Bitcoin mining operators woke up to an unauthorized switch of their machines to a different pool overnight. The attack reportedly began around 8 PM Central Time, with payouts pointed to a Bitcoin address controlled by the attackers.

About 64,000 machines and 13 EH/s of hashrate were redirected to the OCEAN mining pool, whose dashboard briefly approached 50 EH/s before falling back to about 40 EH/s.

CoreX Hosting raised the first alarm and later said the attack appeared to be over, with hijacked hashrate dropping to about 100 PH/s. The attackers mined no blocks, so they collected no block rewards, but affected miners lost the revenue they would have earned during the incident.

One affected operator blamed Luxor's Commander mining management software, and others reported similar unauthorized pool changes days earlier. Whether Commander was compromised, and the full scope of the damage, has not been independently confirmed.