Twenty-odd dollars a day

This thread starts where the teardown chapter left off: the miner carried inside it, behind toy encryption, the Monero wallet it sends its earnings to. Having it is nice and tells you nothing — ninety-five characters don't tell anybody whether this is a kid experimenting or a business. The question that matters is how much it has earned, and the binary doesn't answer that one.

Monero, besides, is built precisely so that it can't be answered: there's no balance to look at and no movements to follow. So the answer wasn't going to come off the chain. It came from somewhere else, and without touching a single machine of theirs.

01A wallet has no balance, but the pool keeps books

The miner prefers to mine against an intermediary of its own, but it carries seven public supportxmr servers in reserve in case theirs goes down. And a public pool does something the currency doesn't: it keeps a tally of what it pays each wallet, and publishes it. No permission to ask for, no sign-up, nothing of anyone's to touch: it's an open page, like a notice board in a building lobby.

So I asked. Three read-only queries, and this is what was there:

paid out          21.27 XMR          pending    0.18 XMR
hashrate          917.7 kH/s
accumulated       26.99 trillion hashes
shares            85,131,478 valid · 676 rejected
last activity     seconds ago

Four things read out of that, and none of them was what I expected. seen

The campaign is alive. Not «was»: the pool logged a hash from it at the very moment I asked. I'd been telling the story of an infection from a few days back as though it were the past, and the thing is still mining as I write. seen

My decoy was one of many. That rate doesn't come off one machine: it takes between four hundred and nine hundred cores working at once, depending on what each one manages. Dozens or hundreds of infected boxes at the same time. Mine was in there for a few hours. inferred

It isn't from this week. The accumulated counter, at that rate, works out to close to a year of continuous mining — which is, roughly, as long as that wallet has existed. inferred

And it isn't an amateur. Of eighty-five million shares submitted, only 676 came back rejected: an error rate of 0.0008 %. That's a correct, stable configuration held together for months, not somebody trying things out. seen

Of those last twenty-five, seventeen fall in the same window, around 21:00 UTC. They get paid on office hours. seen

02And I asked about the old one too

The July samples didn't carry this wallet: they carried a different one, in the clear. While I was at the notice board, I asked about that one. What came back reorders the story I'd brought with me, and it's considerably bigger:

                  the old one           the new one
payouts           1,183                 308
first payout      14 January 2021       20 December 2025
last payout       3 August 2026         14 September 2026
mining now?       no                    yes
total paid out    144.77 XMR            21.27 XMR

First: the old wallet has been collecting since January 2021 — five and a half years, one thousand one hundred and eighty-three payouts. seen And that date isn't just any date: it's when Bitdefender published the first report on this family. read The same box, open since the world first heard of them, and unchanged the whole time. inferred

Second: the new one wasn't brought out in September. It has been collecting since December, seven months before the July sample that still had the old one configured in it. The two were collecting side by side for over half a year. And the old one didn't wind down gradually: it stopped dead on 3 August and hasn't moved a hash since. seen

Third: the old one moved nearly seven times more money. The one I'd been presenting as «the operation» turns out to be, by volume, the smaller of the two. seen

So what I'd called a handover wasn't one. By the time the binary changed wallets, the new one had been collecting for more than six months and the old one had been dead for a month: there was no baton pass, there was one box switching off and another that was already running. inferred

03What this is in money

Here's the one figure a reader can actually judge. Hashes and shares mean nothing to anyone; dollars do. Between the two wallets they add up to 166 XMR, and converting that isn't a matter of multiplying by today's price: there are coins in there mined in 2021, when Monero was worth a quarter of what it is now. Each payout has to be valued at the price the coin had on the day it was paid.

166.04 XMR across the two wallets

at today's price, flat        85,800 $   # bad figure: values 2021 coins at 517 $

valuing each payout at the price on its day:
  last year, measured         16,368 $   # 503 payouts · 43.35 XMR
  everything before Sep-2025  122.69 XMR  # estimated: no price series
  total, five and a half yrs  ~33,000 - 37,000 $
  current rate                ~23 $ a day

Thirty-odd thousand dollars over five and a half years, and about twenty-three a day right now. inferred And year on year it barely moves: 32.6 XMR in 2021, 20.5 in 2022, 23.5 in 2023, 28.7 in 2024, 22.3 in 2025 and 38.4 so far in 2026. seen

That changes the conclusion, and not in the direction I was heading. I came here to say «this isn't an amateur», which is true and doesn't go far enough. What's actually here is a small, old, steady business, and that explains in one go everything I've spent two chapters describing without knowing why: why they don't burn the infrastructure, why they get paid on office hours, why they come back to the same machine four times instead of flooding the internet. These aren't people in a hurry. These are people drawing a wage. inferred

04Who pays for the electricity

What's missing is the sum that changes whose problem this is, because what they earn isn't what it costs. Those four to nine hundred cores burn electricity, and the owner of each machine pays for it without knowing. The hard number here doesn't depend on any country — with ten to twenty watts per core at full tilt, the fleet burns around 216 kWh a day in the middle case, and somewhere between 96 and 432 at the extremes. inferred

Put a price on that and it looks like this:

                                     400 cores   600 cores   900 cores
                                       10 W        15 W        20 W
US residential  18.34 ¢/kWh            18 $        40 $        79 $
US commercial   14.19 ¢/kWh            14 $        31 $        61 $
Europe          0.20 €/kWh             19 €        43 €        86 €

Take the middle column at residential rates — which is the fair yardstick here, because most of what this family infects are small boxes and cheap servers, not data centres — and the victims are paying out more in electricity than the operator takes in: about forty dollars a day against the twenty-three that reaches them. Call it one and a half times over. inferred (On commercial tariffs the gap narrows to roughly break-even; in Europe, at twenty cents a kilowatt-hour, it widens to about double.)

Over a year, at residential rates, that's around 14,500 $ of somebody else's electricity to produce 8,400 $ of their own profit. inferred

And that's what really defines this. It isn't theft of money: it's a transfer of cost. The business only works because the expensive part is paid by somebody else, in bills of twenty or thirty dollars spread across hundreds of machines where nobody will ever notice them.

05What I can't prove

Four caveats, and none of them is minor.

It's what was paid out, not what was made. These are the payments the pool has sent those wallets. For that to be real money they'd have to sell, and what they've done with it isn't visible from anywhere.

The money belongs to the wallet, not to the critter. This is the one that weighs most. A wallet can receive from several campaigns at once, so what I've measured is the pocket, not the particular operation that got into my machine. The worker being named after the process they hide ties it closely, but it doesn't prove exclusivity.

And it's the floor, not the ceiling. The miner prefers its own intermediary and keeps the public pool in reserve, so everything above is what fell through the parachute. What they collect through their own proxy isn't visible from outside and there's no passive way to find out. The figure I can give is the minimum.

The older half of the conversion is an estimate. For the last year I have the price on each day; for anything before last September I don't, and I've used a reasonable average for that stretch. That's why I give a range and not a round number.

06The name on the payroll

And there's the payoff, which isn't a figure. The same board lets you ask what name the miner collecting into that wallet identifies itself by — what a pool calls the worker, a label the operator sets themselves so they can tell which machine is earning them what. The answer is one word long:

$ curl -sL ".../identifiers"
["16"]

16. The same name the miner gives itself on startup so as not to draw attention, and the same one the backdoor from the first chapter wipes off the screen so the administrator can't see it. seen

What they use to hide from the victim is what they use to identify themselves to whoever pays them. And it makes sense: in front of the pool there's nothing to hide, it's their own bookkeeping. But it leaves an uncomfortable symmetry — the one fact an administrator can't see on their own machine is written, in plain view, on a public page that takes no finding at all.

07Indicators (IOCs)

The break-in was catalogued in chapter 23 and the innards in 24. What follows comes from pulling the thread, and it has a virtue the rest doesn't: it doesn't expire at the next rebuild.

The wallet is the most durable thing this case has. Hashes change with every build, addresses die and the delivery server will end up empty; a wallet that has been collecting since 2021 can't be rotated without giving up what it holds, and it's written somewhere that can't be erased.