Loading post from X…
View post on X
By 1:40 a.m. ET on Nov. 15, CoreX declared the attack over, saying the flagged address was down to about 100 petahashes per second. That establishes the sequence of its response, rather than the exact start and end of every affected machine’s diversion.
OCEAN’s statistics for the address corroborated the retreat: a Sunday morning snapshot showed a three-hour average of 13.7 PH/s, compared with a 24-hour average of 1.41 EH/s. Those are rolling averages, not measurements of the attack’s peak or precise duration. The number of physical machines affected remains unconfirmed; OCEAN explicitly warns that its workers are not necessarily individual machines.
For owners, the immediate consequence was that machines were doing work credited to someone else’s address rather than their own. OCEAN’s setup instructions explain the mechanism: miners connect to the pool and use a Bitcoin address as their username. Changing that configuration changes which address receives credit for the work.
No Payout Yet Does Not Mean No Future Reward
The flagged address’s OCEAN page showed zero blocks found, zero lifetime earnings and no payouts. A separate mempool.space record showed no confirmed or pending transactions for the address.
But it is premature to conclude that the attackers can collect nothing. OCEAN’s dashboard estimated about 0.66 BTC in rewards for work still in its reward window, excluding transaction fees. That estimate is neither a payment already received nor a verified total of affected miners’ losses.
Under OCEAN’s TIDES reward system, accepted mining work remains eligible for a share of subsequent block rewards while it is within the relevant window. The flagged address could therefore receive rewards when the pool next finds a block, even after most redirected machines have left.
Entry Point Remains Unconfirmed
CoreX said it believed it had isolated the program used but declined to name it, writing: “I have my assumptions but I won’t post who or what.”
An X account using the name Noirlet, which claimed its entire farm was affected, blamed Luxor Commander. That account’s attribution has not been independently confirmed and does not establish a breach of Luxor’s software.
Luxor describes Commander as fleet-management software capable of changing pool settings on thousands of miners in one operation. That capability explains why access to management tools matters to miners and hosts; it is not evidence that Commander was the entry point in this incident.
