Who and What Is Coinhive?
Summary: Coinhive, a cryptocurrency mining service whose JavaScript code runs on a visitor's browser to mine Monero, was identified by multiple security firms as the top malicious threat to Web users less than a year after its July 2017 debut, with nearly 32,000 sites running its miner code according to publicwww.com. The code has been found on hacked high-profile sites including The Los Angeles Times, Blackberry, Politifact and Showtime, in a Buenos Aires Starbucks WiFi hotspot, in YouTube ads via Google's DoubleClick, and on the Browsealoud service used by UK government sites.
What you should know: Coinhive keeps 30 percent of all Monero mined with its code whether or not a site consented, and security expert Troy Mursch says invalidating an abusive key does not stop the JavaScript from running - Coinhive then keeps 100 percent of what that site mines, giving it what Mursch calls zero incentive to police the abuse.
Read the original at Krebs on Security ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026