---
id: "CMP-202611-3cdpd5"
page: "https://infrastack.ai/live/CMP-202611-3cdpd5"
kind: "campaign"
aliases: []
title: "Attackers hijack about 64,000 Bitcoin mining machines and point them at the OCEAN pool with payouts to their own address; an affected operator blames Luxor Commander (CoreX Hosting)"
severity: "high"
cvss: null
epss: null
exploited: true
status: "open"
category: "infrastructure"
products: [{"name": "Luxor Commander", "fixed": [], "vendor": "Luxor"}]
ecosystems: []
tags: ["campaign", "early-warning"]
not_affected_if: []
published_at: null
first_seen_at: "2026-11-15T13:46:47+00:00"
updated_at: "2026-11-15T13:46:52+00:00"
sources: [{"source": "analyst", "url": "https://www.tokenpost.com/news/technology/57777", "first_seen_at": "2026-11-15T13:46:47+00:00", "cites": ["https://www.tokenpost.com/news/technology/57777", "https://coincamps.ai/flash/n10212"]}]
exploit_sources: []
---

# Attackers hijack about 64,000 Bitcoin mining machines and point them at the OCEAN pool with payouts to their own address; an affected operator blames Luxor Commander (CoreX Hosting)

Link for people: https://infrastack.ai/live/CMP-202611-3cdpd5 (this .md is for agents)

Starting around 8 p.m. US Central on 14 Nov 2026 (02:00 UTC 15 Nov), mining machines at several hosted mining sites were switched without permission to the OCEAN pool, with rewards set to go to an attacker's Bitcoin address. At its peak this was about 13 EH/s from roughly 64,000 machines. CoreX Hosting raised the first alarm. One affected operator says its whole mining site was taken over and names Luxor's Commander mining management software as the way in. Other operators report similar unauthorized pool changes a few days earlier. CoreX says the activity has mostly stopped (down to about 100 PH/s). The attackers mined no block, so the victims lost mining revenue but the attackers got no payout. Whether Luxor Commander was really compromised is not confirmed, and Luxor has made no statement in these sources. The full scope is unknown.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- :Luxor Commander affected range not listed fixed no fixed version listed

## Cause

How the attacker got in: not disclosed yet (unknown). One affected operator names Luxor's Commander software as the way in, but the record says Luxor Commander's compromise is not confirmed and Luxor has made no statement, so the entry point is not established.

How it reached others: not stated (unknown).

Last month's incidents with the same cause, and the full checklist: https://infrastack.ai/live/breaches.md#unknown

## How to check

Look at the pool and worker settings on your ASIC miners and in your fleet management tool for pool changes you did not make since about 11 Nov 2026, especially miners pointed at OCEAN or paying out to bc1qphukp9rjfc4rcej7erpm9ae20xmtspw8pcddrr. If you use Luxor Commander, review its audit logs and API keys for changes you did not make. Whether other management tools are affected is unknown.

## Fix

Put your own pool and payout settings back on the affected miners. Change the passwords and API keys for Luxor Commander and any other miner management tool, and turn on MFA. Change the miners' default web and admin passwords, and keep miner management interfaces off the internet. Watch for an advisory from Luxor.

## Timeline

- 2026-11-15T13:46:47+00:00 analyst https://www.tokenpost.com/news/technology/57777

## Documents

- [describes] @dinodaizovi: Redirecting miners to mine for the attacker should have been in every miners' th https://x.com/dinodaizovi/status/2121955558970560552
- [describes] Hijacking Redirects 13 EH/s of Bitcoin Mining Power to OCEAN https://www.tokenpost.com/news/technology/57777
- [describes] About 13 EH/s of Bitcoin Hashrate Hijacked and Redirected to OCEAN Pool https://coincamps.ai/flash/n10212

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_