About 64, 000 Bitcoin mining machines were reportedly redirected to the OCEAN pool, moving an estimated 13 exahashes per second (EH/s) of computing power. The attackers changed the payout address, but OCEAN reportedly mined no block during the incident, so the attackers received no block reward.
- Bitcoin’s blockchain was not compromised.
- Affected miners lost control of their intended mining setup; total losses are unknown.
- The entry point remains unclear, and a possible link to Luxor Commander is unconfirmed.
- The incident’s year is not clearly established.
What happened to the mining machines?
The reported diversion began around 8 p.m. U.S. Central Time on November 14. Bitcoin News reported that approximately 64, 000 machines, representing about 13 EH/s, were redirected to OCEAN. These are reported estimates, and the available account does not explain how the machine count was calculated.
Hashrate measures how quickly mining machines perform hash computations. One EH/s equals one quintillion hashes per second. The reported 13 EH/s refers to the computing power redirected. It does not indicate a change to Bitcoin’s rules or blockchain.
The attackers also replaced the mining payout address with a Bitcoin address they controlled. OCEAN reportedly mined no block during the incident window, so the attacker-controlled address received no block reward. The report provides no further details about the pool’s payout mechanics or how that conclusion was verified.
The lack of a block reward did not make the diversion harmless. Affected operators lost control over where their machines were pointed and where rewards would go. Their total lost revenue has not been quantified, and no recovery or compensation has been reported.
A mining infrastructure incident, not a Bitcoin breach
A mining pool coordinates work from multiple miners and distributes rewards according to its payout arrangements. Redirecting machines and changing a payout address can disrupt an operator’s revenue without changing Bitcoin’s consensus mechanism. That mechanism is how the network validates blocks and maintains its transaction history.
OCEAN’s reported total pool hashrate climbed toward 50 EH/s before settling near 40 EH/s. These figures refer to the pool’s overall hashrate, not just the approximately 13 EH/s said to have been redirected. The account does not say how the pool-wide figures were measured.
CoreX Hosting said the incident appeared to have ended on November 15. By then, the affected hashrate had dropped from around 13 EH/s to approximately 100 petahashes per second (PH/s). One EH/s equals 1, 000 PH/s.
The cause remains unknown
An affected operator reportedly suggested that Luxor Commander, a mining-management software product, might have been involved. The available account does not identify the operator, and the suspected connection has not been independently confirmed. For now, it is only a lead.
CoreX said the incident was not linked to LuxOS, another product associated with Luxor. That rules out a claimed connection to LuxOS, but does not explain how the machines were accessed or show whether Commander or another part of the mining operation was involved.
The timeline also has an unresolved date issue. The incident is described as beginning on November 14, but the year is not given. Wu Blockchain’s post summarizing the incident is dated November 15, 2026. That timestamp alone does not establish the year of the incident.
Key questions and answers
-
Was Bitcoin’s blockchain compromised?
No. The reported incident affected mining machines and pool configurations. Bitcoin’s blockchain and consensus rules were not compromised.
-
Did the attackers receive Bitcoin?
According to the report, no. OCEAN mined no block during the incident, so the attacker-controlled address received no block reward.
-
Did miners lose revenue?
Affected miners lost revenue while their machines were diverted, but the total has not been reported. No recovery or compensation has been reported either.
-
Was Luxor Commander responsible?
That has not been established. An affected operator reportedly raised it as a possibility, but the connection remains unconfirmed.
-
When did the incident end?
CoreX Hosting said it appeared to have ended on November 15, when the affected hashrate had fallen to about 100 PH/s. The year is not clearly specified.
The biggest unanswered questions are practical: how access was gained, how many operators were affected, and how much revenue they lost. Until those details are clear, claims about a specific software compromise or the full financial impact should be treated cautiously.
