Luxor Pledges Full Compensation for Commander Hijack

Luxor Technology said on Nov. 15 that bitcoin mining power was redirected without authorization through its Commander fleet-management software, and pledged to compensate every affected client as though their machines had mined normally.

Just over a dozen client accounts were affected, the company said in its statement. Engineers patched Commander within two hours and began restoring affected machines to their original mining-pool settings.

The promise covers earnings from the redirected computing power, or hashrate: “every affected client will be paid in full for the redirected hashrate, as if it had mined normally,” Luxor said. The statement did not specify a payment date, total compensation amount or detailed calculation method.

Chief Executive Officer Nick Hansen said affected clients would receive an email that day with more details. “You trust us with your fleet, and we need to be better,” he wrote.

Fleet Controls, Not Just Monitoring

Luxor's acknowledgment identifies Commander as the route used for the redirection, but does not detail the underlying exploit. The company said the issue was isolated to Commander and that its other services, including Luxor Pool and LuxOS, were unaffected. It also said no data was leaked or exfiltrated from its systems.

Commander is more than a monitoring dashboard. Luxor's product page says the software can change pool settings on thousands of miners in a single operation. That authority lets operators manage fleets in bulk, but the incident shows how misuse of the management layer can redirect the mining work itself.

Mining host CoreX Hosting had reported about 13 exahashes per second, or EH/s, at the address it identified with the attack, while saying it was changing miners back. It later said the address's hashrate had fallen to about 100 petahashes per second.

The OCEAN dashboard for that address lists zero blocks found, but it also records a payout of about 0.0809 BTC. The corresponding onchain transaction confirms that amount went to the address CoreX flagged.

Those figures are not contradictory. Under OCEAN's TIDES reward system, miners receive a proportional share of rewards for work recorded in the pool's reward window when any pool miner finds a block. An address need not find a block itself to receive earnings. That payout is not a measure of all affected clients' lost revenue.

Luxor said Commander was operating normally and users needed to take no action. The company promised a full post-mortem.