Crypto Mining Glossary

Proof of Work requires miners to repeatedly hash candidate block headers until one produces a result below the network target. Finding such a hash is hard; verifying it is instant. This asymmetry lets anyone confirm that real energy was spent to produce each block, anchoring the blockchain's security in physics rather than trust.

Because rewriting history would require redoing all the accumulated work faster than the honest network produces new blocks, PoW chains like Bitcoin become exponentially harder to attack as hashrate grows. The energy cost criticised by outsiders is precisely the security budget that makes the ledger immutable.

Cryptocurrency mining is the competitive process of assembling pending transactions into a candidate block and searching for a hash that satisfies the network's difficulty target. The first miner to succeed broadcasts the block and collects the block reward plus all included transaction fees.

Economically, mining converts electricity and hardware depreciation into cryptocurrency. Profitability therefore depends on four variables: hardware efficiency, electricity price, network difficulty, and coin price — all of which you can model in our live calculators.

The block reward is the primary income stream of mining. It has two components: the protocol-defined subsidy (newly created coins, e.g. 3.125 BTC per Bitcoin block since the 2024 halving) and the transaction fees paid by users whose transactions the block includes.

Subsidies typically decline over time — Bitcoin halves every four years, Ethereum Classic steps down 20% every 5 million blocks, while Dogecoin pays a fixed 10,000 DOGE forever and Monero settled on a perpetual 0.6 XMR tail emission. The subsidy schedule is the single most important long-term variable in mining business plans.

Halvings enforce digital scarcity: Bitcoin's subsidy fell from 50 BTC in 2009 to 3.125 BTC after April 2024, and will drop to 1.5625 BTC around April 2028. Litecoin follows the same pattern on its own schedule (next: ~August 2027), and Bitcoin Cash halves within days of Bitcoin.

For miners a halving is an overnight 50% revenue cut on the subsidy side. Historically it squeezes out inefficient operators, accelerates hardware turnover, and shifts revenue weight toward transaction fees. Any hardware purchase should be modelled against the date of the next halving.

Since hash functions are deterministic, hashing the same block header twice gives the same result. The nonce is the field miners change between attempts: each new value yields a completely different, unpredictable hash. Mining is simply iterating nonces (billions of times per second on modern hardware) until one hash meets the difficulty target.

Bitcoin's 32-bit nonce space is too small for modern ASICs, which exhaust it in a fraction of a second — so miners also vary the timestamp and the coinbase transaction (the "extra nonce") to expand the search space.

Every block begins with a special transaction that has no inputs: the coinbase. It pays the block subsidy plus the block's aggregate transaction fees to an address chosen by the miner (or the pool). This is literally where new coins come from.

Coinbase outputs are subject to a maturity rule — on Bitcoin they cannot be spent for 100 blocks — protecting the network from spending coins in blocks that might be orphaned. Pool payout systems (FPPS, PPLNS) are accounting layers that distribute coinbase income across contributing miners.

A transaction in the latest block has one confirmation; each subsequent block adds another. Reversing a transaction with n confirmations requires secretly re-mining n+1 blocks faster than the honest network — practically impossible beyond a handful of confirmations on a large chain.

Exchanges typically credit Bitcoin deposits after 2–6 confirmations. For miners, pool payouts and freshly mined coinbase rewards follow stricter maturity rules (100 blocks on Bitcoin) before the funds are spendable.

Every node maintains a memory pool of valid transactions that have been broadcast but not yet mined. Miners sort it by fee rate (satoshis per virtual byte on Bitcoin) and pack the most profitable set into each candidate block — fee maximisation is pure profit optimisation.

A congested mempool means higher fees and richer blocks for miners; an empty one means blocks earn little beyond the subsidy. As subsidies decline through halvings, mempool dynamics will increasingly determine mining revenue.

Fees are a market: block space is scarce, and users bid for it. Miners collect the difference between a transaction's inputs and outputs. During demand spikes (ordinals, token mints, bull-market congestion) fees on Bitcoin have briefly exceeded the block subsidy itself.

Long term, fees are designed to replace subsidies as the security budget of PoW chains. Miners evaluating multi-year hardware investments should treat fee revenue as upside rather than baseline — it is far more volatile than the subsidy.

A wallet doesn't "store" coins (those live on the blockchain); it stores the private keys that authorise spending them. For miners, the wallet address is what you enter in the pool dashboard or ASIC configuration to receive payouts.

Best practice scales with balance: exchange addresses are fine for immediate selling, software wallets (Electrum, Sparrow, Feather) for working balances, and hardware wallets (Ledger, Trezor, Coldcard) for accumulation. Never mine to an address whose keys you haven't backed up.

An ASIC miner implements a single algorithm (SHA-256, Scrypt, kHeavyHash…) directly in silicon. The specialisation yields extreme performance — an Antminer S21 XP delivers 270 TH/s where a top GPU manages a few GH/s on the same algorithm — at the cost of total inflexibility: an algorithm change bricks the investment.

ASICs dominate every major PoW coin except deliberately resistant ones like Monero. Buying decisions revolve around efficiency (J/TH), price per terahash, and the credibility of the manufacturer's delivery schedule — Bitmain, MicroBT, Canaan and IceRiver are the established names in 2026.

Graphics cards excel at memory-hard algorithms designed to resist ASICs: Etchash (Ethereum Classic), KAWPOW (Ravencoin), and Blake3 (Alephium) are the main GPU coins of 2026. A tuned RTX 4090 or RX 6800 XT can switch between them as profitability shifts.

GPU mining's structural advantage is downside protection: a card that stops mining profitably is still a gaming and AI accelerator worth real money, while an obsolete ASIC is scrap. The trade-off is lower absolute earnings and the constant need for undervolting and per-card tuning.

CPU mining died on Bitcoin in 2011 and on most coins shortly after, outcompeted by GPUs and then ASICs. It survives — and thrives — exclusively where the algorithm is designed for it: Monero's RandomX exercises caches, branch prediction and floating-point units so thoroughly that a general-purpose CPU is the optimal hardware.

Modern AMD Ryzen and EPYC chips with large L3 caches dominate. CPU mining's appeal is accessibility: no special hardware, no fan noise farms — any desktop can accumulate XMR, with profitability hinging almost entirely on electricity price.

Efficiency determines operating cost per unit of revenue. An Antminer S21 XP at ~12 J/TH spends roughly half the electricity per terahash of an S19k Pro at ~23 J/TH — meaning it stays profitable at electricity prices that bankrupt the older unit. Equivalent metrics exist per algorithm: J/MH for Scrypt and Etchash, J/GH elsewhere.

As difficulty rises and rewards halve, the network's average efficiency improves and the break-even bar rises with it. A useful rule: buy the best efficiency you can afford, not the most hashrate — hashrate determines how much you earn, efficiency determines whether you profit.

Mining workloads are memory-bound on most GPU algorithms, so the core can run slower and cooler without hurting hashrate. A stock RTX 4090 pulling 350 W can often deliver near-identical Etchash output at 250–280 W after undervolting — a 20–30% efficiency gain for free.

Standard recipe: lower the core clock/voltage curve, raise the memory clock until errors appear (then back off), and verify stability over 24 hours. On ASICs the equivalent is custom firmware with per-chip voltage tuning.

Immersion replaces fans with a bath of engineered fluid that carries heat away far more effectively than air. Benefits: near-silent operation, no dust, longer hardware life, denser deployments, and headroom to overclock — immersion-tuned S21 units routinely run above stock hashrate.

The costs are tanks, fluid, pumps and heat exchangers, which only amortise at scale or where heat reuse (greenhouses, district heating) adds a second revenue stream. Hydro-cooled ASICs like the Antminer S21 XP Hyd are the manufacturer-integrated version of the same idea.

In GPU mining, a rig is an open-air frame with a motherboard, minimal CPU/RAM, riser cables, and four to twelve graphics cards sharing one or two power supplies. The open design prioritises airflow and serviceability over aesthetics.

Rig economics reward standardisation: identical cards, one OS image (HiveOS, mmpOS and similar), centralised monitoring, and per-card power tuning. The term is also used loosely for ASICs, though those are sealed appliances rather than assembled machines.

Mining industrialised because the inputs (power and cooling) have massive economies of scale. Modern farms negotiate wholesale electricity, sign demand-response contracts (curtailing during grid stress for payments), and increasingly share infrastructure with AI data centres — the 2026 trend of miners pivoting capacity to AI workloads is reshaping network difficulty.

Geography follows power: hydro in Scandinavia and Canada, gas in Texas and the Gulf states, geothermal in Iceland and El Salvador. Our country guides map electricity prices and regulation worldwide.

Hosting bridges the gap between home mining (noise, residential power prices) and building a farm. You buy the ASICs; the host provides racking, industrial electricity at a quoted all-in rate (typically $0.06–$0.09/kWh in 2026), cooling, and basic maintenance, billed monthly per kilowatt.

Due diligence is everything: verify the facility exists, check uptime SLAs, payment terms on curtailment, and who controls the pool account. The sector has a history of overselling capacity — never prepay long terms to an unproven host.

Stock ASIC firmware runs conservative one-size-fits-all settings. Custom firmware profiles each hash board, finds the optimal voltage/frequency per chip, and lets operators choose efficiency mode (lower watts, same hashrate) or performance mode (overclock). Gains of 10–25% efficiency are routine on S19-class hardware.

Trade-offs: warranty implications, a dev fee (1–2% of hashrate typically), and the need to flash carefully from official sources only — malicious firmware images that redirect hashrate are a real and common scam.

SHA-256 (Secure Hash Algorithm, 256-bit) is a NSA-designed hash function standardised in 2001 and chosen by Satoshi Nakamoto for Bitcoin. Mining applies it twice to the block header (double-SHA-256). Its simplicity in silicon made it the first and most heavily ASIC-optimised algorithm.

Today SHA-256 hashrate is measured in hundreds of exahashes per second, supplied exclusively by ASICs from a handful of manufacturers. Because Bitcoin and Bitcoin Cash share the algorithm, hashrate flows freely between them, keeping per-terahash profitability in near-perfect parity.

Scrypt forces hashing to touch a sizeable scratchpad of memory, which made it expensive to implement in early ASICs and briefly preserved GPU mining. Dedicated Scrypt ASICs arrived anyway in 2014; today machines like the Antminer L9 (16 GH/s) define the network.

Scrypt's economic peculiarity is merged mining: Dogecoin accepts Litecoin's proof-of-work via AuxPoW, so every modern Scrypt miner earns LTC and DOGE simultaneously — often with DOGE contributing half or more of total revenue.

Equihash bases mining on the generalised birthday problem, requiring substantial memory and bandwidth. The 200,9 parameter set used by Zcash was meant to keep mining on GPUs; Bitmain's Antminer Z9 broke that assumption in 2018 and the Z15 Pro (840 KSol/s) now defines the network.

Zcash chose not to hard-fork against ASICs, unlike Monero. For miners, Equihash hardware is a specialised bet on ZEC and its halving schedule — efficiency is measured in watts per kilosol.

Activated in November 2019, RandomX generates random sequences of instructions exercising every subsystem of a modern CPU: large caches, branch prediction, out-of-order execution, floating point. An "ASIC" for RandomX would essentially be a CPU, eliminating the efficiency gap specialised hardware relies on.

Six-plus years on, Monero remains ASIC-free — the only major PoW network where consumer hardware is competitive. AMD chips with large L3 caches (2 MB per mining thread) lead; huge-pages configuration adds 20–50% hashrate and is the first tuning step every XMR miner should take.

kHeavyHash combines Keccak hashing with a matrix multiplication step. It launched GPU-minable, but Kaspa's price surge triggered the fastest ASIC transition ever seen: from IceRiver's first units in 2023 to Bitmain's KS7 (70 TH/s) in 2025, hashrate grew thousands-fold and GPUs were obsoleted within months.

Kaspa's blockDAG architecture produces multiple blocks per second, giving miners smooth, low-variance rewards. The lesson of kHeavyHash for miners: on any rising coin, model ASIC arrival risk before buying previous-generation hardware.

Adopted in November 2020 (ECIP-1099), Etchash halved the DAG epoch size of Ethash so older GPUs could keep mining ETC, while invalidating existing Ethash ASICs. Mining performance is bound by memory bandwidth: the miner constantly reads pseudo-random slices of the multi-gigabyte DAG held in VRAM.

Since Ethereum's 2022 move to proof-of-stake, Etchash is the largest GPU-minable algorithm by market cap. Tuning is mandatory — undervolted cards deliver 20–40% better efficiency than stock settings.

KAWPOW (adopted May 2020) derives from ProgPoW, which generates random program sequences tuned to saturate exactly the units a commodity GPU has: compute cores, caches, and memory bandwidth in gaming-card proportions. The goal is making an ASIC's advantage too small to fund its development.

It has held: Ravencoin remains one of the principal GPU coins in 2026. KAWPOW is power-hungry per card relative to Etchash, so undervolting and electricity price matter even more than usual.

Blake3 is a 2020-era hash function built for speed: highly parallel, SIMD-friendly, and dramatically faster than SHA-256 in software. Alephium adopted it for proof-of-work within its sharded blockDAG architecture, where mining secures multiple chain shards simultaneously.

For miners, Blake3 on Alephium has been a GPU opportunity with low power draw per card, now transitioning as dedicated ASICs arrive — the familiar lifecycle of every successful PoW coin. Energy efficiency per hash is among the best of any algorithm.

Etchash and Ethash generate an epoch-based dataset (the DAG) that must reside in GPU memory; mining reads random slices of it constantly, making memory bandwidth the bottleneck and defeating compute-only ASIC designs. When the DAG outgrows a card's VRAM, that card can no longer mine the coin — the fate of 4 GB cards on Ethereum in 2020, which Etchash's recalibration deliberately reversed for ETC.

Confusingly, "DAG" also names the block-graph architecture of Kaspa and Alephium (blockDAG) — an unrelated concept where blocks form a graph instead of a single chain, enabling parallel block production.

ASIC resistance aims to keep mining decentralised by ensuring commodity hardware stays competitive. Techniques include memory-hardness (Scrypt, Ethash), program randomisation (RandomX, ProgPoW/KAWPOW), and credible threats to hard-fork against any ASIC that appears.

History is mostly a graveyard: Scrypt, Equihash, and kHeavyHash all fell to ASICs once coin prices justified chip development. The exceptions prove the formula — Monero combines a genuinely CPU-shaped workload with demonstrated willingness to fork, and remains ASIC-free after six-plus years.

Solo, a small miner might wait years to find a block; in a pool, thousands of machines search together, and each participant earns their proportional share of every block found. The pool charges a fee (0.5–4%) and handles block construction, payout accounting, and infrastructure.

Pool choice involves fee level, payout scheme (FPPS vs PPLNS), minimum payout, server latency, and decentralisation concerns — routing hashrate to a pool nearing half the network is a systemic risk. Our per-coin pool pages compare all of this live.

A solo miner keeps the entire block reward but receives nothing until a block is found. On Bitcoin, a single S21-class machine's odds make expected waiting time measured in centuries — yet solo lottery wins happen regularly via services like Solo CK Pool, and make headlines precisely because of the odds.

Solo becomes rational on smaller networks where your hashrate is a meaningful share, or philosophically via decentralised options like Monero's P2Pool, which combines solo-style sovereignty with pool-style payout smoothing.

Stratum lets a pool distribute work templates to thousands of machines and collect their shares efficiently. Version 1, dating to 2012, remains the universal default — it's the stratum+tcp://pool:port line in every miner setup.

Stratum V2 modernises the protocol with encryption (preventing hashrate hijacking by ISPs or attackers) and optionally lets individual miners choose their own transaction sets — a meaningful decentralisation upgrade adopted by Braiins and a growing minority of pools.

Finding actual blocks is too rare to measure individual contribution, so pools assign easier targets: hashes good enough to prove work but not to solve a block. Each accepted share credits your account; when the pool finds a real block, rewards are split according to shares submitted.

Monitor your accepted vs rejected/stale share ratio: rejects above ~1–2% usually indicate network latency, unstable overclocks, or pool-side issues, and translate directly into lost revenue.

Under FPPS the pool calculates the expected value of each share — including the block subsidy and the average transaction fees — and pays it regardless of whether the pool actually found blocks that day. The miner gets bond-like predictable income; the pool carries the luck risk and charges a higher fee (typically 2–4%) for it.

FPPS dominates Bitcoin pooling in 2026 (Foundry, Antpool, F2Pool). It's the right choice for miners with power bills to pay monthly; PPLNS suits those willing to absorb variance for lower fees.

PPLNS pays only when the pool finds blocks, splitting each reward over a sliding window of recent shares. Income tracks real pool luck: lean weeks and lucky streaks both pass through to miners. Fees are lower than FPPS (often 0.5–1%) because the pool bears no variance risk.

PPLNS also discourages pool-hopping, since new arrivals must fill the share window before earning fully. Over long periods, expected earnings equal FPPS minus the fee difference — the choice is purely about who holds the variance.

Classic PPS pays each share its expected value of the block subsidy, immediately and unconditionally. Unlike FPPS it excludes transaction fees, which the pool keeps — a meaningful difference on Bitcoin, where fees can be a substantial revenue component during congestion.

Pure PPS has largely given way to FPPS (which adds fee pass-through) and PPS+ hybrids. When comparing pools, always check which scheme the advertised fee applies to — a low fee on PPS can net less than a higher fee on FPPS.

Pools batch payouts to limit on-chain fees, releasing funds only above a minimum (e.g. 0.001 BTC, 0.1 LTC, varies widely). A small miner on a high-threshold pool can wait weeks for the first payment, with balance trapped as counterparty risk in the meantime.

Check whether the pool deducts the payout transaction fee, offers free scheduled payouts, and supports Lightning or internal transfers. Our pool pages list minimum payouts side by side per coin.

Auxiliary proof-of-work lets a child chain (Dogecoin) accept proofs produced while mining a parent chain (Litecoin). The miner's Scrypt work is submitted to both networks; valid solutions for either chain pay out. Since 2014 this has secured Dogecoin with Litecoin's full hashrate.

For miners the effect is automatic on supporting pools: configure the Litecoin stratum, receive LTC and DOGE both. DOGE frequently contributes half or more of total Scrypt revenue — no Litecoin profitability analysis is complete without it.

Block discovery is a Poisson process: even a perfectly healthy pool oscillates above and below expectation. Luck of 130% over a day means nothing; persistent sub-90% luck over months can indicate problems (stale infrastructure, or in the worst case, dishonest accounting).

On PPLNS pools, luck passes directly into your income; on FPPS, the pool absorbs it. Before blaming a pool for low payouts, compare its long-run luck statistics and your own stale-share rate.

Hashrate scales from kilohashes (KH/s) through mega, giga, tera, peta to exahashes (EH/s). A CPU mines Monero in KH/s; an Antminer S21 XP produces 270 TH/s; the Bitcoin network operates in hundreds of EH/s. Your revenue share equals your hashrate divided by the network's.

Units are algorithm-specific and not comparable across coins: 1 GH/s of Scrypt represents vastly more silicon effort than 1 GH/s of SHA-256. Always compare hashrate, efficiency and revenue within a single algorithm.

Hashprice compresses coin price, network difficulty, block subsidy and fee levels into one number: what a terahash earns in 24 hours. When price rises or difficulty falls, hashprice climbs; halvings cut it overnight. Industrial miners quote it the way farmers quote grain prices.

Comparing your all-in electricity cost per TH/day against hashprice tells you instantly whether you're mining at a profit. Our calculators perform exactly this computation per machine, with live network data.

Every miner has a break-even rate determined by its efficiency and current hashprice: an S21 XP might break even near $0.10–0.12/kWh while an old S19 dies above $0.05/kWh. It is the first number to compute before buying hardware — if your power price is above a machine's break-even, no amount of hope fixes the math.

Break-even shifts daily with price and difficulty. Our simulation pages publish live break-even rates for every hardware model, and the per-country pages compare them against real electricity prices worldwide.

Divide hardware cost by monthly net profit (revenue minus electricity) to get a naive payback period. A healthy target in 2026 is 12–18 months for ASICs; beyond that, you're exposed to halvings, difficulty growth and hardware obsolescence before recovering capital.

The naive figure assumes constant conditions, which never holds. Stress-test with rising difficulty, a price drawdown, and the next halving date. GPU miners can use gentler assumptions thanks to resale value; ASIC buyers should treat payback beyond the next halving as speculative.

When multiple coins share an algorithm (BTC/BCH on SHA-256) or hardware can run several algorithms (GPUs), small profitability spreads open and close constantly. Profit-switching pools and tools (Mining-Dutch, MoneroOcean, HiveOS flight sheets) chase those spreads automatically, paying out in your preferred coin.

Gains are real but modest — efficient markets keep spreads thin, and switching itself has frictions (stale shares, payout fragmentation, tax accounting). Over a year, automated switching typically adds single-digit percentage points over single-coin loyalty.

Cloud mining contracts sell you a hashrate stream from machines the provider claims to operate. The structural problem: if the contract were priced to be profitable for you, the provider would earn more by mining directly. Legitimate offerings therefore price in their margin; the rest are Ponzi schemes — the sector's fraud history is extensive.

If you want mining exposure without hardware hassle, hosting (you own the machine) preserves your equity, and simply buying the coin avoids operational risk entirely. Approach any cloud contract promising fixed returns as a red flag, not an opportunity.

Memory-hard algorithms like Etchash leave GPU compute units partly idle. Dual-mining software (lolMiner, GMiner) fills that headroom with a second, compute-bound coin — historically ETC+KAS or ETC+ALPH pairings — raising total revenue 20–60% for a disproportionately small power increase.

The economics shift as coins migrate to ASICs (Kaspa already has; Alephium is following). Check current pairings in your miner's documentation, watch card temperatures — dual loads stress VRAM — and verify the combined power draw still beats single-mining profit at your electricity rate.

Difficulty is the network's thermostat: more hashrate joins, blocks come too fast, difficulty rises until the target block time is restored. Bitcoin adjusts every 2,016 blocks (~2 weeks); Litecoin every 3.5 days; Bitcoin Cash recalculates every block via ASERT; Monero and Kaspa continuously.

For miners, difficulty is the silent competitor: your hardware's share of rewards erodes as global hashrate grows, even when coin price is flat. Profitability projections that ignore difficulty growth overstate earnings badly — stress-test at +20–50% annual growth.

Each chain balances responsiveness against stability. Bitcoin's two-week epoch is slow but predictable, capped at 4x per adjustment. Bitcoin Cash's ASERT responds every block against an exponential baseline, neutralising the hashrate oscillation attacks of its early years. Kaspa and Monero adjust continuously.

Adjustment events are tradable information for miners: a large downward adjustment (like Bitcoin's June 2026 drop amid the AI pivot) immediately raises every remaining miner's revenue — old hardware briefly comes back to life until hashrate returns.

Network hashrate is estimated from block discovery rates and difficulty — it cannot be measured directly. It represents both competition (your earnings = your hashrate ÷ network hashrate × total rewards) and security (the cost an attacker must match to threaten the chain).

Hashrate follows price with a lag: bull markets attract deployment, bear markets force capitulation of inefficient miners. The 2026 phenomenon of miners diverting megawatts to AI workloads introduced a new, non-price driver of hashrate movements on Bitcoin.

When two miners solve blocks nearly simultaneously, the network briefly forks; the branch that receives the next block wins, and the loser's block is orphaned — technically "stale". Its coinbase reward never matures. Orphan rates are below 0.1% on Bitcoin but matter more on fast chains, which is why Kaspa's blockDAG includes parallel blocks instead of discarding them.

For pool miners, orphans surface as occasional invalidated earnings on transparent pools. Persistent high stale-share rates on your own rig point to network latency — mine on a pool server geographically close to you.

A majority attacker can mine a private chain faster than the honest network, then release it to replace recent blocks — reversing their own transactions (double-spending) or censoring others. They cannot steal arbitrary funds or change protocol rules; the attack's scope is narrower than its reputation suggests.

Feasibility is purely economic: matching Bitcoin's hashrate would cost billions in hardware and gigawatts of power, while smaller chains (Ethereum Classic in 2019–2020, Bitcoin Gold) have been successfully attacked with rented hashrate. This is why exchanges demand more confirmations on smaller PoW coins.

Instead of letting the subsidy reach zero like Bitcoin will around 2140, tail-emission chains guarantee miners a perpetual minimum payment. Monero activated its 0.6 XMR tail in May 2022; inflation declines asymptotically (below 1% annually and falling forever) while the security budget never disappears.

The design sidesteps an open question for Bitcoin's far future — whether transaction fees alone can fund adequate security. For miners, tail emission means revenue predictability: no halving cliffs, ever.

Because RandomX runs well on ordinary CPUs, Monero is the currency of choice for botnets that hijack computers, servers and even IoT devices for covert mining. Campaigns abuse the same open-source tools legitimate miners use — XMRig above all — which is why your antivirus flags it even when you installed it deliberately.

Defence is ordinary hygiene: patched systems, no pirated software, and monitoring for unexplained CPU load. Miners should download tools exclusively from official repositories and whitelist only binaries whose checksums they've verified.