In December 2020, cryptocurrency whale LuBian was dealt a crushing blow. This meant that he lost $3.5 billion worth of Bitcoins, 127,426 of them to be precise. Today, those coins are valued at more than $14 billion. Arkham Intelligence, a blockchain research firm, had previously alleged they had uncovered the specifics behind the major theft. Until today, this incident was cloaked in secrecy. The case marks the largest Bitcoin heist ever discovered. It underscores the critical need for vigorous security protections in the digital asset space.
The vulnerability that made this unprecedented heist possible was rooted in an apparent deficiency in LuBian’s private key generation. His wallet software had an algorithm which used only 32 bits of entropy. This level of security is woefully inadequate to secure a wealth of that magnitude. Yet this security oversight produced an opening for malicious actors to exploit. They took advantage of the weak key and stole almost all of LuBian’s assets.
The Scale of the Theft
The LuBian theft is particularly unique given the magnitude of the theft vis-a-vis other major incidents in Bitcoin’s short history. At $3.7 billion in Bitcoin stolen alone, the overall loss vastly eclipses nearly every other notable hack. After the theft, LuBian was left with only 12,000 BTC in his possession, illustrating the profound effect of the security breach.
Their members’ stolen funds, 127,426 BTC, have continued to sit since the December 2020 hack. This uncommon lack of action fuels the interest in this mysterious case. Investigators can only guess at the attack’s intent and future use of such a large cache. The coins just sit there, earning interest on a smart business play. This would presumably be to prevent being caught out and identifying the criminals involved.
Attempts at Communication
In a last-ditch effort to reclaim his purloined wares, LuBian followed through on his invasion and reached out to the aggressor. To mess with them, he began sending all 1,500 of these microtransactions loaded with bargaining messages to the pickpocket. This unconventional strategy helps illustrate just how far LuBian was willing to push the envelope. His intent was clear — to speak directly to whoever stole his bike.
The attacker never replied and recovered stolen Bitcoins were always just out of reach. After these initial attempts at messaging backfired, LuBian withdrew from all social appearances. This decision further inflamed speculation and added to the enigma of the case. The ongoing silence from all parties has only compounded the mystery and interest surrounding this historic theft.
Lessons Learned
The LuBian case serves as a stark reminder of the potential consequences of inadequate security measures in the cryptocurrency world. It is a reminder of how easy it is for technical vulnerabilities to facilitate large-scale poaching that can go unnoticed for years. A strong private key generation algorithm was not LuBian’s security panacea. This grave defect led to the needless waste of billions of dollars.
Arkham Intelligence’s exposure of the LuBian theft offers an important reminder to all those participating in the digital asset space. Concerted attention and smart security priorities are needed to keep our nation’s treasures safe. Cryptocurrencies are entering the mainstream more each day. It’s time for individuals and institutions alike to make enterprise-level security a top priority and be vigilant to new threats on the horizon. The LuBian case serves as a cautionary tale. Perhaps most importantly, through its extensive educational resources, the Act urges everyone to remain vigilant and take steps to protect valuable digital assets from theft and misappropriation.
