Attackers hijack about 64,000 Bitcoin miners and point 13 EH/s at OCEAN

Someone took control of approximately 64,000 Bitcoin mining machines on November 14, 2026. They redirected roughly 13 EH/s of hashing power to the OCEAN mining pool.

The attackers didn’t earn anything for their trouble. No blocks were mined, and their payout address received no payments. The miners whose machines were hijacked weren’t so lucky: their lost revenue is gone for good.

How the hijacking unfolded

The incident began at approximately 8 p.m. Central Time. It showed up fast in public data, because OCEAN’s reported hashrate jumped sharply.

The pool’s hashrate climbed to approximately 50 EH/s. It then settled at around 40 EH/s.

The surge didn’t last. The diverted power later fell to about 100 PH/s. A petahash is one-thousandth of an exahash, so most of the hijacked machines had been pulled back, or otherwise dropped off, within a short window.

All of the redirected output went to a single attacker-controlled payout address. That address never received a payment.

A suspected software weak point

Operators first learned about the problem from CoreX Hosting. The hosting firm spotted unauthorized changes to pool settings on the affected machines.

One operator said their entire mining operation was hit. The suspected entry point is Luxor Commander, a software tool used to manage mining fleets. That link remains a suspicion rather than a confirmed finding.

This also may not have been a one-off. Reports had already surfaced of unauthorized pool changes in the days before the November 14 incident.

Why this matters even though no Bitcoin was stolen

Every minute those machines worked for the attackers was a minute they weren’t earning for their owners’ pools. That revenue can’t be clawed back. Mining income depends on contributing work in real time, and once that time passes, the opportunity is gone.

The bigger story concerns the attack surface itself. Bitcoin’s protocol didn’t fail here. Nothing about the network’s consensus rules was broken. What failed, if the suspicions hold, was the operational software that sits between a mining company and its hardware.

Here the redirected power landed on a legitimate pool, and the attackers aimed for payouts, not disruption. Still, the episode shows how quickly a large block of hashrate can be moved without the owners’ consent.

What to watch next

For mining operators, the most immediate question is the entry point. If Luxor Commander is confirmed as the vulnerability, anyone running it will want to know what was exposed and whether a fix is available.

Until that is clear, operators may want to audit their pool settings frequently. CoreX Hosting caught this because someone noticed the settings had changed.

The earlier reports of unauthorized pool changes deserve attention too. If attackers were probing or testing access in the days before the main event, the November 14 incident may not mark the end of it.