Crypto Journalist

Amin Ayan

Crypto Journalist

Amin Ayan

About Author

Amin Ayan is a crypto journalist with over four years of experience in the industry. He has contributed to leading publications such as Cryptonews, Investing.com, 99Bitcoins, and 24/7 Wall St. He has…

Share

Last updated: 

August 3, 2025

A massive Bitcoin theft from 2020 has surfaced nearly four years later, and it’s now being called the largest crypto heist ever uncovered.

On Saturday, blockchain analytics firm Arkham Intelligence reported that 127,426 BTC, valued at around $3.5 billion at the time and nearly $14.5 billion today, was stolen from Chinese mining pool LuBian in December 2020.

LuBian rose quickly in early 2020, becoming the sixth-largest mining pool on the Bitcoin network by mid-year.

Its website promoted it as “the safest high yielding mining pool in the world.”

LuBian Vanished in 2021, Sparking Speculation of Shutdown

By February 2021, LuBian had disappeared without explanation, fueling speculation that it was either shut down by authorities or quietly converted into a private pool.

Arkham’s investigation points to a more dramatic exit: a hack that drained the pool’s holdings.

“They appear to have been first hacked on December 28th, 2020 for over 90% of their BTC,” Arkham wrote.

The following day, attackers siphoned off another $6 million in BTC and USDT from a LuBian-linked address on the Bitcoin Omni layer.

The firm believes the Bitcoin theft stemmed from vulnerabilities in LuBian’s private key generation system, which may have allowed brute-force attacks.

While 11,886 BTC, worth roughly $1.35 billion, remains untouched in LuBian’s wallet, none of the stolen coins have moved since July 2024.

Interestingly, LuBian attempted to communicate with the attacker using Bitcoin’s OP_RETURN feature.

In two transactions, the team wrote: “To the whitehat who is saving our asset, you can contact us… to discuss the return of asset and your reward.”

The message included an email address, but it’s unclear if the hacker ever replied.

While the Mt. Gox collapse involved more BTC, the LuBian breach is the largest confirmed crypto theft by value at the time of the incident.

Bitcoin Hacks, Theft Cost Investors $2.2B in H1 2025: CertiK

Crypto investors lost over $2.2 billion to hacks, scams, and breaches in the first half of 2025, driven largely by wallet compromises and phishing attacks, according to CertiK’s latest security report.

Wallet breaches alone caused $1.7 billion in losses across just 34 incidents, while phishing scams accounted for over $410 million across 132 attacks.

Two major incidents, including Bybit’s $1.5 billion hack in February and Cetus Protocol’s $225 million exploit in May, skewed the year’s losses upward, together accounting for nearly $1.78 billion.

Without these, losses align more closely with previous years at around $690 million.

Ethereum remained the primary target, suffering over $1.6 billion in losses across 175 events.

The report also pointed to rising sophistication of phishing schemes and ongoing risks from social engineering, urging crypto users to verify links, avoid suspicious sites, and use hardware wallets.

A wave of data breaches impacting companies like Qantas, Allianz Life, LVMH, and Adidas has been linked to the ShinyHunters extortion group, which has been using voice phishing attacks to steal data from Salesforce CRM instances.

In June, Google’s Threat Intelligence Group (GTIG) warned that threat actors tracked as UNC6040 were targeting Salesforce customers in social engineering attacks.

In these attacks, the threat actors impersonated IT support staff in phone calls to targeted employees, attempting to persuade them into visiting Salesforce’s connected app setup page. On this page, they were told to enter a “connection code”, which linked a malicious version of Salesforce’s Data Loader OAuth app to the target’s Salesforce environment.

In some cases, the Data Loader component was renamed to “My Ticket Portal,” to make it more convincing in the attacks.

GTIG says that these attacks were usually conducted through vishing (voice phishing), but credentials and MFA tokens were also stolen through phishing pages that impersonated Okta login pages.

Around the time of this report, multiple companies reported data breaches involving third-party customer service or cloud-based CRM systems.

LVMH subsidiaries Louis Vuitton, Dior, and Tiffany & Co. each disclosed unauthorized access to a customer information database, with Tiffany Korea notifying customers the attackers breached a “vendor platform used for managing customer data.”

Adidas, Qantas, and Allianz Life also reported breaches involving third-party systems, with Allianz confirming it was a third-party customer relationship management platform.

“On July 16, 2025, a malicious threat actor gained access to a third-party, cloud-based CRM system used by Allianz Life Insurance Company of North America (Allianz Life),” an Allianz Life spokesperson told BleepingComputer.

While BleepingComputer has learned that the Qantas data breach also involved a third-party customer relationship management platform, the company will not confirm it is Salesforce. However, previous reporting from local media claims the data was stolen from Qantas’ Salesforce instance.

Furthermore, court documents state that the threat actors targeted “Accounts” and “Contacts” database tables, both of which are Salesforce objects.

While none of these companies have publicly named Salesforce, BleepingComputer has since confirmed that all were targeted in the same campaign detailed by Google.

The attacks have not led to public extortion or data leaks yet, with BleepingComputer learning that the threat actors are attempting to privately extort companies over email, where they name themselves as ShinyHunters.

It is believed that when these extortion attempts fail, the threat actors will release stolen information in a long wave of leaks, similar to ShinyHunter’s previous Snowflake attacks.

Who is ShinyHunters

The breaches have caused confusion among the cybersecurity community and the media, including BleepingComputer, with the attacks attributed to Scattered Spider (tracked by Mandiant as UNC3944), as those threat actors were also targeting the aviation, retail, and insurance sectors around the same time and demonstrated similar tactics.

However, threat actors associated with Scattered Spider tend to perform full-blown network breaches, culminating with data theft and, sometimes, ransomware. ShinyHunters, tracked as UNC6040, on the other hand, tends to focus more on data-theft extortion attacks targeting a particular cloud platform or web application.

It is BleepingComputer’s and some security researchers’ belief that both UNC6040 and UNC3944 consist of overlapping members that communicate within the same online communities. The threat group is also believed to overlap with “The Com,” a network of experienced English-speaking cybercriminals.

“According to Recorded Future intelligence, the overlapping TTPs between known Scattered Spider and ShinyHunters attacks indicate likely some crossover between the two groups,” Allan Liska, an Intelligence Analyst for Recorded Future, told BleepingComputer.

Other researchers have told BleepingComputer that ShinyHunters and Scattered Spider appear to be operating in lockstep, targeting the same industries at the same time, making it harder to attribute attacks.

Some also believe that both groups have ties to threat actors from the now-defunct Lapsus$ hacking group, with reports indicating that one of the recently arrested Scattered Spider hackers was also in Lapsus$.

Another theory is that ShinyHunters is acting as an extortion-as-a-service, where they extort companies on behalf of other threat actors in exchange for a revenue share, similar to how ransomware-as-a-service gangs operate.

This theory is supported by previous conversations BleepingComputer has had with ShinyHunters, where they claimed not to be behind a breach, but just acting as the seller of the stolen data.

These breaches include PowerSchool, Oracle Cloud, the Snowflake data-theft attacks, AT&T, NitroPDF, Wattpad, MathWay, and many more.

To muddy the waters further, there have been numerous arrests of people linked to the name “ShinyHunters,” including those who have been arrested for the Snowflake data-theft attacks, breaches at PowerSchool, and the operation of the Breached v2 hacking forum.

Yet even after these arrests, new attacks occur with companies receiving extortion emails stating, “We are ShinyHunters,” referring to themselves as a “collective.”

Protecting Salesforce instances from attacks

In a statement to BleepingComputer, Salesforce emphasized that the platform itself was not compromised, but rather, customers’ accounts are being breached via social engineering.

“Salesforce has not been compromised, and the issues described are not due to any known vulnerability in our platform. While Salesforce builds enterprise-grade security into everything we do, customers also play a critical role in keeping their data safe — especially amid a rise in sophisticated phishing and social engineering attacks,” Salesforce told BleepingComputer.

“We continue to encourage all customers to follow security best practices, including enabling multi-factor authentication (MFA), enforcing the principle of least privilege, and carefully managing connected applications. For more information, please visit: https://www.salesforce.com/blog/protect-against-social-engineering/.”

Salesforce is urging customers to strengthen their security posture by:

• Enforcing trusted IP ranges for logins
• Following the principle of least privilege for app permissions
• Enabling multi-factor authentication (MFA)
• Restricting use of connected apps and managing access policies
• Using Salesforce Shield for advanced threat detection, event monitoring, and transaction policies
• Adding a designated Security Contact for incident communication

Further details on these mitigations can be found in Salesforce’s guidance linked above.

Trusted Editorial content, reviewed by leading industry experts and seasoned editors. Ad Disclosure

Pump.fun former employee Jarett Dunn has been remanded to a London prison after breaching the terms of a bail agreement. The Canadian and popular crypto figure is currently undergoing trial after stealing $2 million from the Solana meme coin factory.

Dunn Settles For Prison, Hints At Accepting Guilty Plea

In May 2024, Jarett Dunn, a developer at Pump.fun, drained the platform of almost $2 million in SOL, which was diverted to multiple addresses. Thereafter, Dunn started distributing this stolen wealth to several wallets holding Solana memecoins or NFTs, allowing the Canadian to gain some following in the crypto community.

Notably, Jarett Dunn took responsibility for the exploits within minutes of the operation, citing reasons such as a hostile work environment and inappropriate mentality towards user funds. Dunn accused Pump.fun of several crimes, including operating as an unregistered securities exchange and casino, alongside suggestions of child abuse intentions.

The former Pump.fun employee was immediately arrested but soon released on bail. In October 2024, Jarett Dunn pleaded guilty to the crypto theft but soon requested to withdraw this plea while awaiting sentencing. This action resulted in Dunn losing his legal team while under a strict bail condition that involved movement restriction.

However, in June 2025, Jarett Dunn breached this bail agreement in a sudden, unauthorized move from London to Liverpool while also tampering with his ankle monitor. The ex-Pump.fun developer was soon apprehended and now sits in a London prison awaiting a hearing.

According to recent posts on Dunn’s X account under the alias @STACCoverflow, the Canadian appears to have made peace with staying in prison, hinting at accepting the guilty plea again and terminating his withdrawal request. @STACCoverflow is reportedly managed by Dunn’s friend Mark Kelly, who has reportedly been communicating with the developer since his recent incarceration.

Dunn Stares At 10-Year Sentence While Pump.fun Celebrates ICO

In the UK, fraud by abuse of position where the value exceeds £500,000 ($640,000) can result in a maximum sentence of 10 years. While a bail breach attracts remand in prison until hearing or an additional 12 months’ jail time if prosecuted as a separate offence. However, such factors as an early guilty plea and purported health issues may help mitigate sentences in the case of Jarett Dunn.

Meanwhile, Pump.fun just recently concluded its initial coin offering (ICO) process, raising about $600 million in the process. The Solana memecoin factory is now valued at over $6 billion following resounding success, such as Moo Deng (MOODENG), Fart Coin (FARTCOIN), Peanut The Squirrel (PNUT), etc.

Featured image from Pexels, chart from Tradingview

Editorial Process for bitcoinist is centered on delivering thoroughly researched, accurate, and unbiased content. We uphold strict sourcing standards, and each page undergoes diligent review by our team of top technology experts and seasoned editors. This process ensures the integrity, relevance, and value of our content for our readers.

Nearly half of the US population has been impacted by data breaches in the first half of 2025 alone, according to a new report from the Identity Theft Resource Center (ITRC).

The ITRC says 1,732 data compromises were reported in the US in H1 2025, which impacted 165,745,452 individuals.

“Analysis of data from the first six months of the year reveals a landscape dominated by cyberattacks, with supply chain vulnerabilities persisting as a major threat vector. While the total number of compromises has not dramatically outpaced previous years, the impact on victims remains severe.”

There are currently around 342 million people in the US, according to the U.S. Census Bureau.

The ITRC says there’s been a rise in artificial intelligence (AI)-powered phishing attacks, which are more difficult to detect, and other new threats to personal information.

“The introduction of repackaged and recirculated personal information – PCD (previously compromised data) – into the risk environment represents a significant new threat to organizations that are vulnerable to the use of stolen logins and passwords to gain access to mission-critical systems for ransom attacks and/or data exfiltration. The recent discovery of an unsecured cloud environment with more than 16 billion logins and passwords aggregated into a single database is an example of PCD.”

Follow us on X, Facebook and Telegram

Don’t Miss a Beat – Subscribe to get email alerts delivered directly to your inbox

Check Price Action

Surf The Daily Hodl Mix

&nbsp

Disclaimer: Opinions expressed at The Daily Hodl are not investment advice. Investors should do their due diligence before making any high-risk investments in Bitcoin, cryptocurrency or digital assets. Please be advised that your transfers and trades are at your own risk, and any losses you may incur are your responsibility. The Daily Hodl does not recommend the buying or selling of any cryptocurrencies or digital assets, nor is The Daily Hodl an investment advisor. Please note that The Daily Hodl participates in affiliate marketing.

Generated Image: Midjourney

A scammer pleaded guilty after participating in a scheme that convinced the Internal Revenue Service (IRS) to pay out $10 million in fraudulent refunds.

Brooklyn resident Xerxes Shevar, 57, was part of a prolific international conspiracy ring involving scammers in the United States, Ghana, Nigeria and Ireland, according to the U.S. Attorney’s Office for the Western District of Pennsylvania.

The US Attorney says the conspirators obtained stolen identity info on the internet and then submitted fraudulent federal tax returns under the names of those identities. The alleged scammers also opened bank accounts in those names to receive the returns from the IRS.

One of Shevar’s co-conspirators alleges the scam ring attempted to secure around $38 million from the IRS between the tax years 2010 and 2013 and ended up receiving more than $10 million.

The scammers allegedly used stolen identities to open 3,493 bank accounts and obtain 4,563 credit cards across 443 financial institutions. In all, the scam ring allegedly victimized 11,468 individuals.

Shevar was arrested in February 2024 when he returned to the United States from Ghana. The Brooklyn resident was convicted of wire fraud conspiracy, and US District Judge Susan Paradise Baxter sentenced him earlier this month to three years of probation. The judge also ordered him to pay $290,000 in restitution.

Follow us on X, Facebook and Telegram

Don’t Miss a Beat – Subscribe to get email alerts delivered directly to your inbox

Check Price Action

Surf The Daily Hodl Mix

&nbsp

Disclaimer: Opinions expressed at The Daily Hodl are not investment advice. Investors should do their due diligence before making any high-risk investments in Bitcoin, cryptocurrency or digital assets. Please be advised that your transfers and trades are at your own risk, and any losses you may incur are your responsibility. The Daily Hodl does not recommend the buying or selling of any cryptocurrencies or digital assets, nor is The Daily Hodl an investment advisor. Please note that The Daily Hodl participates in affiliate marketing.

Generated Image: Midjourney

They said the teenager might try to escape the country before sentencing, and that people he worked with could help him do it.

Recent unsealed documents revealed that Chatel pleaded guilty in Washington, DC, to participating in a 2024 scheme involving wire fraud and money laundering. The case centers on a large-scale Bitcoin theft carried out through fake tech support calls.

Did you know?

Want to get smarter & wealthier with crypto?

Subscribe – We publish new crypto explainer videos every week!

10 Biggest Crypto Scams & How to Avoid Them (ANIMATED)

According to ZachXBT’s post on X, Chatel would call victims pretending to be from a company’s help desk. He would guide them through a process that gave his team access to their accounts.

Once inside, the attackers would trick victims into revealing their crypto wallet details. They then transferred the funds from Gemini

$328.55M

Authorities stated that Chatel used professional money launderers to hide the stolen funds. Along with his co-conspirators, Malone Lam and Jeandiel Serrano, he spent the money on watches, designer clothing, and several cars.

When the FBI searched his home, they found about $37 million in crypto connected to the heist. Officials also believe he defrauded around 50 more people, which generated another $3 million for himself.

As part of his plea deal, Chatel agreed to give up luxury goods purchased with the stolen money. He is expected to face between 19.5 and 24.5 years in prison, along with a fine that could range from $50,000 to $500,000.

Meanwhile, Global Ledger and Recoveris, in collaboration with Reuters, recently found that Russia’s Federal Security Service (FSB) has been using Bitcoin to pay a Canadian teenager. What was the FSB’s motive? Read the full story.