Analysis: The US Government or "Hack on Hack" Stole 127,000 Bitcoins from Chen Zhi, with the case matching the modus operandi of a state-level hacking group.

BlockBeats News, November 9th. The National Computer Virus Emergency Response Center released the "LuBian Mining Pool Hacked, Massive Bitcoin Theft Incident Technical Traceability Analysis Report." On December 29, 2020, LuBian Mining Pool experienced a significant hacker attack, with a total of 127,272.06953176 bitcoins (valued at about $3.5 billion at the time, now valued at $15 billion) stolen by the attacker. The holder of these massive bitcoins is precisely Chen Zhi, the Chairman of the Cambodian Crown Prince Group. After the hacker attack, Chen Zhi and his Crown Prince Group separately posted messages on the blockchain in early 2021 and July 2022, calling out to the hackers, hoping they would return the stolen bitcoins and expressing willingness to pay a ransom, but received no response. Strangely, after the massive bitcoin theft, the bitcoins were transferred to a bitcoin wallet address controlled by the attacker and remained dormant for a long 4-year period, almost untouched. This behavior clearly does not align with the typical hacker's rush to cash out and pursue profits; rather, it resembles a precise operation orchestrated by a "state-level hacker organization." It wasn't until June 2024 that these stolen bitcoins were once again moved to new bitcoin wallet addresses and have remained untouched since.

On October 14, 2025, the U.S. Department of Justice announced criminal charges against Chen Zhi and stated that they had seized 127,000 bitcoins from Chen Zhi and his Crown Prince Group. Various evidence indicates that the U.S. government seized these massive bitcoins from Chen Zhi and his Crown Prince Group, which were originally stolen by hackers through technical means from the LuBian Mining Pool bitcoins as early as 2020. In other words, the U.S. government had already used hacker techniques to steal the 127,000 bitcoins held by Chen Zhi in 2020, making this a typical "hack-on-hack" incident orchestrated by a state-level hacker organization.