Attackers hijack 64,000 bitcoin miners, divert 13 EH/s to OCEAN pool

Around 64,000 bitcoin mining machines had their pool configuration changed without authorization starting at about 20:00 US Central Time on November 14, with their combined ~13 EH/s of hashrate redirected to the OCEAN mining pool and block rewards pointed at a single attacker-controlled bitcoin address. The attackers mined no blocks during the window and received no payouts. Hosting firm CoreX Hosting first flagged the unauthorized pool changes, and the mining-management software Luxor Commander is a suspected, unconfirmed entry point. The diverted hashrate had fallen to roughly 100 PH/s by late November 15, per CoreX's follow-up, a reduction of more than 99 %.

What happened

CoreX Hosting, a bitcoin-mining infrastructure provider, said operators under its care noticed their machines had been switched to a different pool and payout address without their consent. The firm's public disclosure — mirrored by Crypto Briefing and Blockonomi — put the scale at about 64,000 ASICs and 13 EH/s, a figure Wu Blockchain also surfaced the same day on X.

OCEAN's public dashboard reflected the inbound diversion in real time. The pool's reported hashrate climbed to roughly 50 EH/s at the peak, then settled near 40 EH/s before falling back as the hijacked machines were recovered or switched off. OCEAN itself has not issued a public statement linking that spike to the incident; it was the destination pool, not the source of the compromise.

The payout address under the attacker's control received no bitcoin, because no block was mined during the window of control. All stolen value is in opportunity cost — the hashing time the victim operators would otherwise have billed through their own pools.

Mechanism

The attack did not exploit the ASICs themselves or the OCEAN pool protocol. It changed the pool URL and the reward-address fields in the machines' configurations, which is normally an operator-level setting accessed through a fleet-management dashboard. Several affected operators pointed to Luxor's Commander mining-management software as the suspected way in; one operator told reporters its entire facility was compromised. Neither Luxor nor CoreX has confirmed a specific vulnerability or disclosed a CVE.

If the Luxor Commander path holds up, the compromise is a management-plane breach, not a consensus-layer one: the attacker needed only to log into or inject commands into the control plane that already has permission to reconfigure the fleet. Earlier unauthorized pool changes reported by other operators in the days before November 14 would fit that pattern.

Impact

The direct financial loss is zero bitcoin for the attacker and lost mining revenue for the victim operators. At current network hashrate (~1.0 ZH/s) and current block subsidy (3.125 BTC plus fees), 13 EH/s represents roughly 1.3 % of total hashpower. A rough bound: a ~10-hour window at that share works out to about 0.6 expected blocks, so single-digit missed blocks per victim fleet is the order of magnitude. Operators will only recover it if their contracts or policies let them bill for hashrate delivered to an unauthorized destination, which is not the usual arrangement.

For OCEAN, the collateral damage is reputational. Its reported hashrate briefly looked like a sudden-growth story; it was an inbound flood of someone else's miners.

Numbers

• Machines hijacked: ~64,000
• Hashrate redirected: ~13 EH/s
• OCEAN dashboard peak: ~50 EH/s (vs. ~25–30 EH/s normal)
• Attack start: ~20:00 CT, November 14, 2026
• Attack end (per CoreX): hijacked hashrate ~100 PH/s by late November 15, >99 % reduction
• Blocks mined by the attacker's address: 0
• Reward paid to attacker address: 0 BTC

Action checklist for mining operators

1. Audit pool URL and payout-address fields across every machine in your fleet against the expected values; do not trust what the fleet dashboard shows, read the config directly on-machine.
2. Rotate any fleet-management-software credentials, especially Luxor Commander if in use, and require fresh MFA; invalidate active sessions.
3. Lock down the fleet-management network path — VPN or IP-allowlist the control plane and block its WAN-facing ports.
4. Watch for configuration-drift alerts: if your fleet management does not alert on pool/payout-address changes, add that check.
5. Reconcile expected-vs-delivered hashrate at your own pool for the November 14–15 window; any gap is the missed revenue to document for your hosting contract.

Context

Remote hijacks of mining fleets at exahash scale are rare — the usual mining-security story is firmware malware on infected ASICs or a cloud-mining Ponzi, not a coordinated pool-swap across tens of thousands of real machines. The last comparable mass pool-redirection wave hit Antpool and viabtc users via credential-stuffing attacks on fleet dashboards in 2022; what is new in 2026 is that a single management product — if the Luxor Commander hypothesis is confirmed — plausibly sits between an attacker and four percent-points of global hashrate in a single login.

OCEAN separately had a configuration-related hashrate-routing incident around the August 2026 BIP-110 chain-split that the pool acknowledged and refunded; that was a pool-software issue, distinct from this week's external compromise. The two together are a reminder that the thin stack between miner and chain — pool software, fleet-management SaaS, hosting APIs — is as much a mining-security surface as the machines themselves.