SECURITY ALERT
Nobody touched a wallet.
They changed one line in the miners’ settings.
Bitcoin mining machines were switched without their owners’ consent overnight into Sunday and pointed at the OCEAN mining pool, with rewards set to pay a single Bitcoin address, according to CoreX Hosting, a mining host that raised the first public alarm.
At its peak the redirected hashrate (the computing power miners contribute) was about 13 EH/s, CoreX said. That is roughly 1.4% of the network’s 930 EH/s three-day estimate on mempool.space, by our calculation.
The X account Bitcoin News put the number of machines at about 64,000. That is an estimate. We have not been able to check it.
Nobody has said who did it. Nobody has confirmed how.
How many owners still don’t know their machines were working for someone else?
The timeline
Reports put the start at about 8 p.m. US Central time on 14 Nov, which is 02:00 UTC on 15 Nov (TokenPost, citing Bitcoin News).
At 03:08 UTC, CoreX posted the alert and the address the miners were paying:
bc1qphukp9rjfc4rcej7erpm9ae20xmtspw8pcddrr
At 03:57 UTC, CoreX said the attack was still running, with the address still at 13 EH. It said it was switching its own machines back and thought it had isolated the program used. It has not named it.
At 06:40 UTC, CoreX wrote “It is over”, with the address down to about 100 PH/s.
BlockBeats reported that OCEAN’s dashboard showed the pool’s hashrate briefly near 50 EH/s before it fell back to about 40 EH/s.
Was this the first wave, or only the first one anyone noticed?
What OCEAN’s own data show
The address has never received a payment. Mempool.space shows no transactions to it at 14:45 UTC.
OCEAN’s last block before the attack was 975,869, at 01:00 UTC, about an hour before the reported start. Its public block list shows none since.
That is why reports say the attacker earned nothing.
That may not stay true.
OCEAN pays miners under a scheme it calls TIDES. Shares stay in a payout window and are paid each time the pool finds a block.
At 14:45 UTC, OCEAN’s public API still credited the address with about 2.6% of the shares in that window. It estimated a payout of 0.0809 BTC from the next block, about $5,200 at Kraken’s price at the time.
The API also showed the address still receiving a trickle of hashrate, about 3.5 PH/s.
We found no public statement from OCEAN on whether it will pay or void those shares.
If the pool finds a block tonight, who gets paid?
What is not known
The cause. Operators replying to CoreX on X have blamed third-party fleet-management software. No vendor has confirmed a breach, CoreX has declined to name one, and we are not repeating unconfirmed claims.
BlockBeats reported that other operators saw similar unauthorised pool switches a few days earlier. We have not verified that.
The bill. Owners lost the hours their machines spent hashing for someone else, on a week when bitcoin’s difficulty fell 9.13% on Friday as hashrate retreated.
This week also brought a default Grafana password at Chainstack. Our Sunday column, The Spare Key Week, was about exactly this kind of door.
Who else had the login?
Protect yourself
- Check the pool URL and payout address on every machine, not just the dashboard summary.
- Change passwords on miners and on any remote-management tool, and turn off remote access you do not use.
- Keep miners off the open internet, behind a firewall or VPN.
- Watch pool-side hashrate. A sudden drop is often the first sign.
Corrections and new evidence: [email protected]
This article is for information only and is not investment advice.