Search

ASIC Mining Security: Firmware, Access and Compliance

Used Antminer S19s stacked in a dense wall.

The realistic threat to a home mining setup is not a sophisticated attack. It is a miner with its default password still set, reachable from the internet because someone forwarded a port to see it from work. The standard attack changes one field — the pool address — and your machine goes on hashing perfectly, quietly, for somebody else. The hardware looks healthy the whole time; only the payouts stop.

That failure mode drives everything below: keep the miner off the public internet, change the credentials that shipped with it, and check that the pool and payout address it reports are still the ones you set.

The twenty minutes that prevent the attack that actually happens

In order, and none of it needs a security budget:

  • Change the web login. Antminers ship with root / root. WhatsMiners ship with admin / admin. These are not secrets — they are in every manual and every scanner’s wordlist. A used machine that arrives on its factory credentials has been reachable by anyone who found it for its entire previous life.
  • Do not port-forward a miner. Ever. If you want to see the dashboard from outside, use a VPN into your own network. Port 80 forwarded to a miner is the single most common way a machine ends up hashing for someone else, and search engines that index exposed devices make finding it a query rather than an attack.
  • Put miners on their own subnet or VLAN, with no route to the machine you do your banking on. Miners are appliances running old kernels; treat them as untrusted devices on your own network, because that is what they are.
  • Write down the pool, the worker name and the payout address the day you commission the machine, and check them monthly against what the miner reports. This is the only check that catches a successful pool hijack, and it takes thirty seconds per machine.
  • Compare hashrate at the pool, not on the miner. A hijacked machine reports a perfect local hashrate. The pool-side graph is the one that tells the truth about where the work went.
  • Record serial numbers and MAC addresses before the units go into a rack. It is the difference between a police report and a shrug if a pallet walks, and it is what we ask for when someone brings a fleet to us to resell.
A blue Bitmain Antminer control board photographed on a carpet, two shielded network and USB sockets along its top edge, a BITMAIN silkscreen down the right side, a white barcode label reading Ctrl_C55, and rows of ribbon and multi-pin connectors along the bottom and right edges.
The attack surface, physically. Everything in this section happens on this board — the network socket at the top edge is the whole of what an ASIC exposes to a LAN. Pictured: Bitmain Antminer Control Board, ctrl_C55 V2.3011 NGSB202101 – Tested, Working.

What is actually exposed on an ASIC, port by port

A mining rig is not a general-purpose computer and its attack surface is small enough to list. On a typical Antminer-class machine:

Port Service What it gives an attacker What to do
80 / 443 Web UI Full configuration: pool, password, firmware upload, reboot Change credentials; never expose to the internet
22 SSH (on some firmware) Shell on the control board Disable if unused; change any default key or password
4028 cgminer/bmminer API Status by default, and on permissive builds privileged commands too Bind to the LAN only; do not forward
3333 / 4444 (outbound) Stratum to the pool Plain-text pool traffic; a machine-in-the-middle can redirect work Use a pool that offers an encrypted stratum endpoint where one exists

Two things follow from that table. First, the web UI is the whole game — everything an attacker wants is one authenticated page away, which is why the password and the port-forward are the entire defence for most operators. Second, stratum is plain text on most pools by default, so a hostile network between you and the pool can redirect work without ever touching the miner. On your own premises that is a low risk; on shared or hosted infrastructure it is worth asking about.

Firmware: the trade nobody explains at the point of sale

Third-party firmware — Braiins OS, VNish and the rest — is genuinely useful. It is how you undervolt a machine to a better J/TH, and several units on our used shelf ship on it precisely because the tune is worth having. It is also the largest deliberate change you can make to a miner’s trust model, and the listings say so.

What you are accepting: the manufacturer’s warranty ends the moment you flash, the firmware’s authors now have effective control of the machine, and any auto-update mechanism they run is a channel into your fleet. This is not hypothetical history. In 2017 researchers found a remote shutdown mechanism baked into Bitmain’s own stock firmware — “Antbleed” — that phoned home on a schedule and could have been used to switch off a large share of the network’s hashrate. In 2018–19 a worm known as hAnt spread between Antminers on flat networks and bricked infected machines outright. Both events were firmware-trust failures, and one of them was in the vendor’s firmware.

The practical rules we follow before a machine leaves here, and that you should apply to anything you buy from anyone:

  • Flash only images fetched directly from the maker’s own site or the tuning vendor’s own release channel. Never a link in a forum post or a marketplace message.
  • Reflash any used machine whose firmware provenance you cannot establish, then reset the credentials, before it touches the rest of your network.
  • Assume a tuned machine has no manufacturer cover, and price it that way — that is why a tuned used unit is cheaper than a boxed one, not a bargain nobody noticed.
  • Keep firmware versions consistent across a fleet. Mixed versions turn a fleet-wide symptom into a per-machine investigation.

Buying used: the security questions to ask the seller

This is the part of mining security that a hardware dealer can tell you something useful about, because it is what we do every week when a fleet comes in. A used miner is a second-hand computer with somebody else’s configuration on it.

  • “Has it been factory reset, and what firmware is on it?” If the answer is vague, assume the previous owner’s pool, password and possibly their SSH key are still on the machine. That is not necessarily malice — it is the normal state of an untouched fleet — but it means the first thing you do on arrival is wipe and reconfigure.
  • “Is the control board original to the unit?” Mixed-provenance control boards are common in refurbished stock and are not automatically a problem, but they are a reason to reflash rather than trust what is on there.
  • “Can I have the serial numbers before it ships?” A seller who will not give you serials in advance is a seller you cannot check anything about afterwards.
  • “What was it running, and for how long?” Relevant to condition, and it is also the question that tells you whether you are buying from someone who actually had the machines in front of them.

Run the same 48-hour acceptance test on arrival that you would for any used purchase — hashrate at the pool, error counts, board temperatures — because freight claim windows are short and a security problem and a hardware problem look identical for the first day. How to buy a used ASIC miner covers the rest of that checklist, and lots go out of here with credentials reset and firmware stated on the listing.

U.S. compliance, limited to what actually applies to a miner

Most writing on this topic lists every financial regulation in existence and applies none of them. Here is the short, accurate version for someone plugging machines in.

Mining itself is not a securities transaction. In March 2025 the SEC’s Division of Corporation Finance published a statement on certain proof-of-work mining activities, taking the view that mining on a public proof-of-work network — solo or in a mining pool — does not involve the offer and sale of securities. There is a good practitioner summary of what it does and does not cover. It is staff-level guidance rather than law, and it does not bless anything built around mining, such as selling hashrate contracts to the public.

The income is taxable when it lands. Mined coin is ordinary income at its fair market value on the day you receive it, and that value becomes your basis for a later sale. The depreciation side is covered in ASIC depreciation and US tax treatment. General information, not tax advice.

The regulations you will actually meet are electrical and local. The NEC treats a miner as a continuous load and sizes the circuit at 125% of its draw — a 3,510 W machine at 240 V is 14.6 A, sized to 18.3 A, so a 20 A circuit with nothing spare. Beyond that it is your utility’s tariff and demand charges, your local inspection, and in more places every year a noise ordinance. None of these are federal and all of them can stop a site.

Do not mine on hardware you do not own or pay the power for. This sounds obvious and it is the single most common enforcement story in mining. University and corporate policies — Cornell’s and Michigan’s are typical — prohibit mining on institutional resources outright, and cloud providers treat unauthorised mining as the primary symptom of a compromised account rather than as a billing dispute, which is why Google’s own guidance is written as attack response.

The security mistakes that cost operators machines and payouts

  • Leaving the default password. The whole attack, start to finish. Costs nothing to fix and it is still the most common finding on machines that arrive here.
  • Forwarding a port so the dashboard is reachable from work. Second most common, and the reason the first one matters.
  • Never checking the pool config after commissioning. A hijack is invisible in every local metric. Only the pool-side hashrate and the payout tell you.
  • Flashing firmware from a link someone sent. Also the way people lose whole fleets at once, because they do it to every machine in an afternoon.
  • Running miners on the same flat network as everything else. hAnt spread machine-to-machine on exactly that topology.
  • No record of serials. Makes theft unprovable and resale harder.
  • Trusting the machine’s own dashboard as the source of truth. It reports what the firmware tells it to report.

The security work that actually pays on a home setup is dull: change the default credentials, keep the miner off the internet, and install firmware only from the source that made it. Note that third-party firmware voids any remaining manufacturer cover — several machines on our used shelf ship on Braiins OS for exactly that reason, and their listings say so.

Frequently Asked Questions

What is the most common way a mining rig actually gets compromised?

Default credentials on a miner that has been port-forwarded to the internet. Antminers ship as root/root and WhatsMiners as admin/admin, and both are in every scanner’s wordlist. The attacker changes the pool address and nothing else; the machine keeps reporting a perfect hashrate locally while the work goes somewhere else. Changing the password and removing the port forward closes almost the entire real-world attack surface.

How do I tell if my miner has been hijacked?

Compare the pool-side hashrate with what the miner reports, and check the configured pool URL, worker name and payout address against what you wrote down at commissioning. A hijacked machine looks completely healthy in its own dashboard — correct fan speeds, correct board temperatures, correct hashrate — because only the destination of the work changed. Payouts stopping with no hardware symptom is the signature.

Is third-party firmware like Braiins OS or VNish safe to run?

It is widely used and genuinely useful for undervolting, and it is also a real transfer of trust: it ends the manufacturer’s warranty and gives the firmware’s authors effective control of the machine. Flash only from the vendor’s own release channel, keep versions consistent across a fleet, and remember that firmware trust has failed on this hardware before — the 2017 Antbleed remote-shutdown mechanism was in Bitmain’s own stock firmware, and the hAnt worm bricked Antminers on flat networks in 2018–19.

What should I do first with a used miner when it arrives?

Assume the previous owner’s configuration is still on it. Reflash from the maker’s own image, reset the web credentials, set your own pool and worker, put it on a subnet of its own, and record the serial and MAC. Then run a 48-hour acceptance test against the pool-side hashrate, because freight claim windows are short and a security problem and a hardware fault look the same for the first day.

Is Bitcoin mining legal in the United States and does the SEC regulate it?

Mining is legal, and in March 2025 the SEC’s Division of Corporation Finance stated its view that mining on a public proof-of-work network, solo or in a pool, does not involve the offer or sale of securities. That is staff guidance rather than law and it does not cover businesses built around mining, such as selling hashrate to the public. The rules you will actually meet are the NEC’s 125% continuous-load sizing, your utility’s tariff, local inspection and noise ordinances, plus income tax on the coin when you receive it.

More on securing a miner

Hardware worth pairing with a well-run operation

More in ASIC, or the full ASIC miner inventory.

Type to search