirected hashrate can be pointed back to its owners. The larger question is security at the management layer, where credentials and remote-access tools concentrate control over large fleets. Until the entry point is established, operators have little basis for assessing whether the breach was confined to the machines identified over the weekend or reached further into the infrastructure that runs them.
Once added, BigGo Finance appears first in Google Search Top Stories, so you get the broadest, most up-to-the-minute, and most comprehensive global financial news first.
