Published: 12.11.2025
Summary
- China’s cybersecurity agency alleges the U.S. government led a “state‑level” operation that stole ~127,272 BTC from the LuBian mining pool in December 2020. [1]
- Washington previously unsealed an indictment of Cambodian businessman Chen Zhi and filed a civil forfeiture complaint over ~127,271 BTC, calling the stash criminal proceeds now in U.S. custody. [2]
- Blockchain sleuths report the coins moved to new wallets in mid‑2024, later tagged as U.S. government–linked, fueling Beijing’s claim. U.S. officials maintain the action is a lawful seizure; prosecutors have not detailed how they obtained control. [3]
What Beijing is alleging
China’s National Computer Virus Emergency Response Center (CVERC) published a technical analysis claiming the theft of 127,272 BTC from the LuBian mining pool was carried out using advanced tools and operational tradecraft consistent with a “state‑level hacker operation.” The report suggests the coins’ long dormancy and later coordinated transfers imply a government actor, and it directly points to the United States. [4]
The agency says the incident occurred in December 2020, one of the largest crypto heists ever recorded, and argues the subsequent on‑chain movements link the stolen bitcoin to wallets under U.S. control. Chinese state‑aligned outlets and industry publications amplified that reading after the report was posted on CVERC’s Weixin account. [5]
What Washington has said and done
On 14 October 2025, the U.S. Department of Justice (DOJ) unsealed charges against Chen Zhi, chairman of Cambodia’s Prince Group, alleging a massive forced‑labor cyber‑fraud network (“pig‑butchering” scams) and filed a civil forfeiture complaint for approximately 127,271 BTC, describing the coins as proceeds and instruments of fraud and money laundering. The DOJ says the bitcoin are in U.S. government custody and calls the action the largest forfeiture in its history. [6]
The complaint lists the seized bitcoin and outlines the broader criminal case; however, U.S. filings do not spell out when or how agents gained control of the private keys. Prosecutors involved have declined to elaborate beyond the filings, according to contemporary coverage. [7]
The blockchain breadcrumbs
Independent blockchain researchers, including Arkham Intelligence, previously surfaced the LuBian heist in August, estimating ~127k BTC were stolen in 2020. Arkham later noted that, after years of dormancy, the coins moved in mid‑2024 into wallets it attributed to the U.S. government—a linkage China now cites. (Attribution on public ledgers is probabilistic and contested.) [8]
Arkham and other analysts have published additional research since the DOJ action, describing the bitcoin now under U.S. control as connected to the LuBian hack and to Chen’s alleged network, though none of this by itself proves how U.S. authorities obtained the keys. [9]
Why the LuBian breach matters
The LuBian hack, first widely detailed this summer, ranks among the biggest in crypto by current value. It helped trigger a fresh round of debate over crypto custody, key generation practices, and international cyber norms—especially as the stolen coins amount to a meaningful slice of circulating bitcoin. Reporting has emphasized LuBian’s size before it vanished and the unusual patience of whoever held the coins. [10]
Two narratives, one pile of bitcoin
- China’s claim: U.S. actors stole the coins in 2020 and only moved them years later, consistent with an intelligence‑driven operation. [11]
- U.S. position: The government seized bitcoin linked to Chen Zhi’s alleged criminal empire; the assets are subject to forfeiture in court and intended for victim compensation under U.S. law. [12]
Some industry commentators argue there’s no public evidence proving the U.S. perpetrated the hack itself; rather, they view the DOJ’s filings as consistent with a post‑hoc seizure of criminal proceeds. That skepticism underscores how much of the technical backstory remains outside the public record. [13]
Geopolitics and risk: digital-asset sovereignty
The dispute lands amid escalating U.S.–China cyber hostilities and tit‑for‑tat allegations that have already produced sanctions, indictments, and naming‑and‑shaming campaigns. The size and visibility of the LuBian stash make it a high‑stakes test of digital‑asset sovereignty: who controls cross‑border crypto wealth when crime, national security, and foreign policy collide. [14]
What happens next
- Court process: The forfeiture case in the Eastern District of New York will proceed on the merits of whether the bitcoin are traceable to Chen’s alleged crimes. Forfeiture is a civil action; the DOJ’s criminal case against Chen is separate. [15]
- International friction: Beijing’s accusation pressures Washington to reveal more about the chain of custody; U.S. officials so far are sticking to the “lawful seizure” line. Any formal Chinese counter‑measures would likely appear in diplomatic channels, not on‑chain. [16]
- Market watch: The coins’ legal limbo reduces near‑term liquidation risk but concentrates political risk. Traders are monitoring on‑chain movements and docket updates rather than expecting sudden market sales. [17]
Key timeline
- Dec 2020: LuBian mining pool hacked for ~127k BTC. [18]
- 2021: LuBian disappears from the mining landscape. [19]
- Jun–Jul 2024: Dormant coins move to new addresses; blockchain firms later tag these as U.S.‑linked. [20]
- 14 Oct 2025: DOJ indicts Chen Zhi; files civil forfeiture over ~127,271 BTC; says funds are in U.S. custody. [21]
- 11–12 Nov 2025: CVERC alleges a U.S.‑orchestrated hack; international coverage intensifies. [22]
The bottom line
Both governments agree on the numbers; they do not agree on how the United States ended up controlling the coins. Until courts (or additional disclosures) clarify the provenance and key‑access story, this case will sit at the intersection of cyber forensics, asset recovery, and great‑power politics—an uncomfortable place for a very large stack of bitcoin. [23]
Sources: Bloomberg; Fortune; The Japan Times; DOJ filings and press release; Arkham Intelligence; Investing.com; TechRadar/Tom’s Hardware; CoinDesk. [24]
Editor’s note: This is a developing legal and geopolitical dispute. Assertions of state involvement are allegations, not established fact; readers should distinguish between court‑filed claims and unverified technical inferences. [25]
References
1. www.bloomberg.com, 2. www.justice.gov, 3. www.coindesk.com, 4. www.bloomberg.com, 5. www.theregister.com, 6. www.justice.gov, 7. www.justice.gov, 8. info.arkm.com, 9. info.arkm.com, 10. www.tomshardware.com, 11. www.bloomberg.com, 12. www.justice.gov, 13. cryptoslate.com, 14. apnews.com, 15. www.justice.gov, 16. www.bloomberg.com, 17. www.coindesk.com, 18. www.tomshardware.com, 19. www.tomshardware.com, 20. www.coindesk.com, 21. www.justice.gov, 22. www.bloomberg.com, 23. www.justice.gov, 24. www.bloomberg.com, 25. www.justice.gov
