Hackers seized control of roughly 64,000 Bitcoin mining machines in a coordinated attack, redirecting 13 exahashes per second (EH/s) of hashrate directly at the OCEAN mining pool. The perpetrators never mined a single block.
That 13 EH/s represents about two percent of Bitcoin's total network hashrate—a massive amount of compute. The attackers' choice of OCEAN is telling: the pool offers solo mining, which means any miner who finds a block gets the full reward, not a split. For someone controlling 13 EH/s of stolen hardware, solo mining looked like a fast path to a seven-figure payday. They got nothing.
The failure says something important about how hard it actually is to mine a block. Even with that much power, the odds are brutal. At any given moment, a solo miner with 13 EH/s competing against a network hashrate of roughly 650 EH/s has about a two percent shot at finding the next block. Over a few hours or even a day, the law of probability catches up. Mining pools exist because individual miners need to smooth out variance—pooling hashrate lets you collect smaller, frequent rewards instead of gambling on a jackpot.
The attackers likely assumed they could point stolen hashrate at OCEAN, mine a block or two in hours, and vanish with the Bitcoin. The reality was different. Mining difficulty adjusts every 2,016 blocks (roughly two weeks), and in the short term, luck is merciless. No block found means no reward, period. The attacker bore all the electricity costs and risked detection for nothing.
This also signals something about mining pool security. OCEAN and other pools monitor for anomalous hashrate spikes and can detect hijacked miners. Pools have advanced detection systems to flag suspicious activity—sudden jumps in hashrate from new sources, hardware behaving outside normal parameters, unusual submission patterns. The solo mining angle made the attack easier to execute technically, but it also made it easier to detect because solo miners are individually identifiable.
For mining operators, the lesson is blunt: secure your ASIC remote access. Hackers almost certainly compromised mining machines via exposed SSH ports, default credentials, or firmware vulnerabilities. If your miner is on the internet with a weak password, you will lose hashrate. The attack underscores why large-scale mining farms increasingly use out-of-band management networks, mandatory VPNs, and hardware-level security keys.
For Bitcoin hodlers and network participants, this reinforces a core insight: attacking Bitcoin's proof-of-work security is not worth the cost. Even when attackers could steal 13 EH/s of hardware, they still failed to extract value. The network's economic security model works. The cost of the electricity burn alone was substantial. The attacker likely lost money.
