What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Criminals may use mining pools or hash-rental and cloud-mining services to make illicit cryptocurrency appear to have come from mining. The methods are related but different: one routes funds through pool-linked wallets; the other pays for hash power and directs newly mined coins to a wallet chosen by the customer. Neither makes cryptocurrency literally untraceable, and evidence about these cases does not show that mining is the dominant laundering method or that ordinary mining services are inherently criminal.
How can mining make illicit cryptocurrency look legitimate?
Blockchain transactions remain visible, but a sequence of transfers can make the source and path of funds harder to assess. A mining-linked receipt may create a plausible cover story: instead of appearing to come directly from a ransomware payment or scam, funds may appear alongside proceeds associated with mining. Chainalysis describes this as a way a mining pool can obscure the apparent origin of funds, not as proof that a pool or any particular miner is involved in crime.
Two mechanisms matter here. A mining pool combines miners’ work and distributes proceeds; pool- and wallet-linked transactions may be used in flows that also contain criminal funds. A hash-rental or cloud-mining service sells computing power, and the customer can arrange for mining proceeds to be paid to a selected wallet. In the latter case, newly mined cryptocurrency can be received after a criminal actor has paid the service with stolen cryptocurrency.
Two documented methods, compared
| Feature | Hash rental or cloud mining | Mining-pool routing or commingling |
|---|---|---|
| What is used | A service sells hash power and directs mining proceeds to a wallet selected by the customer. | Pool- and wallet-linked flows appear alongside criminal proceeds and may make receipts look mining-related. |
| Documented example | Mandiant’s 2023 assessment that North Korean threat actor APT43 likely used these services to launder stolen cryptocurrency. | Chainalysis’s 2023 analysis of ransomware-linked and scam-linked address flows. |
| What the evidence establishes | An actor-specific assessment qualified as likely, not a claim about cloud-mining customers generally. | Transaction associations and an interpreted typology, not proof that every mining-exposed flow is illicit. |
| Relevant control | Screen customer wallets and payment origins at the service. | Screen pool and exchange flows, including intermediary-wallet exposure. |
What Chainalysis observed in ransomware and scam-linked flows
In a June 2023 analysis of flows dating from 2018 onward, Chainalysis described a highly active exchange deposit address that received $94.2 million in total, including $19.1 million from ransomware addresses and $14.1 million from mining pools. The figures describe one address example, not an industry total. Chainalysis observed paths from ransomware-linked wallets to pools and from pools to exchanges, sometimes through intermediate wallets. It said the pattern could make funds appear to be mining proceeds or help avoid compliance alerts.
Recommended Free Tools
#1 Best Overall
- Effortlessly build your crypto portfolio via the all in one Ledger Wallet app: buy, sell, send, receive, swap, stake and more across popular blockchains. 15,000+ coins & tokens in a single dashboard. Keep a close eye on the market. Compare service providers. Track performance. Get timely alerts. Build your portfolio with confidence.
- Effortlessly build your crypto portfolio via the all in one Ledger Wallet app: buy, sell, send, receive, swap, stake and more across popular blockchains. 15,000+ coins & tokens in a single dashboard. Keep a close eye on the market. Compare service providers. Track performance. Get timely alerts. Build your portfolio with confidence.
- Enjoy Bluetooth connectivity, iOS access, and hours of battery use with this mobile-first, secure backup signer. Freedom you can depend on.
- Genuine Check: confirm your signer is authentic during setup with the Ledger Wallet app.
- Protect your signer: keep it in mint condition at all times with a bespoke Pod or Case to avoid scratches and everyday wear and tear.
Chainalysis also identified 372 exchange deposit addresses that had received at least $1 million from mining pools and some amount from ransomware addresses. Those addresses had received $158.3 million from ransomware addresses since the start of 2018; Chainalysis cautioned that its ransomware figure was likely an underestimate because additional addresses may be identified. A mining-related receipt alone does not prove that the funds first passed through a pool or that the address owner knowingly laundered money.
For scam-linked flows, Chainalysis reported that deposit addresses with scam exposure and at least $1 million in receipts from mining pools had received just under $1.1 billion in cryptocurrency from scam-related addresses since 2018. This is a measure for the address set Chainalysis defined; it is not a proven total laundered through cloud mining. Its BitClub Network example involved a fraudulent investment scheme that promised Bitcoin-mining returns: Chainalysis described laundering wallets receiving BitClub-associated bitcoin and a Russia-based mining operation sending bitcoin to overlapping exchange deposit addresses. That example concerns the movement of scheme proceeds, not investors laundering their own funds.
Rank #2
- Proven security at scale: Over 9 years and millions of cards issued with no known remote hacks, while military‑grade EAL6+ security keeps your private keys locked inside the chip. Your cryptocurrencies stay strongly protected from online attackers.
- Tap once to manage your entire crypto wallet across 90 blockchains - no USB cables or Bluetooth, no batteries, no setup. Access 14,100+ coins & tokens, DeFi, NFTs, and staking instantly from your phone
- Smart backup: Use your second Tangem Wallet as your Backup keys with end‑to‑end encryption; no more papers, pictures. If one card is lost, the remaining can still restore full access, with an optional seed phrase available for advanced users.
- Engineered to last up to 25 years: Waterproof (IP69K), shockproof and tested for extreme temperatures from −25°C to 50°C. A durable cold wallet with long‑term protection and independently audited security.
- Trusted by 6 million users worldwide (4.9 App Store, 4.8 Google Play) - buy, sell, swap, stake, and spend cryptocurrency directly. The secure offline storage wallet designed for how people actually use crypto wallets
What Mandiant assessed about APT43 and cloud mining
In a 2023 assessment, Mandiant said APT43 operators likely used hash-rental and cloud-mining services to launder stolen cryptocurrency into clean cryptocurrency. The proposed mechanism is that an actor pays a service with stolen coins for hash power, then has mined cryptocurrency sent to a chosen wallet. This can weaken an obvious on-chain connection between the initial payment and the later receipt, but Mandiant’s statement is a qualified assessment about a specific threat actor—not evidence that all cloud-mining use is suspicious.
Is this the same as a “liquidity mining” scam?
No. The FBI’s July 2022 warning concerns scams aimed at cryptocurrency owners, not criminals disguising proceeds through mining services. The FBI describes legitimate liquidity mining as staking cryptocurrency in a liquidity pool in return for a share of trading fees. In the reported scam pattern, a fraudster builds trust, promises high daily returns, persuades a victim to connect a wallet to a fraudulent application, and steals the assets. The FBI reported more than $70 million in combined victim losses since January 2019, based on IC3 and open-source information. Those losses are not a measure of laundering through mining pools.
Rank #3
- Proven security at scale: Over 9 years and millions of cards issued with no known remote hacks, while military‑grade EAL6+ security keeps your private keys locked inside the chip. Your cryptocurrencies stay strongly protected from online attackers.
- Tap once to manage your entire crypto wallet across 90 blockchains - no USB cables or Bluetooth, no batteries, no setup. Access 14,100+ coins & tokens, DeFi, NFTs, and staking instantly from your phone
- Smart backup: Use your second Tangem Wallet as your Backup keys with end‑to‑end encryption; no more papers, pictures. If one card is lost, the remaining can still restore full access, with an optional seed phrase available for advanced users.
- Engineered to last up to 25 years: Waterproof (IP69K), shockproof and tested for extreme temperatures from −25°C to 50°C. A durable cold wallet with long‑term protection and independently audited security.
- Trusted by 6 million users worldwide - buy, sell, swap, stake, and spend cryptocurrency directly. The secure offline storage wallet designed for how people actually use crypto wallets
What screening and compliance can do
Chainalysis recommends stronger wallet screening and know-your-customer checks at mining pools and hash-rental services, using blockchain analysis to assess the origin of customer funds, and exchange review of a wallet’s full exposure rather than only its most recent transaction. These are risk-reduction measures, not guarantees: intermediaries can complicate a transaction path, and a mining-linked transfer by itself does not establish criminal activity. The U.S. Department of Justice’s March 2025 overview likewise discusses screening and compliance practices as ways to mitigate the typology.
- For mining and hash-rental services: assess customer wallet exposure and the origins of incoming payments before providing service.
- For exchanges: review transaction histories and intermediary-wallet exposure, rather than treating a pool-related deposit as conclusive evidence either way.
- For investigators and compliance teams: distinguish observed transaction associations from conclusions about intent, ownership, or the source of every coin.
How this fits the wider ransomware picture
Canadian Centre for Cyber Security guidance defines ransomware to include malware that denies access until payment and recognizes extortion cases involving stolen data even when files are not encrypted. Canada’s 2025–2027 outlook treats ransomware as a financially motivated ecosystem. The Department of Finance Canada describes broader laundering techniques such as peel chains, mixers, gambling platforms, and decentralized finance before cryptocurrency is converted at exchanges. That context helps explain why mining-linked flows are one possible typology among others; it does not establish that cloud mining is a prevalent laundering channel today.
Quick Recap
Best Value
- Dual-chip architecture for maximum protection: The next-gen, fully auditable TROPIC01 chip works alongside a certified EAL6+ Secure Element—completely NDA-free—to deliver radically transparent, industry-leading defense against physical attacks.
- Quantum-ready security: Get protection against future threats with the first-ever hardware wallet designed with quantum-ready architecture.
- See every detail with confidence: Our largest high-resolution color touchscreen makes it easy to navigate your assets, review transactions and manage your coins with clarity.
- Wireless freedom with encrypted Bluetooth control: Manage, buy, swap and stake securely using Trezor Suite on desktop or mobile. Qi2-compatible wireless charging keeps your Trezor powered up. No cables required—security meets convenience.
- Works seamlessly with Android, iOS and desktop: Connect wirelessly or via USB-C to your phone or computer. Manage your crypto anywhere with our companion Trezor Suite app.
Rank #4
- EAL5+ CERTIFIED SECURE ELEMENT + FINGERPRINT PROTECTION — Your private keys stay encrypted offline on a certified EAL5+ chip, the same security tier used in EMV bank cards. Built by DCENT, securing crypto since 2018. Fingerprint authentication adds a second layer no PIN-only wallet can match.
- 10,000+ ASSETS NATIVE ON 100+ BLOCKCHAINS — Hold Bitcoin, Ethereum, XRP, Solana, Cardano, popular stablecoins (USDT, USDC), and NFTs in one wallet. No third-party apps, no fragmented setup — every supported asset works straight out of the box.
- TAP-TO-SIGN MOBILE EXPERIENCE — Pair your wallet with the DCENT mobile app over Bluetooth. Manage tokens, review transactions, and access in-app swap features directly from your phone — no cables, no desktop required.
- WEB3 & dAPP ACCESS VIA METAMASK — Connect to MetaMask and other browser extension wallets to manage NFTs, claim airdrops, and access dApps. A large screen and intuitive 4-button interface keep every transaction clearly visible before you sign.
- SEAMLESS FIRMWARE UPDATES & 30-DAY MONEY-BACK GUARANTEE — Apply security updates without resetting your wallet or migrating funds. Backed by Amazon's 30-day money-back guarantee — your purchase is risk-free.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
