Pool mining security

Why security is your job

When you mine in a pool you hand the miner one thing: the wallet address your payouts go to. There is no account and no password to create; you download a miner, point it at the pool with your address, and start earning.

Simple, yes, but it does not mean security is someone else's problem. Because payouts go straight to your own wallet, non-custodially, you alone are responsible for the safety of your coins. The steps below are the basics that keep them yours.

Step one: wallet security

Most wallets have two layers: an everyday PIN or password that unlocks the app, and a secret recovery (seed) phrase that can restore the whole wallet from scratch. The recovery phrase is the one that matters most.

Never give out your password, PIN or recovery phrase to anyone. No one should know them, not even a pool's support team. Anyone who asks is trying to steal your coins.

Keep those secrets stored safely. If someone else gets them, they get your money:

• Do not reuse a PIN that is also your card PIN or your date of birth, and do not use the same PIN everywhere.
• If an email account can reset your wallet, make that email password unique and turn on two-factor authentication (2FA).
• Keep your recovery phrase offline, in a place it cannot be lost and no one else can reach.
• On a phone wallet, lock the phone itself with a fingerprint or a strong PIN or pattern.

And do not mine straight to an exchange deposit address. Not your keys, not your coins:

• Exchanges can change deposit addresses without warning; payouts sent to an old address can be lost for good.
• You do not hold the private key, so you never fully control the funds.
• An exchange can freeze your account, and some do not credit small mining payouts reliably.
• A pool payout address is fixed once you mine to it; if the exchange changes or closes, the pool cannot recover or redirect your coins.

Step two: address security

Always double-check a wallet address after you copy and paste it. Clipboard-hijacking malware watches for a crypto address on your clipboard and silently swaps in the attacker's address when you paste. If you do not verify the address before you send, the coins are gone for good.

Check the first and last few characters of an address every single time you paste it. One swapped address is one irreversible loss.

Step three: operating-system security

An unprotected computer is the weak link. Digital safety is on you, and if you ignore it no one else can cover for you.

• Do not visit shady sites or download from unverified sources. Mining and overclocking tools are frequently flagged by antivirus, sometimes as a false positive and sometimes because a fake copy really is infected.
• Only download your miner (for example SRBMiner or BzMiner) from its official page. If your antivirus flags a file you are certain is genuine, add that one file to the exceptions, never a whole folder, because malware can hide in the rest of it.
• Do not run cracked or pirated Windows, cracks or hacks; use clean, licensed software.
• Avoid remote-access tools you do not need. If an intruder gets remote control of your PC, they can do anything.
• Keep the operating system updated. Updates exist to close security holes, not to annoy you.

Not sure about a file? Do not risk it. Scan it first at a service like VirusTotal before you run it.

Running HiveOS or RaveOS? Never share your rig IDs or access keys, secure the email tied to the account, and enable 2FA.

Step four: browser security

Your browser is where you open your dashboard and your wallet, so keep it clean:

• Install a browser only from its official source, never from a torrent or a random build.
• Do not add suspicious extensions; a malicious add-on can read your passwords and your pages.
• An ad blocker and pop-up blocking cut out a common route for scams and drive-by downloads.
• Keep the browser updated so you get the latest security fixes; it is free.

Step five: network security

Make sure the network you mine and manage your wallet on is secure:

• Do not use public Wi-Fi for anything sensitive; a phone hotspot is safer, because public connections are easy to intercept.
• Secure your home Wi-Fi: change the default Wi-Fi password and the router admin login (the classic admin / admin is not a password). Anyone on your Wi-Fi is inside your network.
• If your router is more than a few years old, consider replacing it; newer routers get security fixes and a better built-in firewall.

What else can I do?

Attacks get more sophisticated every year, but the basics never go out of date: keep your software licensed and updated, keep your secrets offline and private, and slow down before you paste an address or run a file.

Be vigilant. Your security is in your hands.