Israeli security firm Lava identified 32 Nvidia Blackwell Ultra B300 chips linked to IP addresses connected to China Telecom, the state-owned carrier, according to a report by The Information on October 22, 2026. US export controls prohibit the sale of these advanced chips to China on national security grounds. Lava discovered the chips through publicly exposed instances of Nvidia's DCGM Exporter monitoring tool, not through physical seizure or customs inspection. The finding highlights ongoing challenges in enforcing technology export restrictions.
Lava Discovered Chips Through Exposed Nvidia Monitoring Tool
Lava traced the chips through publicly exposed instances of Nvidia's DCGM Exporter, a monitoring tool operators use to track GPU performance. Many operators leave the tool unsecured, according to the research. Those exposed endpoints reveal what hardware is running behind them. In this case, the hardware included 32 B300 chips, and the associated IP addresses pointed back to China Telecom.
Lava's work links the chips to IP addresses connected to the carrier—a network association distinct from confirming physical ownership or exact location of the hardware. The research describes the B300s and similar advanced GPUs as purportedly valued at over $100 million.
Lava's October 9 Report Identified 2,100 Exposed Hosts Globally
The China Telecom discovery builds on a broader study Lava released on October 9, 2026. Lava identified approximately 2,100 exposed DCGM Exporter hosts globally in that earlier work.
The same report flagged a vulnerability in Nvidia's systems tracked as CVE-2026-47483. It carries a severity rating of 8.2, and Lava's research indicated it could allow remote disruption of affected AI infrastructure.
Research Points to Rising Prices on Gray Markets in China
The research points to evidence of rising prices for advanced AI chips on gray and black markets in China. Lava's discovery suggests that some of that hardware may be reaching networks tied to a major Chinese state enterprise. It also shows that detection can come from unexpected places, such as a security researcher scanning for misconfigured software.
Operators Face DCGM Exporter Security and CVE-2026-47483 Vulnerability
Nothing in Lava's findings indicates Nvidia itself sold the chips into China. For data center operators, if GPU monitoring tools are reachable from the open internet, Lava's research suggests they are being catalogued. Locking down those endpoints and addressing CVE-2026-47483 are the steps highlighted by the research.
FAQ
What did Lava discover on October 22, 2026?
Lava identified 32 Nvidia Blackwell Ultra B300 chips linked to IP addresses connected to China Telecom through publicly exposed DCGM Exporter monitoring tool instances, according to The Information's report on October 22, 2026.
How did Lava find the Nvidia chips?
Lava traced the chips through publicly exposed instances of Nvidia's DCGM Exporter monitoring tool. Many operators leave the tool unsecured, and those exposed endpoints reveal what hardware is running behind them, including the 32 B300 chips with IP addresses pointing to China Telecom.
What vulnerability did Lava's October 9 report identify?
Lava's October 9, 2026 report flagged vulnerability CVE-2026-47483 in Nvidia's systems, which carries a severity rating of 8.2 and could allow remote disruption of affected AI infrastructure, according to the research.
