Only 10 People Made Significant Profits from Coinhive Mining Scripts

Experts from the RWTH Aachen University have published a very interesting set of statistics. According to their data, just 10 users are responsible for placing 85% of all links related to the Coinhive mining service.

To recap, Coinhive and its users earn money through so-called “cryptojacking”—mining scripts that are embedded into website pages and then use the devices and browsers of site visitors (usually secretly and without warning) to mine cryptocurrency. Each month, Coinhive mines about $250,000 worth of Monero. Coinhive operators keep 30% of the mined amount, while the rest goes to the service’s clients. Although there are other similar services besides Coinhive, it remains the clear leader by a wide margin.

However, experts note that the overall popularity and profitability of cryptojacking is highly questionable, especially after the introduction of special browser extensions designed to combat this activity, as well as the ability of security solutions and even ad blockers to detect and block browser-based mining. According to the report, mining scripts were found on only 0.8% of websites.

The researchers used a new detection method based on the public NoCoin filter (which turned out to be insufficient) and their own WebAssembly-based solution. They collected statistics from the one million most popular sites according to Alexa, as well as .org domains, to detect all Coinhive scripts and link each one to specific user accounts. This is possible because the script code must include a special token, which is used to calculate payouts.

It turned out that the most active distributors of Coinhive are just 10 clients of the service, who receive the largest profits from their activities. “In fact, one third of all links are created by the same user, and about 85% of all links are created by just 10 people. Of course, one user can use multiple tokens, but this only confirms our observations,” the report states.