A new report from China’s National Computer Virus Emergency Response Center (CVERC)has accused the U.S. government of orchestrating a “state-level hacking operation” to seize 127,000 Bitcoins originally stolen from China’s LuBian mining pool in December 2020.
The report alleges that the U.S. used hacking methods to obtain the coins, later framing the seizure as a law enforcement action against Chen Zhi, the Cambodian billionaire and Prince Group founder accused of running a Southeast Asian crypto scam. The U.S. Department of Justice (DOJ), however, maintains that the seizure was lawful and targeted criminal proceeds connected to international fraud.
The 2020 LuBian Hack: $3.5B in Bitcoin Stolen
According to the CVERC, the LuBian mining pool suffered a devastating breach on December 29, 2020, when attackers exploited a system vulnerability and drained 127,272.06953176 BTC, worth about $3.5 billion at the time, and nearly $15 billion today.
The report claims the stolen funds were held in wallets linked to Chen Zhi’s Prince Group, which operated the mining pool. Over the following years, Chen Zhi reportedly posted blockchain messages offering a ransom for the return of the coins, but the hackers never responded.
Unusually, the stolen Bitcoin remained idle for nearly four years, contradicting the typical pattern of rapid liquidation following crypto thefts. CVERC argues this inactivity is evidence of a coordinated state-level operation rather than criminal opportunism.
The Timeline of the Alleged Operation
CVERC’s technical reconstruction divides the Bitcoin movement into five distinct phases:
- Attack and Theft (Dec 29, 2020): Hackers drained the LuBian pool within two hours using an automated batch script, with every transaction sharing identical fees.
- Dormancy Phase (2021–June 2024): The 127,000 BTC remained virtually untouched, aside from a few dust transactions.
- Negotiation Attempts (2021–2022): Over 1,500 blockchain messages were sent by LuBian, offering a bounty for recovery.
- Activation and Transfer (June–July 2024): The coins were suddenly moved to new wallets tagged by Arkham Intelligence as U.S. government-controlled addresses.
- Seizure and Indictment (Oct 14, 2025): The DOJ announced criminal charges against Chen Zhi, confirming the seizure of 127,000 BTC.
CVERC argues that the sequence indicates the same entities that hacked LuBian were later responsible for transferring and seizing the funds under the guise of U.S. law enforcement.
China Calls It “Thieves Falling Out” Between States
Labeling the event a case of “thieves falling out,” CVERC alleges the U.S. effectively hacked a hacker, taking possession of digital assets originally stolen from a Chinese company. The center’s report states:
“This is a typical case of a state-level hacking organization turning on its partner, reflecting the use of national cyber capabilities for private gain under the cover of criminal prosecution.”
Beijing’s cybersecurity watchdog said its investigation used Bitcoin’s transparent blockchain records to trace all 127,272 BTC back to independent mining operations, pool payouts, and exchange flows. CVERC claims that over 17,800 BTC originated from legitimate mining, 2,300 BTC from mining pool distributions, and 107,100 BTC from mixed sources, contradicting the DOJ’s claim that the funds stemmed from illegal activity.
U.S. Denies Accusations, Cites Criminal Proceeds
The U.S. Department of Justice rejects China’s claims, stating the coins were seized through standard legal proceduresas part of an investigation into fraudulent cryptocurrency investment schemes across Southeast Asia, allegedly orchestrated by Chen Zhi’s network.
U.S. officials maintain that the funds were proceeds of a large-scale “pig butchering” scam, not lawful mining revenue. The Bitcoin linked to the case remains in federal custody and has not been moved since June 2024.
Broader Implications
The case adds a new dimension to the already strained U.S.-China cyber relations, intertwining cryptocurrency forensics with allegations of digital espionage and asset appropriation. Analysts note that the controversy could influence how both nations approach cross-border blockchain forensics, law enforcement jurisdiction, and digital asset sovereignty.
As of now, China’s CVERC continues to press for international scrutiny of U.S. cyber operations, while the U.S. insists it acted lawfully against criminal proceeds. The 127,000 BTC, now one of the most contested crypto stashes in history, remains untouched, symbolizing the geopolitical tension at the intersection of blockchain and state power.
