However, Western research ties the event to a wallet random-number flaw and does not name a state actor.
Regarding attribution, technical teams that first identified the flaw and traced the flows do not claim knowledge of who executed the 2020 drain. MilkSad repeatedly refers to an actor who discovered and exploited weak private keys, stating they do not know the identity.
Arkham and Blockscope describe the entity as the LuBian hacker, focusing on method and scale. Elliptic and TRM confine their claims to tracing and to the match between the 2020 outflows and the later DOJ seizure. None of these sources names a state actor for the 2020 operation.
It argues that the four-year dormancy period deviates from common criminal cash-out patterns and therefore points to a state-level hacking organization.
It then links the later U.S. custody of the coins to the allegation that U.S. actors executed the exploit in 2020 before converting it into a law enforcement seizure.
The report’s technical sections track closely with independent open research on weak keys, MT19937, address batching, and fee patterns.
Its attribution leap rests on circumstantial inferences about dormancy and ultimate custody rather than new forensics, tooling ties, infrastructure overlaps, or other standard indicators used in state actor attribution.
There are at least three coherent readings that fit what is public.
The third is an allegation not substantiated by independent technical evidence in the public domain.
A brief timeline of the uncontested events is below.
From a capability standpoint, brute forcing a 2^32 seed space is well within reach for motivated actors. At about 1 million guesses per second, a single setup can traverse the space in a few hours, and distributed or GPU-accelerated rigs compress that further.
Feasibility is central to the MilkSad-class weakness, explaining how a single actor can sweep thousands of vulnerable addresses simultaneously. The fixed-fee pattern and address derivation details published by MilkSad and mirrored in CVERC’s technical write-up reinforce this method of exploitation.
The remaining disputes lie in ownership and control at each step, not in the mechanics. DOJ frames the wallets as repositories for criminal proceeds tied to Chen and states the assets are forfeitable under U.S. law.
Chinese authorities frame LuBian as a victim of theft and accuse a U.S. state actor of the original exploit.
Independent blockchain forensics groups connect the 2020 outflows to the 2024–2025 consolidation and seizure, and stop short of naming who pressed the button in 2020. That is the status of the record.
