SECURITY ALERT · UPDATE 1
The vendor stayed silent most of the day.
The chain kept its own record.
Luxor, the mining software and services company, said on X at 17:25 UTC on Sunday that an unauthorised redirect of hashrate ran through Commander, its tool for managing fleets of mining machines. That is the software outlets and operators had named as a suspect since the overnight hijack to OCEAN we reported earlier.
Five minutes before that post, OCEAN found a block whose reward included a payment to the attacker’s address.
Who has been paid, and who has not?
What Luxor says
Luxor’s post says “just over a dozen client accounts” were affected and that their machines “were pointed to a different pool for a limited window”.
It says no data was leaked or exfiltrated from its systems.
It says Commander was patched within two hours of its monitoring raising the alarm, and that it started restoring machines to their original pool settings.
It says “every affected client will be paid in full for the redirected hashrate, as if it had mined normally.”
It says Commander is operating normally, that users need take no action, and that it will share a full post-mortem. It has not said when.
At 17:17 UTC, a post from NickH (@hash_bender), whom Bitcoin News identifies as Luxor’s chief executive, said a subset of Commander customers were compromised around 6:00 p.m. PDT on Saturday “through a sophisticated AI-enabled vector”. That post gives no further detail, and Luxor’s own statement does not use those words.
We do not know how the attacker got in. We do not know how many machines were involved.
Luxor’s account is a company statement. Nobody independent has yet checked the numbers.
How much hashrate did a dozen accounts control?
What the chain shows
OCEAN’s block 975,995 was found at 17:20 UTC by another OCEAN user, according to OCEAN’s public API. Its coinbase transaction, 07ff9e20…98d1, has 19 outputs on mempool.space.
One of them, 8,088,977 sats, or 0.0809 BTC, pays the attacker address named by CoreX:
bc1qphukp9rjfc4rcej7erpm9ae20xmtspw8pcddrr
That is about $5,260 at Kraken’s 20:45 UTC price of $64,983, by our calculation.
The attacker did not find the block. OCEAN’s TIDES scheme pays every address with shares in its window, and this address still had some.
At 14:45 UTC, we noted OCEAN’s API projected 0.0809 BTC from the next block. The actual payment was within 0.02% of that.
As of 20:55 UTC the output has not moved. The address has one transaction, this one.
OCEAN’s API still showed the address receiving about 2.6 PH/s from 12 workers at about 20:50 UTC, and still listed it with 2.6% of the shares in the window. It projected 0.0810 BTC from the next block. We cannot tell whether those are machines Luxor has not yet restored.
We found no statement from OCEAN on whether it will void or reclaim any of this.
If the shares stay in the window, how much more will the next block pay?
What is still unknown
How the attacker reached Commander. What the “AI-enabled vector” was. Which clients were hit, and what they lost.
Whether the earlier unauthorised pool switches BlockBeats reported days before were the same incident. We have not verified those.
It comes in a week when bitcoin’s difficulty fell 9.13% on Friday and a default Grafana password was behind the Chainstack breach. Both were ordinary doors.
Does a promise to pay cover the hashrate, or the trust?
Protect yourself
- If you manage machines with Commander or similar fleet software, check the pool URL and payout address on every machine, not only the dashboard summary.
- Rotate the credentials and API keys the management tool holds, and turn on any two-factor option it offers.
- Watch pool-side hashrate. A sudden change in your own workers is often the first sign.
- Keep your own records of hashrate for the period, so you can document any compensation claim.
Corrections and new evidence: [email protected]
This article is for information only and is not investment advice.