CoreX Reports Bitcoin Mining Power Hijacked to OCEAN

Bitcoin mining host CoreX Hosting reported that roughly 13 exahashes per second of mining power had been redirected without authorization to the OCEAN pool under an address it identified as the hacker’s. The diverted power fell sharply overnight, but the work submitted could still generate payments to that address.

CoreX warned at 10:08 p.m. ET on Nov. 14 that miners were being pointed at OCEAN with a specific Bitcoin address. At 10:57 p.m., it said the address still had about 13 EH/s of hashrate — a measure of computing power devoted to mining — while it was restoring miners’ settings.

“On my end, I am changing miners back as I can,” CoreX wrote.

By 1:40 a.m. ET on Nov. 15, CoreX declared the attack over, saying the flagged address was down to about 100 petahashes per second. That establishes the sequence of its response, rather than the exact start and end of every affected machine’s diversion.

OCEAN’s statistics for the address corroborated the retreat: a Sunday morning snapshot showed a three-hour average of 13.7 PH/s, compared with a 24-hour average of 1.41 EH/s. Those are rolling averages, not measurements of the attack’s peak or precise duration. The number of physical machines affected remains unconfirmed; OCEAN explicitly warns that its workers are not necessarily individual machines.

For owners, the immediate consequence was that machines were doing work credited to someone else’s address rather than their own. OCEAN’s setup instructions explain the mechanism: miners connect to the pool and use a Bitcoin address as their username. Changing that configuration changes which address receives credit for the work.

No Payout Yet Does Not Mean No Future Reward

The flagged address’s OCEAN page showed zero blocks found, zero lifetime earnings and no payouts. A separate mempool.space record showed no confirmed or pending transactions for the address.

But it is premature to conclude that the attackers can collect nothing. OCEAN’s dashboard estimated about 0.66 BTC in rewards for work still in its reward window, excluding transaction fees. That estimate is neither a payment already received nor a verified total of affected miners’ losses.

Under OCEAN’s TIDES reward system, accepted mining work remains eligible for a share of subsequent block rewards while it is within the relevant window. The flagged address could therefore receive rewards when the pool next finds a block, even after most redirected machines have left.

Entry Point Remains Unconfirmed

CoreX said it believed it had isolated the program used but declined to name it, writing: “I have my assumptions but I won't post who or what.”

An X account using the name Noirlet, which claimed its entire farm was affected, blamed Luxor Commander. That account’s attribution has not been independently confirmed and does not establish a breach of Luxor’s software.

Luxor describes Commander as fleet-management software capable of changing pool settings on thousands of miners in one operation. That capability explains why access to management tools matters to miners and hosts; it is not evidence that Commander was the entry point in this incident.