<p>There were a number of news articles in September 2011 about the rootkit TDL4 using the Ufasoft GPU miner to mine bitcoins. A few links:</p>

<ul>
<li><a href="http://www.theinquirer.net/inquirer/news/2109599/worlds-dangerous-botnet-mines-bitcoins">World's most dangerous botnet mines Bitcoins</a> - The Inquirer</li>
<li><a href="http://www.spamfighter.com/News-16865-TDL4-Worms-Discovered-in-Bitcoin-Pools-Trend-Micro.htm">TDL4 Worms Discovered in Bitcoin Pools: Trend Micro</a> - spamfighter.com</li>
<li><a href="http://www.gmanews.tv/story/233799/technology/new-worm-turns-pcs-into-bitcoin-miners">New worm turns PCs into Bitcoin miners</a> - GMA News</li>
</ul>

<p>Quotes below are from the article in the Inquirer:</p>

<blockquote>
  <p>SECURITY RESEARCHERS at Russian antivirus vendor Kaspersky Lab warn
  that TDSS, one of the most dangerous and widespread family of
  rootkits, recently received an update that forces infected computers
  to mine Bitcoins.</p>
  
  <p>TDSS rootkits have consistently grown in sophistication since first
  appearing in 2008. The latest version known as TDL4 installs itself in
  the master boot record (MBR) and is capable of infecting all Windows
  versions, including 64-bit Windows Vista and Windows 7, which require
  signed device drivers.</p>
  
  <p>[...]</p>
  
  <p>It turns out that the variant had been configured to execute a
  component called conhost.exe with special parameters. Further
  investigation revealed that conhost.exe was a copy of the Ufasoft GPU
  Bitcoin miner application.</p>
</blockquote>

CC BY-SA 3.0
2011-10-09T17:59:01.633Z
I think it should be noted that whoever tries to reclaim Bitcoins generated by a discovered botnet is pretty much putting themselves in the line of fire. As Bitcoins aren't truly anonymous, it would be be a bit hard, but most people would love to catch whoever it was that did it.
Evil Spork
CC BY-SA 3.0
2011-10-09T08:06:50.843Z
2011-10-09T08:06:50.843Z
D.H.
<p>It has been happening for months.
In fact botnet software is now smart enough to identify the best option to mine on and use that - cpu or gpu.</p>

CC BY-SA 3.0
2011-10-09T07:41:59.240Z
Citation required.
ripper234
CC BY-SA 3.0
2011-10-14T20:46:03.273Z
Unsupported claim.
DeathAndTaxes
CC BY-SA 3.0
2011-10-09T07:17:56.260Z
2011-10-09T07:17:56.260Z
Graet
<p>First report about mining botnet was made at the end of June, and it evolved rapidly from CPU to GPU mining. But there is no consensus about what kind of harm it will do to Bitcoin, because from the bitcoin network point of view, infected computers run legitimate mining that supports network operation.</p>

<ul>
<li>17 Jun 2011 - <a href="http://www.symantec.com/connect/blogs/bitcoin-botnet-mining">Symantec suggested</a> that it would be profitable to
run CPU mining botnet.</li>
<li>28 Jun 2011 - Kaspersky Lab's expert Alex Gostev made <a href="http://www.securelist.com/en/blog/208188132/Gold_rush">first
report</a> about simple CPU mining botnet found in the wild.</li>
<li>2 Aug 2011  - <a href="http://www.f-secure.com/weblog/archives/00002207.html">F-Secure reported</a> about discovery of advanced CPU
mining botnet controlled via twitter.</li>
<li>11 Aug 2011 - <a href="http://www.symantec.com/connect/blogs/bitcoin-mining-trojanbadminer">Symantec discovered</a> first GPU mining botnet called
Trojan.Badminer.</li>
</ul>

CC BY-SA 3.0
2011-10-09T08:52:32.503Z
2011-10-09T08:59:44.633Z
2011-10-09T08:59:44.633Z
Serith
<p>Is the threat of Botnets using massive amounts of CPUs/GPUs to mine Bitcoin, or some CPU-friendly coin, purely theoretical at this point? Or have there been reports of this actually happening?</p>

<p>I know of trojans stealing Bitcoin wallets, this is not related to my question.</p>

CC BY-SA 3.0
2011-10-09T23:37:42.983Z
[This article](http://www.symantec.com/connect/blogs/bitcoin-botnet-mining) from Symantec might interest you. They try to calculate the profitability of such botnets. With the current difficulty and price, I highly doubt that bitcoin mining is an appealing activity to botnet owners.
nmat
<cpu-mining><gpu-mining><botnets>
Have there been reports of botnets mining Bitcoin / crypto-currencies?
ripper234
# Have there been reports of botnets mining Bitcoin / crypto-currencies?

(Asked by: username_0 on 2011-10-09)

Is the threat of Botnets using massive amounts of CPUs/GPUs to mine Bitcoin, or some CPU-friendly coin, purely theoretical at this point? Or have there been reports of this actually happening?

I know of trojans stealing Bitcoin wallets, this is not related to my question.

**Tags:** cpu-mining, gpu-mining, botnets

> **Comments:**
> **username_1**: [This article](http://www.symantec.com/connect/blogs/bitcoin-botnet-mining) from Symantec might interest you. They try to calculate the profitability of such botnets. With the current difficulty and price, I highly doubt that bitcoin mining is an appealing activity to botnet owners.  

---

## 3 answers

### Answer by username_6 on 2011-10-09. Score: 8 | Accepted answer

First report about mining botnet was made at the end of June, and it evolved rapidly from CPU to GPU mining. But there is no consensus about what kind of harm it will do to Bitcoin, because from the bitcoin network point of view, infected computers run legitimate mining that supports network operation.

* 17 Jun 2011 - [Symantec suggested](http://www.symantec.com/connect/blogs/bitcoin-botnet-mining) that it would be profitable to
  run CPU mining botnet.
* 28 Jun 2011 - Kaspersky Lab's expert Alex Gostev made [first
  report](http://www.securelist.com/en/blog/208188132/Gold_rush) about simple CPU mining botnet found in the wild.
* 2 Aug 2011 - [F-Secure reported](http://www.f-secure.com/weblog/archives/00002207.html) about discovery of advanced CPU
  mining botnet controlled via twitter.
* 11 Aug 2011 - [Symantec discovered](http://www.symantec.com/connect/blogs/bitcoin-mining-trojanbadminer) first GPU mining botnet called
  Trojan.Badminer.


---

### Answer by username_2 on 2011-10-09. Score: 5

There were a number of news articles in September 2011 about the rootkit TDL4 using the Ufasoft GPU miner to mine bitcoins. A few links:

* [World's most dangerous botnet mines Bitcoins](http://www.theinquirer.net/inquirer/news/2109599/worlds-dangerous-botnet-mines-bitcoins) - The Inquirer
* [TDL4 Worms Discovered in Bitcoin Pools: Trend Micro](http://www.spamfighter.com/News-16865-TDL4-Worms-Discovered-in-Bitcoin-Pools-Trend-Micro.htm) - spamfighter.com
* [New worm turns PCs into Bitcoin miners](http://www.gmanews.tv/story/233799/technology/new-worm-turns-pcs-into-bitcoin-miners) - GMA News

Quotes below are from the article in the Inquirer:

> SECURITY RESEARCHERS at Russian antivirus vendor Kaspersky Lab warn
> that TDSS, one of the most dangerous and widespread family of
> rootkits, recently received an update that forces infected computers
> to mine Bitcoins.
>
> TDSS rootkits have consistently grown in sophistication since first
> appearing in 2008. The latest version known as TDL4 installs itself in
> the master boot record (MBR) and is capable of infecting all Windows
> versions, including 64-bit Windows Vista and Windows 7, which require
> signed device drivers.
>
> [...]
>
> It turns out that the variant had been configured to execute a
> component called conhost.exe with special parameters. Further
> investigation revealed that conhost.exe was a copy of the Ufasoft GPU
> Bitcoin miner application.

> **Comments:**
> **username_3**: I think it should be noted that whoever tries to reclaim Bitcoins generated by a discovered botnet is pretty much putting themselves in the line of fire. As Bitcoins aren't truly anonymous, it would be be a bit hard, but most people would love to catch whoever it was that did it.  

---

### Answer by username_4 on 2011-10-09. Score: -1

It has been happening for months.
In fact botnet software is now smart enough to identify the best option to mine on and use that - cpu or gpu.

> **Comments:**
> **username_0**: Citation required.  
> **username_5**: Unsupported claim.  

---

