How Crypto Currency Mining Works and What a Miner Actually Does

What a Crypto Currency Miner Actually Is

A crypto currency miner can mean a few different things. It might be a software program, a hardware rig, a hosted cloud setup, or just the act of using those resources to participate in a cryptocurrency network. In a proof-of-work system, the miner runs the coin's consensus algorithm, competes to solve a computational puzzle, validates and orders transactions, and earns cryptocurrency when its work gets accepted into a block. Mining isn't just about creating new coins. It also validates transactions, adds them to a distributed ledger, and helps prevent double-spending. A distributed network has no central authority to stop the same digital currency from being spent twice. Proof-of-work and other consensus mechanisms establish agreement among participants.

A miner might be a general-purpose computer using its CPU, a system built around one or more GPUs, an ASIC machine designed for a particular algorithm, an FPGA or other specialized processor, a cloud-hosted mining installation, or a participant in various pool arrangements. It could be a legitimate operation controlled by its owner, or it could be cryptominer malware that takes over a victim's resources without authorization. Malicious cryptominers, also called cryptojackers, exploit a victim's computing resources for the attacker's profit. Unlike cybercrime schemes where cryptocurrency is mainly used as payment, cryptojacking uses the mining process itself to generate income. Mining malware is often noisy because it consumes unusually large amounts of processor, memory, electricity, and bandwidth.

Cryptominers have been part of cybercrime since at least 2013, when a video game company allegedly used customers' machines to mine Bitcoin.

Cryptocurrency, Blockchains, and Wallets

Cryptocurrency is a digital form of currency that uses cryptographic techniques to secure transactions and control the creation of new coins or tokens. Unlike fiat currency, which is generally issued and managed through traditional financial institutions, cryptocurrency operates on decentralized networks using blockchain technology. A blockchain is a distributed ledger maintained by a network of nodes. Transactions are placed into blocks, and each block is linked to the preceding block. This creates a chain of records that is difficult to alter without controlling a substantial majority of the network's computing power. The decentralized structure can reduce dependence on banks or other traditional intermediaries while allowing participants to verify transaction history.

A cryptocurrency wallet is a collection of cryptographic secrets used to transact on a blockchain. A wallet is commonly represented by an address in a coin-specific string format. The address is public, and transactions involving it are generally visible on the blockchain, but the owner's real-world identity remains unknown unless information outside the blockchain links the person or organization to that address. Public-key systems use corresponding public and secret keys. The public key or derived address identifies or authorizes transactions, while the secret key allows the owner to sign them. Privacy-oriented coins add further cryptography to obscure addresses, balances, senders, receivers, or amounts.

Major cryptocurrencies mentioned

Consensus and Proof of Work

Consensus algorithms allow distributed networks to agree on the state of the ledger without a central authority. They help prevent double-spending, maintain ledger integrity, and make trustless transactions possible. Different cryptocurrencies use different mechanisms, each balancing security, scalability, and energy efficiency in its own way. Proof of work, or PoW, is the mechanism most closely associated with Bitcoin. Miners repeatedly calculate hashes until one participant finds a result that satisfies the network's current target and difficulty. The first miner to find a valid result is normally entitled to add the next block and receive the block reward.

Each block includes a reference to the previous block, creating a verifiable chain. Peers can check whether blocks are valid and whether the proof submitted for each block satisfies the network's rules. PoW is computationally and energetically intensive. Its security is based on the cost of acquiring enough computing power to rewrite or dominate the ledger. An alteration attack would require control over more than 50% of the network's computing power, which is described as highly impractical for major networks. A miner or group controlling a large proportion of a network's hashrate can still create a 51% attack risk. Cryptominers generally use PoW because the attack vector is resource hijacking.

Proof of stake, or PoS, is used by networks such as Ethereum 2.0 and Cardano. Validators are selected to create blocks according to the amount of cryptocurrency they hold and are willing to stake.

PoS does not require miners to perform the same intensive computational search used in PoW, making it more energy-efficient. Its security assumption is that validators with a larger financial stake have a stronger incentive to act honestly. The potential attacker motivation for PoW mining declines if privacy-oriented coins become unprofitable or if networks move away from resource-intensive consensus. Ethereum's transition from PoW toward PoS is part of the changing mining landscape.

Testing every miner from free software to a $5K hydro ASIC

The creator runs eight price tiers in one sitting - NiceHash on a GPU, a $35 USB stick, home ASICs up to a water-cooled Bitmain S21 - and shows the noise, heat, and actual satoshis each one prints.

How the Mining Process Actually Works

Mining can be described as a lottery at scale. Each participant receives a mining job containing block information and a nonce. The miner repeatedly changes or tests nonce values and calculates hashes until it finds a result that meets the network target. The target is the highest value that an accepted hash may have. A valid result must be equal to or below that target. Difficulty expresses how difficult it is to find an accepted hash. Different coins calculate difficulty differently, but the common purpose is to regulate hashrate so blocks continue to appear at approximately the network's target time.

If blocks appear too quickly, the network can increase difficulty. If they appear too slowly, it can lower difficulty. One simplified example uses a one-byte target of `0x1F`. With `0xFF` representing the number of possible byte values, dividing `0xFF` by `0x1F` produces a difficulty of eight. In that example, a matching result is statistically expected once every eight random nonce calculations. Hashrate represents the mining work being performed by the network. A simplified relationship divides difficulty by target time to estimate network hashrate: `network hashrate = difficulty / target time`. The exact calculation varies by coin.

A hash is a compact digital fingerprint produced from data. Miners search for a hash that satisfies the network's target. In Bitcoin-style chains, a block's hash function links it to the previous block, making the block history verifiable. The first miner to submit acceptable proof normally receives the new block reward and transaction fees included in the block, while other participants receive ordinary transaction-validation roles rather than the full block reward. This is how crypto mining gets done at the technical level.

Mining Hardware: CPU, GPU, ASIC, and FPGA

A central processing unit is a general-purpose integrated circuit. A CPU can calculate many kinds of consensus algorithms, including PoW, but it may not do so efficiently as hardware designed specifically for the workload. CPU mining was practical during early cryptocurrency networks, but increasing difficulty has made it slow and expensive for many major coins. A miner does not necessarily need a powerful GPU or ASIC to run every cryptocurrency. Attackers commonly target ordinary computers, servers, and embedded devices that may only have CPUs. This supports the use of ASIC-resistant algorithms that can be mined on general-purpose processors.

A graphics processing unit handles complex arithmetic and parallel computation more efficiently than a CPU. GPU mining rigs combine multiple GPUs with a motherboard, power supply, cooling system, networking, and mining software. GPUs can also be useful for AI and other parallel workloads, which makes them attractive to both legitimate users and cryptojackers. GPUs produce substantial heat and require careful airflow and cooling. As more powerful GPU hardware becomes common in organizational networks, cloud servers, and AI infrastructure, attackers gain access to a wider pool of devices capable of running GPU-oriented mining algorithms.

Hardware comparison for mining

An application-specific integrated circuit is designed for one narrow task. Bitcoin ASIC miners are custom-built to perform the hashing required by Bitcoin and are substantially more efficient than general-purpose CPUs or GPUs. Their efficiency can make large-scale Bitcoin operations viable when electricity is available at a competitive price. ASICs are expensive and can become less competitive as network difficulty rises or a more efficient chip generation becomes available. They are also not effective for every algorithm. ASICs perform poorly when an algorithm requires substantial memory or a large number of branches based on previous results.

ASIC resistance can be built into a coin's hashing algorithm. An ASIC-resistant algorithm uses a large memory address space, complex computation, and features found in modern CPUs.

Monero's RandomX algorithm is an example. RandomX defines a custom instruction set and virtual machine that translates the algorithm for the underlying hardware. It uses many modern CPU features and is intended to favor general-purpose processors over specialized ASICs. If you're thinking about buying a mining rig , you need to understand which hardware works for which coin.

Physical Infrastructure for Large Bitcoin Operations

A large Bitcoin mine requires more than a collection of hashing machines. It needs reliable power, cooling, networking, security, physical space, monitoring, and maintenance. Poor infrastructure can reduce hardware life, increase downtime, waste electricity, and lower profitability. An overbuilt facility can also add unnecessary operating expense. Mining consumes enough electricity that power contracts and electricity rates are central operating factors. Large operators monitor temperature, humidity, airflow, and other environmental conditions and adjust equipment to reduce downtime and energy waste.

Bitcoin ASICs produce substantial heat. Traditional data centers may use HVAC systems, but HVAC itself consumes power and can reduce the facility's power usage effectiveness. Airflow-oriented designs can direct more electricity toward mining and cooling rather than facility overhead. High-density mining facilities also need to control dust, noise, exhaust heat, and the mixing of hot exhaust with cooling air. Mining data centers are designed around the airflow, electrical capacity, hardware density, maintainability, and scalability of the mining fleet.

Bitcoin mining hardware has moved through smaller manufacturing processes, including a planned transition from 5-nanometer to 3-nanometer chips. The stated benefits of 3-nanometer designs are improved energy efficiency and lower maintenance costs. Core Scientific also describes work with Block on modular 3-nanometer hardware intended to let miners replace individual hashboards rather than entire machines. This modular approach is intended to reduce capital and maintenance costs. More than 70 Bitcoin mining companies in the United States offer hosting services and the industry generates more than $1 billion in revenue per month. Hosting providers may manage electricity, cooling, physical security, and hardware, while some operations also manage the miners' daily operation.

AI Infrastructure and GPU Mining

The growth of generative AI creates a new potential cryptomining target because AI systems depend heavily on GPUs. The same GPUs are often well suited to many mining algorithms. Cloud and organizational GPU fleets can therefore provide attackers with substantial parallel computing capacity even when dedicated mining ASICs are absent. The research forecasts that cryptominer operators may eventually target AI infrastructure through model interaction, training processes, or both. That statement is presented as a prediction rather than a documented campaign at the time of the source.

Eighteen months of home mining profits, no filter

Lays out the real spreadsheet: revenue, electricity bills, and net profit from running a residential operation for a year and a half.

Transaction Privacy and Privacy-Oriented Coins

Bitcoin transaction data is stored as plaintext and is publicly accessible through blockchain explorers. The use of a digital wallet can be pseudonymous, but interactions with third parties can reveal identity. A person exchanging dollars for Bitcoin may have to disclose a wallet address, allowing the identity to be linked to that wallet. Decoy transactions generally remain traceable until funds enter or leave the network through an exchange. Deanonymization commonly occurs when funds are deposited into or withdrawn from a network or exchange. Bitcoin therefore does not provide the level of transaction privacy sought by cryptominers and other actors who want to conceal the origin or destination of illicit funds.

Privacy-oriented cryptocurrencies emerged partly to prevent misuse of transaction information. Monero and Zcash use techniques such as ring signatures, stealth addresses, and zero-knowledge proofs to obscure transaction details. Depending on the coin, these techniques can hide the sender, receiver, amount, or account balance. Attackers assess privacy across three areas: network communication including use of privacy networks such as Tor or I2P, transaction information including addresses and amounts, and cash-out routes through exchanges or other platforms that support privacy coins. A coin may provide strong transaction privacy but weaker network privacy, or it may communicate through a privacy network while exposing wallet information. Attackers balance these privacy properties against mining efficiency, coin value, exchange availability, and algorithm performance.

Monero, Zephyr, and Safex

Monero is described as the coin most commonly used by cryptominers. It is privacy-oriented and uses the ASIC-resistant RandomX proof-of-work algorithm. Its privacy system uses ring signatures, multiple asymmetric keys, Bulletproofs, RingCT, and other cryptographic methods. RingCT combines one real transaction input with decoy inputs so observers cannot determine which input funded the transaction. It also uses cryptographic techniques to conceal the sender, receiver, and amount. RandomX is designed to be resistant to ASIC specialization. It uses a custom instruction set and a virtual machine that translates the instructions to the hardware. This makes ordinary CPUs competitive compared with a purpose-built RandomX ASIC.

Zephyr presents itself as a privacy-focused protocol for the stablecoin market. It builds on privacy features associated with Monero and uses the RandomX proof-of-work algorithm. Zephyr divides its system into four tokens: ZEPH is the mineable reference token, ZRS backs the reserve for ZSD, ZSD is the stablecoin counterpart, and ZYS is a yield mechanism. Mining ZEPH yields 65% of the block reward to the miner while the blockchain retains the remainder. Zephyr was described as almost the least profitable of the candidate coins at the time of the research, making it less attractive than Monero. Nevertheless, samples mining Zephyr were found.

Safex is a blockchain platform designed for a private, decentralized marketplace where users can buy and sell without traditional intermediaries. It uses Safex Token (SFT) and Safex Cash (SFX). Its privacy design is based substantially on Monero and includes ring signatures and stealth addresses. Safex was described as the most profitable candidate coin at one point in the research, but active cryptomining had not been found beyond a small number of wallet addresses in configuration files. A network map found 298 Safex nodes, but only six were publicly available.

Mining Topologies and Communication Protocols

Mining setups can be organized in several topologies. The topologies have different balances among statistical reward probability, operating cost, decentralization, privacy, resilience, and detection risk. The components communicate through network technologies such as IP, Tor, and I2P. Application-level systems include the Levin peer-to-peer protocol and Stratum. Stratum is the mining standard for managing fleets of miners through structured JSON jobs. A job contains the data needed to execute the selected consensus algorithm.

The principal topologies described in the research are solo mining, conventional mining pools, P2Pool, NiceHash, and proxy-based arrangements. In solo mining, a miner works directly with its own blockchain node or a trusted node. A successful block provides the full applicable reward rather than a small pool share, but the odds of finding a block are based only on that miner's hashrate. A large botnet can make solo mining worthwhile because its combined hashrate approaches that of a pool. Solo mining also carries network-security and operational risks. If one operator controls a substantial share of the network hashrate, it creates a 51% attack risk. Maintaining a node adds cost, and a directly controlled node may identify the operator and reduce anonymity.

Types of mining pools and arrangements

In a conventional pool, multiple miners combine their hashrate and appear to the blockchain as one participant. This increases the statistical chance of finding a block. A pool is normally managed by one entity, which distributes the reward among participants according to their contributed shares or work. Some pools charge participation fees. Payout models include Pay Per Last N Shares, or PPLNS. Many pools do not require a conventional account or identity verification; the wallet address may serve as both the miner's login and the payment destination. Some pools specialize in privacy coins. Others support several coins and can switch or mine multiple algorithms according to profitability.

P2Pool is a decentralized pool design used by Monero. Instead of relying on one pool operator, miners collaborate through a peer-to-peer network.

Wallet Authentication and Stratum Jobs

A mining worker normally authenticates to a pool or proxy during the Stratum login request. It supplies a wallet address or account identifier, and the server credits valid shares to that account. A worker name is often included in the password field, and an agent field may identify software such as XMRig and the algorithm being used. Because the worker must be able to reconnect, its wallet information may remain in process memory after the first pool connection. A direct miner therefore leaves a possible wallet indicator even when the configuration is otherwise obscured.

Mining Economics and Profitability

Mining profitability depends on the relationship between the work performed, the value of the reward, and the cost of operating the system. The principal variables are hashrate, mining difficulty and target block time, electricity consumption, local electricity price, hardware purchase and replacement cost, cooling cost, pool fees and reward-sharing methods, coin price and market volatility, transaction rejection or orphaned-block rates, hosting fees, hardware efficiency and expected useful life, availability and uptime, cloud-compute charges, and regulatory, tax, and operating requirements.

Increasing hashrate does not produce a proportionate increase in reward because the network normally adjusts difficulty. A more efficient miner can also become less competitive as newer hardware is introduced. CPU mining can require months to produce a small return when difficulty, power, and cooling are unfavorable. GPU rigs can mine more than one hardware type but have higher total power requirements. ASICs have better algorithm-specific efficiency but may become obsolete after a hardware generation change. Cloud mining removes some physical setup and maintenance work but introduces provider fees, contract terms, withdrawal risk, and continuing service dependence.

One stated estimate says an average ASIC miner uses approximately 72 terawatts of power to create one Bitcoin in about ten minutes. The surrounding material notes that such figures change as technology and difficulty change. For professional operations, electricity is often a major share of operating cost. Mining can remain profitable when power is obtained under long-term contracts at low rates, when equipment is efficient, and when the miner can maintain high uptime. At the same time, a mining operation can become unprofitable rapidly when the market price falls, difficulty rises, hardware requires replacement, or power and cooling costs increase.

The infrastructure source labels its discussion as informational rather than professional or investment advice and states that the information can change, may be incomplete, and is not guaranteed to be current.

Tax Implications and Legal Status

Mining can create two separate taxable events. A taxpayer may owe tax on cryptocurrency received as a mining reward, and may owe additional tax when the reward is sold or exchanged for another asset. IRS Notice 2014-21 addresses cryptocurrency mining. Under the treatment described in the legal source, a miner recognizes gross income when reward tokens are received, measured by their fair market value at the time of receipt. If the activity constitutes a trade or business, the reward may be treated as self-employment income. If the miner performs the work as an employee, cryptocurrency received as compensation may be treated as wages subject to income-tax withholding and associated Social Security, Medicare, and unemployment taxes.

The legal treatment of cryptocurrency mining varies by jurisdiction. Many countries had not enacted detailed rules specifically governing mining. FinCEN treats crypto miners as money transmitters, which can bring them within money-transmission rules. Israel treats mining as a business subject to corporate income tax, and there is continuing regulatory uncertainty in India. Canada and the United States were described as having a comparatively favorable approach. Relatively few countries prohibit cryptocurrency mining outright, aside from jurisdictions that have adopted broader cryptocurrency restrictions. Laws involving money transmission, taxation, electricity use, equipment imports, consumer protection, or energy consumption can still affect a mining operation.

Mining has also faced environmental criticism because the electricity and fuel used by some mining operations may come from fossil-fuel power sources. Concerns about energy use and emissions contributed to interest in lower-energy consensus mechanisms, including PoS.

Why Cryptominers Target Victim Resources

Most financially motivated cybercriminals use cryptominers because mining provides a direct way to monetize an intrusion. Ransomware requires a victim to pay, while data theft requires a buyer or another monetization path. Cryptomining begins producing value as soon as the compromised resource begins mining. The balance between effort and expected reward is important. A coin worth only a fraction of a cent per year would not justify an attacker's risk of detection or arrest. Attackers consider current coin value, mining difficulty, total network hashrate, their share of that hashrate, hardware available on victims, energy consumption, pool or marketplace fees, transaction and exchange availability, privacy properties, expected campaign duration, and the probability of being traced or stopped.

The average business-size comparison used in the research estimated one long-running Monero campaign at about 300 XMR per year. At the stated value of 1 XMR = US$150, that was approximately US$45,000 annually. A later campaign analysis valued the same or a closely related operation at nearly US$47,000 per year and US$5.50 per hour. Privacy is the second major motivation. A direct mining profit can be concealed before it is exchanged if the coin hides transaction participants and amounts. Tor or I2P may also conceal network communication, while privacy-supporting exchanges may reduce the connection between the attacker and a conventional identity.

Industries and Attack Volume

Cryptominers can be found in many sectors. Communications with public mining pools have been used to study the distribution of mining traffic. Higher-education institutions are among the most targeted sectors, possibly because they have substantial centralized computing resources that may be unattended. In the private sector, cloud and hosting providers are preferred targets because they offer large pools of computing capacity. Cloud infrastructure can also hide the physical effects of resource use, including heat, noise, and local electricity consumption.

The research cites a 2022 Sysdig estimate that a victim loses approximately US$53 for every US$1 of profit made by the cryptominer. The difference accounts for consumed power, hardware wear, service disruption, and other direct or operational costs. This is why free cryptocurrency mining for the attacker is so expensive for the victim.

Mining Bitcoin on a gaming laptop in ten minutes flat

Walks through the NiceHash install - kill sleep mode, make an account, download the miner, paste a wallet address - and suddenly your GPU is hashing while you sleep.

Cloud Cryptojacking Lifecycle

Cloud cryptojacking is the use of compromised cloud tenants or cloud accounts to create compute resources for cryptocurrency mining. It differs from ordinary authorized cloud mining because the attacker does not pay for the compute directly. Instead, the attacker uses stolen credentials, excessive permissions, or a hijacked subscription to place the cost on the victim. The cloud model can make cryptojacking attractive to an attacker for several reasons: cloud processors provide fast, large, and scalable resources; GPU instances are much more effective for mining than CPU instances; a legitimate tenant can make resource creation appear normal; automated services can create many virtual machines quickly; an attacker can combine resources from multiple subscriptions or tenants; the victim may not notice the activity until the bill arrives; cloud accounts can provide additional capabilities for persistence, lateral movement, or data theft.

Cloud mining is generally not financially viable when an attacker pays the normal provider bill. Attackers therefore use free trials, stolen or abused accounts, over-privileged credentials, or other methods to avoid the normal cost of compute. Cloud cryptojacking can cause significant unexpected compute charges, exhaustion of CPU and GPU quotas, resource depletion needed for business continuity, service interruption, exposure of the cloud tenant to additional attacker activity, use of the compromised tenant for lateral movement or persistence, risk of theft of information stored in the tenant, and difficulty investigating activity after subscription hijacking.

The Microsoft Threat Intelligence research published July 25, 2023 reported more than US$300,000 in compute fees in some targeted organizations.

Initial Access and Privilege Escalation

The attacker generally needs credentials that can access the cloud tenant and create virtual machines or provide a path to an account with those permissions. The required role is often equivalent to a virtual machine contributor role. If the account does not already have sufficient permissions, the attacker may escalate privileges or use another account with the required role. Commonly described initial-access methods include phishing, leaked credentials, compromise of an on-premises device, abuse of an over-privileged identity, use of a global administrator account, and abuse of a valid account that was not protected with MFA. In the Microsoft investigations, accounts used in nearly all observed cases did not have MFA enabled. The absence of password-spraying or brute-force evidence suggested that leaked credentials were a common entry method.

A threat actor may also create attacker-controlled virtual machines inside a legitimate tenant and use cloud services as the operational infrastructure. This living-off-the-land approach can avoid external command-and-control infrastructure. An attacker may compromise a global administrator account. In Azure environments, a global administrator may still need to use an elevate access option before it can manage every subscription and management group. Protecting that ability is important because an attacker with effective global control can grant itself roles that permit compute creation.

Subscription Hijacking and Quota Increases

Subscription hijacking is a defense-evasion technique in which a threat actor moves or changes the subscription's administrative context. The destination can be an attacker-controlled tenant or another affected tenant that the attacker can access. Subscription-level activity may remain associated with the subscription, while tenant-level role-based access control activity can be recorded in a different tenant. This separation makes it more difficult for the original customer to reconstruct the complete attack timeline or perform a full investigation. After gaining access, the attacker can use existing quotas or request increases. Quota increases may be reviewed, and some Azure Batch quotas require a support request. Attackers without permission to increase quotas may exhaust the available capacity across multiple regions instead.

An observed attacker asked Microsoft support to increase an Azure Batch limit after creating multiple batch accounts. Microsoft Incident Response also treats unexpected quota increases as an early signal of resource abuse. Relevant anomalies include several increases within a short period, increases across multiple regions, increases in regions not normally used by the environment, increases in core types that are rarely used, and provisioning by a user with no previous compute history.

GPU Cloud Resources and Automated Deployment

GPU compute provides access to NVIDIA and AMD GPU cores. GPU instances can mine substantially faster than CPU instances. The most-abused options identified in the research were NVIDIA T4, V100, and A100. Attackers can use several Azure services to create compute rapidly: VM scale sets, Azure Machine Learning compute clusters, Azure Batch, and Azure Container Instances. These services support centralized management and automated deployment. In one observed case, an attacker used VM scale sets to deploy identical amounts of compute across multiple regions in a three-hour period.

Deployment patterns can reveal malicious use because they differ from the tenant's normal provisioning behavior. Anomalies include accounts that had never provisioned compute before suddenly creating large volumes, GPU compute appearing in an environment that had never used GPU compute, resources being deployed to unusual regions, a recent identity anomaly followed by high-volume resource creation, multiple deployment failures caused by unavailable core quotas, the same automated deployment pattern repeated across hijacked subscriptions, a rapid series of deployments across several regions, and an attacker staggering deployments slightly to avoid a single obvious burst while still provisioning quickly enough to profit.

Detection Methods for Cryptomining

Network detection can cross-reference traffic with mapped blockchain nodes and public pools. Because a successful PoW miner must communicate with a pool, node, proxy, or hashrate marketplace to receive work and submit results, this communication creates an observable indicator. Useful network indicators include connections to known Monero nodes, connections to public mining pools, connections to pool domains observed in cloud cryptojacking, Stratum traffic, Levin peer-to-peer traffic, connections to known proxy addresses, unusual ports such as 999, 3333, and 7777, XMRig HTTP API activity, repeated job requests or share submissions, wallet addresses in unencrypted Stratum JSON, and connections to Tor or I2P associated with mining infrastructure.

A Monero node can also be a Tor exit node or provide unrelated services. A map may therefore identify a server that is not exclusively a blockchain node. IP reassignment can also create false positives when the map is not current. Network detection should therefore combine multiple signals: a known node address, a mining-related port, pool or Stratum protocol behavior, wallet authentication, suspicious process activity, a cryptocurrency algorithm fingerprint, and abnormal CPU or GPU utilization.

Cryptominers intensively use the victim's computing resources. Monitoring for CPU, GPU, memory, or thread-utilization spikes can reveal an infection, but high utilization alone can also result from legitimate software, rendering, scientific computing, backups, or other workloads. ASIC-resistant algorithms can provide more specific indicators because their runtime instructions create a distinctive fingerprint. RandomX, for example, uses complex instructions and modern CPU features. Detection can inspect running threads and CPU-register state, including rounding-control behavior. The RandomX developer created a detection method that iterates through running threads and probes their execution state.

Locating Wallets in Process Memory

A miner that communicates directly with a pool generally stores its wallet in process memory. The wallet is used to authenticate the Stratum session and identify where valid shares should be credited. Possible discovery techniques include hooking socket APIs, intercepting the authentication request, capturing the wallet during the first pool connection, searching allocated process memory, using a machine-in-the-middle technique to intercept the login request, matching Monero's 95-character wallet format, and searching for Stratum-related strings and JSON keys. A Monero wallet begins with 4 or 8 and contains 95 Base58-compatible characters.

A wallet can be searched for after the miner's first pool connection because the miner must retain the address or account identifier to reconnect. A stronger signature combines the wallet pattern with Stratum fields. Matching the JSON structure, the login key, the wallet format, the algo value, and the XMRig agent string can produce fewer false positives than searching for a wallet alone. Some malware avoids placing a wallet in the sample itself. Configuration may be downloaded later, held in a proxy, retrieved from a remote file, or generated at runtime. Proxy arrangements can hide both the pool and wallet.

Omitting wallet addresses reduces the effectiveness of static rules that search for known address patterns. It also makes it harder to link multiple samples to one campaign.

Cloud Security Detections and Case Studies

Microsoft describes several detection categories for cloud cryptojacking. Microsoft Defender XDR detections can include access elevation by a risky user, suspicious Azure activity related to possible cryptocurrency mining, mass provisioning of GPU virtual machines for possible cryptocurrency mining, and suspicious creation of multiple Azure Machine Learning clusters and workspaces. Microsoft Defender for Cloud Apps alerts can include multiple VM deletion activities and multiple VM creation activities. Microsoft Defender for Cloud detections include crypto-mining activity, digital currency mining activity, fileless attack toolkit detected, possible cryptocoinminer download detected, process associated with digital currency mining detected, potential crypto coin miner started, and suspicious Azure role assignment detected.

The research documents several detailed case studies. One analyzed sample had persisted for approximately six years, connected to multiple proxies that accumulated about 5.6 MH/s and reached thousands of compromised machines. The campaign had been active at least since June 2018. At publication, the operator had accumulated at least 1,702 XMR. Another case study examined a public-pool Zephyr cryptominer with more than 1,400 active victims and approximately 800 KH/s total hashrate. A separate campaign used a mining proxy such as XMRig Proxy and distributed its cryptominer through pirated software. A second proxy-based campaign used a Stratum proxy between infected systems and a public pool.

The Confluence exploitation case involved CVE-2021-26084, an Atlassian Confluence Server vulnerability that allowed an unauthenticated attacker to execute remote commands. The attacker deployed XMRig on both Windows and Linux servers. ScreenConnect post-exploitation activity following CVE-2024-1709 and CVE-2024-1708 included cryptocurrency mining with XMRig and a miner that attempted to appear as a legitimate SentinelOne file. The Azure Batch cryptomining case involved an attacker who obtained access to an Azure administrator environment, created multiple Batch accounts, opened a Microsoft support request to increase a Batch limit, and used the available compute to create an autonomous cryptocurrency-mining system using Docker containers running a miner binary named xm configured for the Zephyr protocol with the RandomX-style rx/0 algorithm.

If you're curious about how to produce cryptocurrency yourself, the source material makes it clear that the economics are challenging for individuals. The hardware costs, electricity, cooling, and difficulty adjustments all work against small-scale operators. Cloud mining removes some physical setup but introduces provider fees and contract risks. And if you're looking at crypto mining rig for sale listings, remember that ASICs can become obsolete quickly as difficulty rises or new chip generations arrive. The landscape shifts constantly, and what's profitable today might not be tomorrow.