HashOcean Cloud Mining Scam: False Mining Farms, Website Shutdowns, and Millions Stolen from Global Miners

Who Gets Targeted

The victims are primarily middle-aged and young men encountering crypto assets for the first time, concentrated among small-business owners, side-hustle workers, and retirees in tier-3 and tier-4 cities, with individual investments mostly ranging from 10,000 to 500,000 RMB. Having heard of Bitcoin mining but possessing almost no firsthand experience with mining rigs, farms, or hash rate operations, most enter through short videos, WeChat groups, or friend invitations. Driven by the mentality of 'drinking soup alongside veteran miners' and seeing daily profit screenshots posted by others, they aggressively increase their investments. Platforms exploit their cognitive blind spots regarding the inability to verify global farms and chip procurement, using tactics like 'provincial agent rebates' and 'refer-a-friend startup bonuses' to create a group effect that causes them to abandon basic commercial due diligence before making massive capital injections.

骗局怎么运作

• Packaging Mining Farms: Registering shell companies overseas that contain only an email address, the official website heavily uses AI-generated or stolen photos of mining rig arrays from real farms, paired with multilingual customer service, short-term cloud servers, and so-called 'partner' logos to project a cross-border compliant mining enterprise image. The team has signed no written contracts with any rig manufacturers or farms, merely using visual assets to lay the groundwork for trust.
• Low-Cost Hash Rate Package Pricing: Packaging multiple S19 series mining rigs into standard hash rate packages priced at about half the market average for cloud mining, while promising daily returns 1.5 to 3 times that of real hash rates. The narrative repeatedly emphasizes that 'coin prices are high and startups break even immediately.' The website refreshes a 'Today's Profit Leaderboard' every minute to create the illusion of real-time capital growth, leveraging weekends or market fluctuations for countdown promotions.
• Locking in Reinvestments and Referrals: Withdrawals after a user's initial deposit are usually smooth, and the platform even sends forged electricity bill screenshots to prove the 'mining farm is operating.' The backend then converts real earnings into platform points, requiring users to reinvest or invite new users to unlock full withdrawals—applying a traditional Ponzi scheme model to the mining concept so that cash flow only goes in and never comes out.
• Upgrading and Flashing Hacker Announcements Before Shutdown: First suspending withdrawals for several days under the pretext of server upgrades and KYC reviews, the platform then posts a 'hacker coin theft' announcement with a so-called on-chain address, claiming full cooperation with police investigations. In reality, on-chain transfers show funds split into multiple small amounts deposited into various exchange hot wallets, which does not match the timeline of a real attack; the hackers are merely scapegoats for the exit scam.
• Secondary Extraction: Weeks after shutting down, the platform re-forms groups under official names, claiming some assets have been recovered and planning to 'restart the mining farm,' requiring victims to pay verification deposits or custody fees for priority redemption. Many individuals desperate to recover losses transfer funds again, forming a secondary scam targeting the same group of victims, with funds ultimately going directly into personal wallets controlled by the project team.
• Rebranding and Rebirth: The same project team changes project IDs on Telegram and YouTube, packaging old mining farm materials into 'DePIN hash rate box' or 'RWA tokenization' products to absorb the next round of traffic, and even dropping new links in old groups to make scammed users mistakenly believe the same project is rebuilding with compliance.

红旗信号（看到这些快跑）

• 🚩 The official website has no business entity or registration number, displaying only a so-called real photo of a mining farm; contact numbers are personal phone numbers or emails rather than traceable fixed customer service lines.
• 🚩 Hash rate package pricing is significantly lower than mainstream cloud mining market averages while claiming to use the latest 7nm chips with buy-one-get-one-free subsidies, and profit promises are unreasonably high.
• 🚩 Withdrawals feature 'manual review' roadblocks: any single transaction exceeding 5,000 RMB requires adding customer service on WeChat or Telegram for communication, and customer service consistently refuses to provide an office address or mining farm reception address.
• 🚩 Social media only displays daily profit screenshots or rig startup videos, never electricity bills, quarterly audit reports, or mining farm lease contracts; so-called partners cannot provide on-site photos either.
• 🚩 Unusually accommodating toward frequent micro-deposit bonus hunters, as these transactions maintain the illusion of platform activity until deposited funds reach a scale where deposits and withdrawals are abruptly cut off.
• 🚩 The page never displays hosting contracts or on-chain address audit reports; user funds are required to be transferred to personal wallet addresses rather than regulated custody addresses, meaning funds never enter any real mining farm accounts.

真实案例

• HashOcean 'Cloud Pit' Incident: In 2026, multiple Chinese financial media outlets reported on the incident under the title 'Cloud Pit.' The platform claimed to have been attacked by hackers and shut down, with an involved amount of approximately $3.5 million. Media reports pointed out obvious contradictions between the official attack address and the real on-chain transfer timeline, with funds suspected of being transferred out in batches prior to shutdown, making the hackers mere 'scapegoats' in the official narrative. Relevant reports appeared on multiple mid-sized crypto vertical news sites. (Source: [https://www.qobx.com/info/383134.html](https://www.qobx.com/info/383134.html))
• Bit Bay Scam: According to an in-depth exposé by Project Home, a platform claimed to own a 10-terabit mining farm and engaged in second-hand rig hosting and hash rate leasing, raising funds from tens of thousands of people. On-site inspections after the incident revealed the so-called mining farm contained only 3 second-hand mining rigs, severely contradicting marketing claims, leaving tens of thousands of investors penniless. This case became a classic sample of 'cloud mining' scams on the Chinese internet. (Source: [https://www.qobx.com/info/383134.html](https://www.qobx.com/info/383134.html))
• Mining Circle Female Executive Scam Case: According to TMTpost, a female mining executive known as the 'Queen of the Mining Circle' who reportedly controlled about 9% of global hash rate was defrauded of approximately 60 million RMB by someone claiming to be a 'royal consort' under the guise of investment cooperation. While not a cloud mining platform itself, this case illustrates the industry-wide malady of the mining community's lack of due diligence regarding 'resource positioning' and 'background personas,' mirroring the trust-building tactics of cloud mining platforms.
• Law Enforcement Associated Case: According to public reports, Taizhou police cracked a major virtual currency mining case, seizing a large number of mining rigs on-site and holding relevant personnel criminally accountable. Simultaneously, Shanghai police announced the crackdown on a major cross-border virtual currency exchange underground bank case involving over 20 billion RMB. Both cases demonstrate that the gray financial chain behind mining and cashing out is being systematically targeted, serving as a reminder to cloud mining platform users that invested funds can easily become entangled in money laundering channels.
• In February 2025, the U.S. Department of Justice announced that the operators of cloud mining platform HashFlare fabricated mining capacity between 2015 and 2019, executing a Ponzi scheme under the guise of selling hash rate shares involving as much as $577 million. Two main culprits pleaded guilty and agreed to the forfeiture of over $400 million in assets, with sentencing scheduled for May 8 of that year, facing a maximum sentence of 20 years in prison. (Source: [https://www.justice.gov/opa/pr/two-estonian-nationals-plead-guilty-577m-cryptocurrency-fraud-scheme](https://www.justice.gov/opa/pr/two-estonian-nationals-plead-guilty-577m-cryptocurrency-fraud-scheme))

Official Stance

• On September 24, 2021, the National Development and Reform Commission and 11 other departments jointly issued the 'Notice on Rectifying Virtual Currency "Mining" Activities,' classifying virtual currency 'mining' as a phased-out industry, requiring comprehensive remediation of existing projects and a strict ban on new projects.
• In September 2021, the People's Bank of China and ten other departments jointly issued the 'Notice on Further Preventing and Disposing of Risks in Virtual Currency Trading Speculation,' clarifying that virtual currency-related business activities belong to illegal financial activities, and conducting hash rate leasing or disguised deposit-taking domestically constitutes suspected illegality.
• On March 1, 2022, the revised 'Interpretation of the Supreme People's Court on Several Issues Concerning the Application of Law in the Trial of Criminal Cases of Illegal Fund-Raising' came into effect, clarifying that absorbing funds from the general public under the names of online lending, virtual currency trading, etc., constitutes illegal absorption of public deposits, providing a clear basis for criminalizing cloud mining scams.
• In 2023, Shanghai police announced the crackdown on a major cross-border virtual currency exchange underground bank case involving over 20 billion RMB, with multiple criminal suspects subjected to criminal compulsory measures. The announcement indicates law enforcement agencies have traced virtual currency fund chains to the very end, and cloud mining platform fund channels are also within the scope of the crackdown.

How to Protect Yourself

• ✅ Unfold and Verify Mining: Require the platform to present mining farm addresses, electricity payment contracts, and rig nameplates, and commission a local third-party hosting farm for on-site verification; if the counterpart refuses on the grounds of commercial secrecy, immediately stop depositing.
• ✅ Small-Amount Test Withdrawals and Periodic Testing: First deposit a small amount of no more than 1,000 RMB, execute continuous withdrawals 3 or more times, and observe whether there are delivery delays or customer service interventions. Maintain vigilance against promotions claiming new user perks and large subsidies.
• ✅ Master On-Chain Tracing: Learn basic blockchain explorer applications to check whether withdrawal addresses belong to exchange hot wallets or privacy coin conversion pools. If the platform provides only screenshot earnings rather than on-chain records, refuse all large-scale investments.
• ✅ Qualification and Cross-Border Verification: Any virtual currency mining and promotional activities within the Chinese mainland are illegal; for Hong Kong, Macau, and overseas markets, verify local corporate registration and financial licenses, and email local regulatory bodies directly to check business operation permits.
• ✅ Set Stop-Loss Lines and Keep Records: Once it is discovered that withdrawals require additional matching fees or deposits, or customer service actively discourages large withdrawals, immediately halt transactions and preserve all chat records, transfer addresses, and promotional materials as evidence for reporting to the police or pursuing cross-border recovery.