Cryptocurrency mining is the process of performing cryptographic calculations that help validate and maintain a blockchain-based currency. Miners are rewarded for contributing processing power, but the same process can be abused when a website runs mining code on a visitor’s machine instead of its own infrastructure.
What Cryptocurrency Mining Actually Does
Cryptocurrency mining is the computational work that keeps a blockchain ledger workable: miners validate transactions, compete to add new blocks, and receive rewards when they successfully contribute processing power. In legitimate deployments, mining is a consensus mechanism and an incentive model, not a security control by itself.
The security relevance comes from the fact that mining consumes CPU, GPU, memory, bandwidth, and electricity. That makes it attractive to attackers, but it also means organisations can accidentally create resource contention, noisy infrastructure, and cost spikes when mining is allowed or hidden in the environment.
Where Mining Becomes a Security Issue
Mining becomes security-relevant when the activity is performed without the owner’s consent or outside the intended business use. The common abuse pattern is cryptojacking, where a browser, endpoint, server, container, or cloud workload runs mining code on someone else’s resources.
That abuse often overlaps with broader cloud abuse and credential compromise. For example, NHIMG’s Amazon AWS Hacked Accounts Crypto-Mining shows how compromised IAM credentials can be used to spin up infrastructure for mining at scale. The same pattern can appear anywhere attackers can obtain compute access and hide resource consumption inside normal operations.
How to Recognise Legitimate Versus Abusive Mining
Legitimate mining is usually visible, intentional, and accounted for in policy, budgeting, and infrastructure design. Abusive mining is typically concealed, opportunistic, and designed to persist long enough to monetise stolen or hijacked compute.
Practical indicators include unexplained sustained CPU or GPU load, unusual outbound traffic to mining pool, browser processes consuming excess resources, sudden cloud spend growth, and services that restart mining workloads after termination. On shared systems, mining can also degrade application performance and mask deeper compromise by blending into routine resource noise.
Because mining code is often lightweight and easy to distribute, defenders should think in terms of resource abuse, not just malware signatures. In some cases the visible symptom is cost inflation before any traditional alert fires.
Why Mining Matters for Governance and Control Design
Mining is a useful example of how security, cost, and operations intersect. If an environment allows arbitrary code execution, weak cloud access controls, or poor browser hygiene, mining abuse can become a low-friction way for attackers to monetise access. The issue is not only fraud, but also the way mining can consume capacity that should support business workloads.
That is why controls around workload permissions, browser execution, cloud guardrails, and resource monitoring matter. A strong governance model treats mining as a signal that access boundaries, detection coverage, or workload trust assumptions may already be too permissive.
Risk and Threat Considerations
Mining itself is not always malicious, but unauthorised mining creates a clear security and operational risk because it turns compute into an exploitable asset. In cloud and enterprise environments, attackers often prefer mining because it can generate value quietly while consuming a victim’s resources, budget, and capacity.
Failure mechanism: An attacker gains code execution, browser execution, or infrastructure access, then runs mining workloads that persist long enough to produce profit while avoiding obvious disruption. The same access path that enables mining can also signal broader compromise, especially when it comes through stolen credentials or abused cloud permissions.
Impact: Organisations can see elevated costs, degraded performance, reduced availability for legitimate services, and slower detection of the underlying intrusion. In larger environments, mining can also be a marker that access controls are weak enough to support additional abuse beyond compute theft.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 address the attack and risk surface, while CIS Controls v8, NIST CSF 2.0 and NIST SP 800-63 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| CIS Controls v8 | 8 — Audit Log Management | Mining abuse is often detected through unusual resource and activity logs. |
| 10 — Malware Defenses | Cryptomining payloads are commonly delivered and sustained as malware or unwanted code. | |
| 12 — Network Infrastructure Management | Unauthorized mining often relies on outbound connections to external mining pools. | |
| Recommendation — Log and review compute, process, and cloud activity to surface cryptomining abuse early. Use malware defenses to block and quarantine mining payloads and associated executables. Restrict and monitor outbound traffic to mining destinations and other suspicious infrastructure. | ||
| NIST CSF 2.0 | DE.CM — Security Continuous Monitoring | Cryptomining is usually found through resource and network monitoring signals. |
| PR.AC — Identity Management, Authentication and Access Control | Abusive mining frequently follows stolen or over-permissive access to compute resources. | |
| PR.PT — Protective Technology | Protections such as endpoint controls and browser restrictions help block unauthorized mining scripts. | |
| Recommendation — Continuously monitor resource usage and outbound connections for cryptomining indicators. Enforce access control that limits who can create, run, or persist compute workloads. Deploy protective technology to prevent and contain unauthorized mining execution paths. | ||
| OWASP Non-Human Identity Top 10 | NHI-01 — Secret Leakage and Exposure | Mining campaigns often begin after stolen cloud or API credentials are exposed. |
| NHI-02 — Excessive Permissions and Privilege | Cryptomining abuse scales quickly when an account can create or expand compute freely. | |
| NHI-06 — Third-Party and Federated Trust Risk | Downstream mining abuse can follow compromise of trusted third-party access paths. | |
| Recommendation — Protect and rotate secrets that could be used to provision unauthorized mining infrastructure. Minimize permissions that allow accounts to launch or modify infrastructure for mining. Review trusted integrations and third-party access that could be abused to deploy mining workloads. | ||
| NIST SP 800-63 | IAL/AAL/Authenticator guidance — Digital Identity Assurance and Authenticator Guidance | Unauthorised mining often depends on weak or stolen authentication to obtain compute access. |
| Recommendation — Use strong authenticators and assurance practices to reduce account takeover that enables mining abuse. | ||
Practitioner Guidance
Why practitioners should care: Mining is often the visible outcome of a control failure, not the root problem. If you only remove the miner, but do not address the access path, the attacker can simply redeploy it.
What to watch for: Treat sustained resource spikes, mining-pool connections, unknown browser extensions, unusual container activity, and unexplained cloud spend as investigation triggers. The most useful response is to correlate resource abuse with the account, workload, or endpoint that enabled it.
Practitioner takeaway: The real security question is not whether mining is present, but whether your environment makes unauthorised compute use easy to hide and hard to evict.
