Digging into Browser-based Crypto Mining

TL;DR

This paper investigates the rise of in-browser cryptocurrency mining, especially Monero, by analyzing millions of domains, developing a new fingerprinting method, and quantifying Coinhive's contribution to the Monero blockchain.

Contribution

It introduces a novel fingerprinting technique to detect browser miners more effectively and provides the first detailed analysis of Coinhive's role in Monero mining.

Findings

Identified up to 5.7 times more miners than public block lists.

Coinhive contributed 1.18% of Monero blocks in June 2018.

Developed a method to link mined blocks to mining pools.

Abstract

Mining is the foundation of blockchain-based cryptocurrencies such as Bitcoin rewarding the miner for finding blocks for new transactions. The Monero currency enables mining with standard hardware in contrast to special hardware (ASICs) as often used in Bitcoin, paving the way for in-browser mining as a new revenue model for website operators. In this work, we study the prevalence of this new phenomenon. We identify and classify mining websites in 138M domains and present a new fingerprinting method which finds up to a factor of 5.7 more miners than publicly available block lists. Our work identifies and dissects Coinhive as the major browser-mining stakeholder. Further, we present a new method to associate mined blocks in the Monero blockchain to mining pools and uncover that Coinhive currently contributes 1.18% of mined blocks having turned over 1293 Moneros in June 2018.