Someone Hijacked Bitcoin Mining Power and Pointed It at OCEAN: CoreX Has No Answers
Bitcoin mining hashrate was secretly redirected to the OCEAN mining pool without authorization, and nobody knows exactly how it happened.
CoreX, the mining operation at the center of the incident, confirmed that a flagged wallet address showed zero payouts during the attack period. But here is where it gets complicated: the hijacked mining work was still being submitted and could have earned rewards elsewhere. Someone may have been siphoning computational power and directing it toward OCEAN, one of the more politically charged pools in the Bitcoin ecosystem, while keeping the financial trail deliberately murky.
The entry point has not been confirmed. That means the vulnerability is potentially still open.
Why This Should Put Every Miner on High Alert
This is not a typical exchange hack or DeFi exploit. This is infrastructure-level compromise, targeting the hardware and software layer that secures the Bitcoin network itself. If attackers can silently redirect hashrate from one pool to another, they can also theoretically concentrate mining power, manipulate which transactions get confirmed, or extract value in ways that do not immediately show up as a stolen balance.
The fact that the flagged address showed no payouts is precisely what makes this attack sophisticated. A clean financial trail buys time. And time, in a live exploit, is everything.
OCEAN has not been accused of involvement. The pool may have received redirected hashrate without any knowledge of the attack. But the choice of destination is a detail investigators will not ignore. OCEAN has been a lightning rod in Bitcoin mining politics, known for its stance on transaction filtering and miner sovereignty. Whether the target was symbolic, strategic, or simply opportunistic is still unknown.
What the Mining Community Is Not Saying Out Loud
Hashrate hijacking is not a new concept, but confirmed cases at this level of stealth are rare. This incident raises questions the industry has quietly shelved for years: How many mining operations are running outdated firmware? How many pools have robust authentication on incoming work submissions? How many miners would even notice if their rigs were pointed somewhere else?
The answer, based on how long this attack went undetected, is probably not enough.
What to Watch Right Now
If you operate mining hardware, audit your pool connections and firmware configurations immediately. Do not wait for a postmortem. Watch CoreX communications closely for any confirmed entry point disclosure, because that detail will determine how widespread this exposure actually is across the broader mining ecosystem. If a common software stack or API vulnerability is involved, this story is nowhere near over.