{"id":"CMP-202611-3cdpd5","kind":"campaign","aliases":[],"related":[],"title":"Attackers hijack about 64,000 Bitcoin mining machines and point them at the OCEAN pool with payouts to their own address; an affected operator blames Luxor Commander (CoreX Hosting)","description":null,"summary":"Starting around 8 p.m. US Central on 14 Nov 2026 (02:00 UTC 15 Nov), mining machines at several hosted mining sites were switched without permission to the OCEAN pool, with rewards set to go to an attacker's Bitcoin address. At its peak this was about 13 EH/s from roughly 64,000 machines. CoreX Hosting raised the first alarm. One affected operator says its whole mining site was taken over and names Luxor's Commander mining management software as the way in. Other operators report similar unauthorized pool changes a few days earlier. CoreX says the activity has mostly stopped (down to about 100 PH/s). The attackers mined no block, so the victims lost mining revenue but the attackers got no payout. Whether Luxor Commander was really compromised is not confirmed, and Luxor has made no statement in these sources. The full scope is unknown.","severity":"high","cvss":null,"epss":null,"exploited":true,"exploited_at":"2026-11-15T13:46:47+00:00","products":[{"name":"Luxor Commander","fixed":[],"vendor":"Luxor"}],"ecosystems":[],"tags":["campaign","early-warning"],"not_affected_if":[],"how_to_check":"Look at the pool and worker settings on your ASIC miners and in your fleet management tool for pool changes you did not make since about 11 Nov 2026, especially miners pointed at OCEAN or paying out to bc1qphukp9rjfc4rcej7erpm9ae20xmtspw8pcddrr. If you use Luxor Commander, review its audit logs and API keys for changes you did not make. Whether other management tools are affected is unknown.","fix":"Put your own pool and payout settings back on the affected miners. Change the passwords and API keys for Luxor Commander and any other miner management tool, and turn on MFA. Change the miners' default web and admin passwords, and keep miner management interfaces off the internet. Watch for an advisory from Luxor.","status":"open","published_at":null,"first_seen_at":"2026-11-15T13:46:47+00:00","triaged_at":"2026-11-15T13:46:47+00:00","updated_at":"2026-11-15T13:46:52+00:00","category":"infrastructure","confidence":null,"triage":{"cause":{"at":"2026-11-15T13:47:42Z","path":"unknown","entry":"unknown","reason":"One affected operator names Luxor's Commander software as the way in, but the record says Luxor Commander's compromise is not confirmed and Luxor has made no statement, so the entry point is not established.","confidence":0.6}},"analyst_status":"done","analyst_note":null,"search":"'-202611':31A '-3':32A '00':51B '000':5A,92B '02':50B '100':144B '13':87B '14':47B '15':53B '2026':49B '64':4A,91B '8':42B 'activ':137B 'address':21A,80B 'affect':23A,101B 'alarm':99B 'around':41B 'attack':1A,77B,147B,159B 'bitcoin':6A,79B 'blame':25A 'block':150B 'campaign':36B 'cdpd5':33A 'central':45B 'chang':129B 'cmp':30A 'command':27A,115B,165B 'commander':35A 'compromis':168B 'confirm':171B 'corex':28A,94B,134B 'day':132B 'earli':38B 'earlier':133B 'early-warn':37B 'eh/s':88B 'first':98B 'full':182B 'go':74B 'got':160B 'hijack':2A 'host':29A,59B,95B 'lost':154B 'luxor':26A,34A,113B,164B,173B 'machin':8A,56B,93B 'made':175B 'manag':117B 'mine':7A,55B,60B,106B,116B,148B,155B 'most':139B 'name':112B 'nov':48B,54B 'ocean':14A,68B 'one':100B 'oper':24A,102B,124B 'p.m':43B 'payout':17A,162B 'peak':83B 'permiss':65B 'ph/s':145B 'point':10A 'pool':15A,69B,128B 'rais':96B 'realli':167B 'report':125B 'revenu':156B 'reward':71B 'rough':90B 'say':103B,135B 'scope':183B 'set':72B 'sever':58B 'similar':126B 'site':61B,107B 'softwar':118B 'sourc':180B 'start':40B 'statement':177B 'stop':140B 'switch':63B 'taken':109B 'unauthor':127B 'unknown':185B 'us':44B 'utc':52B 'victim':153B 'warn':39B 'way':121B 'whether':163B 'whole':105B 'without':64B","nicknames":["OCEAN hashrate hijack"],"mitigations":[],"who_affected":null,"tier":"A","verified":{},"analyst_revisit_at":null,"fix_status":null,"audience":null,"plain_action":null,"pkeys":["commander","luxorcommander","oceanhashratehijack"],"ptokens":["commander","luxor"],"labels":["campaign","earlywarning","high","infrastructure"],"campaign_type":"exploitation","search_a":"'-202611':31A '-3':32A '000':5A '64':4A 'address':21A 'affect':23A 'attack':1A 'bitcoin':6A 'blame':25A 'cdpd5':33A 'cmp':30A 'command':27A 'commander':35A 'corex':28A 'hijack':2A 'host':29A 'luxor':26A,34A 'machin':8A 'mine':7A 'ocean':14A 'oper':24A 'payout':17A 'point':10A 'pool':15A","search_b":"'00':51B '000':92B '02':50B '100':144B '13':87B '14':47B '15':53B '2026':49B '64':91B '8':42B 'activ':137B 'address':80B 'affect':101B 'alarm':99B 'around':41B 'attack':77B,147B,159B 'bitcoin':79B 'block':150B 'campaign':36B 'central':45B 'chang':129B 'command':115B,165B 'compromis':168B 'confirm':171B 'corex':94B,134B 'day':132B 'earli':38B 'earlier':133B 'early-warn':37B 'eh/s':88B 'first':98B 'full':182B 'go':74B 'got':160B 'host':59B,95B 'lost':154B 'luxor':113B,164B,173B 'machin':56B,93B 'made':175B 'manag':117B 'mine':55B,60B,106B,116B,148B,155B 'most':139B 'name':112B 'nov':48B,54B 'ocean':68B 'one':100B 'oper':102B,124B 'p.m':43B 'payout':162B 'peak':83B 'permiss':65B 'ph/s':145B 'pool':69B,128B 'rais':96B 'realli':167B 'report':125B 'revenu':156B 'reward':71B 'rough':90B 'say':103B,135B 'scope':183B 'set':72B 'sever':58B 'similar':126B 'site':61B,107B 'softwar':118B 'sourc':180B 'start':40B 'statement':177B 'stop':140B 'switch':63B 'taken':109B 'unauthor':127B 'unknown':185B 'us':44B 'utc':52B 'victim':153B 'warn':39B 'way':121B 'whether':163B 'whole':105B 'without':64B","search_c":"","cause_entry":"unknown","cause_path":"unknown","disclosures_checked_at":null,"first_public_at":"2026-11-15T11:29:04+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"analyst","external_id":"CMP-202611-3cdpd5","url":"https://www.tokenpost.com/news/technology/57777","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-11-15T13:46:47+00:00","fetched_at":"2026-11-15T13:46:47+00:00","note":null,"cites":["https://www.tokenpost.com/news/technology/57777","https://coincamps.ai/flash/n10212"]}],"documents":[{"id":163398,"url":"https://x.com/dinodaizovi/status/2121955558970560552","title":"@dinodaizovi: Redirecting miners to mine for the attacker should have been in every miners' th","kind":"post","source":"x","publisher":null,"text":"Redirecting miners to mine for the attacker should have been in every miners' threat model, but now it's actually happened at scale: https://t.co/vnxc2XrSwe\n\nlikes 4 reposts 0","published_at":"2026-11-15T13:16:43+00:00","relation":"describes","confidence":null,"note":null},{"id":163555,"url":"https://www.tokenpost.com/news/technology/57777","title":"Hijacking Redirects 13 EH/s of Bitcoin Mining Power to OCEAN","kind":"blog","source":"analyst","publisher":null,"text":"About 13 EH/s of Bitcoin mining power from roughly 64,000 machines was diverted to the OCEAN pool with payouts to an attacker-controlled address, starting around 8 p.m. US Central Nov 14 (02:00 UTC Nov 15). CoreX Hosting raised the first alarm: machines switched to another pool without authorization. One affected operator said its entire site was taken over and pointed to Luxor's Commander mining management software as the source; other operators reported similar unauthorized pool changes days earlier. CoreX later said activity ended, diverted hashrate down to about 100 PH/s. Attacker address (per CoreX, via Coincamps): bc1qphukp9rjfc4rcej7erpm9ae20xmtspw8pcddrr. No block mined. Whether Luxor Commander was compromised is not independently confirmed.","published_at":"2026-11-15T11:29:04+00:00","relation":"describes","confidence":null,"note":null},{"id":163556,"url":"https://coincamps.ai/flash/n10212","title":"About 13 EH/s of Bitcoin Hashrate Hijacked and Redirected to OCEAN Pool","kind":"blog","source":"analyst","publisher":null,"text":"Per CoreX Hosting on X, many Bitcoin mining machines were hijacked and pointed to the OCEAN pool, with proceeds to attacker address bc1qphukp9rjfc4rcej7erpm9ae20xmtspw8pcddrr. Hashrate peaked about 13 EH/s, later fell to about 100 PH/s; attack appears ended; the program involved not yet disclosed. Address has received no payment.","published_at":"2026-11-15T11:31:59+00:00","relation":"describes","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}