LuBian-Linked Wallet Moves $1.1 Billion in Bitcoin Amid US Confiscation News

Executive Summary

A wallet associated with the LuBian mining pool, dormant for three years, transferred 9,757 Bitcoin (BTC), valued at approximately $1.1 billion, to a new address. This activity transpired one day after reports indicated that the U.S. government is seeking to confiscate 127,271 BTC, approximately $14.4 billion, allegedly stolen from LuBian in a 2020 security breach. The events underscore the persistent challenges in asset recovery following large-scale cryptocurrency thefts and highlight ongoing disputes regarding the control of these digital assets.

The Event in Detail

According to monitoring by Lookonchain, the specific LuBian wallet, identified by the address 39DUz, became active after a three-year period of dormancy. On [Date of event], the wallet initiated a transfer of its entire holding of 9,757 BTC to a newly designated address. This movement represents a significant volume of capital, amounting to approximately $1.1 billion at current market valuations. The transfer coincided with public disclosure regarding the U.S. government's intent to confiscate a much larger sum, 127,271 BTC, which is linked to the original 2020 LuBian security incident. The 2020 theft saw 127,426 BTC, then valued at $3.5 billion, drained from LuBian, a mining operation that once controlled nearly 6% of global Bitcoin mining capacity. The hack was attributed to a weakness in LuBian's cryptographic key generation algorithm. Following the breach, LuBian reportedly sent numerous transactions to the hacker's wallets, embedding messages requesting the return of funds for a reward.

Government Actions and Disputed Holdings

The U.S. Department of Justice (DOJ) announced in October 2025 the seizure of approximately 127,271 BTC, then valued at $15 billion, as part of an indictment against Prince Group chairman Chen Zhi for wire fraud and money laundering. The DOJ asserted that these seized Bitcoins were the same funds "stolen" from LuBian in 2021, and they had moved into U.S. authorities' custody in June and July 2024. This action marked the largest forfeiture in U.S. government history. However, Arkham Intelligence has concurrently reported that the original exploiter from the December 2020 LuBian attack still retains control over 127,426 BTC, valued at over $14.5 billion, which has reportedly remained untouched since a wallet consolidation in July 2024. These contrasting claims regarding the whereabouts and ownership of the stolen LuBian funds highlight the complex nature of digital asset forensics and international legal jurisdiction in cryptocurrency crime. The 9,757 BTC movement from wallet 39DUz appears distinct from both the DOJ seizure and the primary hacker's reported holdings, adding another layer to the ongoing saga surrounding LuBian's assets.

Market Implications

The sudden movement of a substantial amount of Bitcoin from a LuBian-associated wallet introduces potential for increased market volatility, particularly if the funds are moved to exchanges for liquidation. Such events tend to create uncertainty among investors and can trigger short-term price fluctuations. More broadly, the ongoing developments surrounding the LuBian hack, including the U.S. government's confiscation efforts and the persistent presence of reported hacker holdings, reinforce the heightened regulatory scrutiny facing the cryptocurrency market. Law enforcement agencies are increasingly active in tracking and attempting to recover stolen digital assets, which, while aiming to enhance market integrity, also underscores the inherent risks associated with large-scale crypto holdings. Data from Beosin KYT indicates that only a small fraction, approximately 11.1%, of stolen funds in the first half of 2025 were frozen or recovered, with hackers increasingly utilizing mixers to obscure transaction origins, posing significant challenges for recovery efforts.

Broader Context

The LuBian incident serves as a significant case study in the broader narrative of cybersecurity vulnerabilities within the Web3 ecosystem. The sheer volume of Bitcoin involved, combined with the prolonged dormancy of some associated wallets and the international dimensions of the recovery efforts, illustrates the complexities inherent in securing and tracing digital assets. The contrasting reports from Arkham Intelligence and the U.S. Department of Justice regarding the definitive custody of the stolen funds underscore the nascent stage of legal and technical frameworks for managing large-scale crypto thefts. This evolving landscape necessitates continuous advancements in blockchain forensics, international cooperation among law enforcement agencies, and enhanced security protocols within mining operations and exchanges to safeguard digital assets and maintain investor confidence.