Luxor Technology Confirms Bitcoin Mining Manipulation Linked to AI Attack

Unauthorized Redirection of Bitcoin Mining Hashrate

Luxor Technology announced the confirmation of an unauthorized redirection of bitcoin mining hashrate via its Commander platform, putting to rest rumors of a large-scale attack involving numerous mining rigs. The firm stated the issue was swiftly contained within two hours and that all customers impacted by the breach will receive full compensation for their losses.

Details of the Incident

Initially suspected to be an unverified hacking incident, the event occurred when mining equipment was allegedly hijacked through Luxor's Commander management software. In a statement released on Sunday, November 15, 2026, the company detailed that its internal systems spotted unauthorized changes to mining pool settings, triggering an urgent engineering response. Luxor described the situation:

“Last night, our internal monitoring systems alerted us to an unauthorized redirection of hashrate through Commander. Our on-call engineering team responded immediately.”

The company reported that just over a dozen customer accounts were affected, with some mining machines briefly redirected to another pool. Notably, they emphasized that no client data was compromised during this incident:

“The impact was limited to a small number of accounts. Affected mining machines were redirected for a short period of time, with no data leaked from our systems,”

the team communicated via X.

Response and Compensation

In the aftermath, Luxor’s engineering team applied a patch to Commander within two hours and worked on restoring the affected systems. They assured clients that all lost computational power resulting from the redirection would be reimbursed as though it continued to mine normally:

“Every affected client will be compensated in full for the redirected hashrate,”

the firm confirmed.

Additionally, Luxor clarified that the breach was restricted to the Commander platform, and that neither its mining pool nor the underlying LuxOS firmware were compromised. CEO Nick Hansen provided insights into the situation, describing it as a challenging period and suggesting that an AI-assisted method was used for the intrusion. He noted that the compromise began around 6 p.m. Pacific time on Saturday, November 14, affecting certain Commander clients specifically:

"Around 6:00 PM PDT yesterday, a subset of Commander customers was compromised via a sophisticated AI-enabled vector,"

he detailed.

Ongoing Investigation and Speculations

Despite his speculation about the nature of the attack being AI-driven, Luxor has yet to release specific technical findings explaining how the breach occurred or how the attackers altered the mining configurations. Hansen remarked that the engineering team not only identified the flaw but rectified it before reinstating the affected devices. He extended apologies to customers and reiterated the company’s commitment to making them whole:

"I apologize. You trust us with your fleet, and we need to improve here,"

he stated.

Affected customers will receive further information through emails, and Luxor has promised a thorough review of the incident. Before this official acknowledgment, rumors had circulated indicating that around 64,000 mining machines, accounting for close to 13 EH/s, had been rerouted to the Ocean mining pool. However, these numbers remain unverified, as Luxor’s report only mentioned a small number of compromised accounts, leaving questions about the overall scale of the incident.

Context and Implications

The Ocean mining pool, which was established in 2023 and is financially supported by Jack Dorsey, was noted to have experienced unusual activity corresponding with the reported incident. A suspected address associated with the reported redirection was noted to have acquired approximately 0.65761026 BTC in rewards. Nonetheless, transactions to this address have not been confirmed on the blockchain, indicating the attacker may not have successfully liquidated those gains.

CoreX Hosting, which had initially raised alarms about the supposed hack, later stated that the redirected hashrate had diminished, dropping to around 100 PH/s. Luxor’s acknowledgment of the situation clarifies the occurrence of the unauthorized redirection; however, key elements, such as the total number of mining rigs impacted and how the attack specifically utilized AI technology to achieve control remain unanswered. This incident serves as a stark reminder for mining operators of how unauthorized changes to operational settings can pose significant financial risks without the direct theft of cryptocurrency. While Luxor’s pledge for compensation addresses immediate financial fallout, its upcoming investigation must tackle how intruders were able to gain control over such substantial mining operations in the first place.