- CoreX traced roughly 13 EH/s of diverted work to one address.
- Reports put the number of affected machines at an unconfirmed 64,000.
- Previously submitted work could earn rewards after operators restored pool settings.
A Bitcoin mining hijack diverted roughly 13 exahashes per second (EH/s) to the OCEAN mining pool on November 14, according to CoreX Hosting. The machines kept running, but one address received credit for work that belonged to their owners. Reports put the number of affected machines at about 64,000. Pool records confirm the shift in computing power but cannot establish a precise machine count.
How CoreX tracked the Bitcoin mining hijack overnight
CoreX alerted operators at 10:08 p.m. Eastern after it spotted unauthorized changes to miners’ pool settings. By 10:57 p.m., the flagged address still accounted for about 13 EH/s, even as CoreX worked to restore those settings.
At 1:40 a.m. on November 15, CoreX said the diversion appeared to be over. The address was down to about 100 petahashes per second, less than 1% of the rate CoreX had reported earlier.
The entry point for the Bitcoin mining hijack remains unconfirmed. One operator blamed Luxor Commander, a tool for managing mining fleets. CoreX declined to name the software it suspected, and no independent finding established that Commander was responsible.
Why OCEAN could still pay for work miners already submitted
For operators, the cost of the Bitcoin mining hijack was the time their machines spent earning credit for someone else. Restoring the settings directed future work back to the owners. It did not change who received credit for work already submitted.
OCEAN’s dashboard showed no payouts to the flagged address on Sunday morning. It separately estimated that eligible work could earn about 0.66 BTC before transaction fees. That estimate was neither a payment nor a verified measure of the owners’ losses.
Under OCEAN’s TIDES rules, a miner can share in a block reward even after disconnecting. If the pool finds a block while earlier work still qualifies, the address credited for that work can receive a share.
Disclaimer: This article is for informational purposes only and does not constitute financial advice. CoinCryptoNewz is not responsible for any losses incurred. Readers should do their own research before making financial decisions.
