In Chapter 1, “What Is a Cryptocurrency?,” you learned about the tribespeople of Yap and their huge stone coins called Rai coins that are mined on islands hundreds of miles away across the Pacific. The work involved to obtain a stone coin has always been a significant undertaking, so the expense and work involved gives a Rai coin its accepted value.

When we played with our NickCoin spreadsheet, we used the simple Python script to take the hash of a number of transactions and then, by adding incrementing values and hashing them with SHA256, we would search for a value starting with a certain number of zeros. When a solution was found, this could be used to close the block. Finding the solution required a significant amount of processing power, so the solution is a proof of an investment of work—in fact, not just work, but real time and money. When we played with the NickCoin spreadsheet, the winner of the hashing game won a few NickCoin. This is exactly the same as the real world: when a miner finds the solution to a block, he or she currently receives 12.5 bitcoin and the transaction fees that were taken for each transaction in the block.

The process is not dissimilar to trying to unlock a padlock that uses a combination. You need to try every combination in turn until you find the solution; however, once the solution is known, opening the lock becomes really easy, essentially back to our one-way algorithms.

The obvious questions are: “Is it really hard work? Does it really cost anything?” When you explain mining to non-technical people, they cannot see the work element. It seems that the new coin comes from nothing, so they do not see computer operations as “work” in the traditional sense. However, as you will see, the costs to find a block solution are significant and even the reward of “free” coins hardly covers the investment.

Virtually no cryptocurrencies are left that enable you to mine with just a CPU or single GPU. ZCash, Monero, and one or two other less known coins are the closest to being feasible but if you really want to have a try at it just out of curiosity, numerous sites exist that will talk you through the process.

Most cryptocoins now require specialist hardware to be able to mine with any type of speed, such as vast numbers of high-end graphics cards or ASICs, otherwise known as Application Specific Integrated Circuits. Often, people mistake ASICs as being a cryptocurrency-specific system, when in fact, ASICs have been around for four decades and are essentially just chips that have been designed for a specific task. ASICs for Bitcoin and other currencies are designed to be able to calculate and check hashes very, very fast indeed—that's all they can do.

There is a large hobbyist following around building efficient miners with open-air “crates” available to be purchased to be able to mount multiple graphics cards. Many companies will sell you mining rigs and will tell you how much the rig will make you each month—these are almost always exaggerating or, at worst, lying. A current mining rig for sale on Gumtree for $3300 promises to make the user $250 to $300 per month. Even if that were the case, it would still take a year or more to break even, and that's before factoring in the cost of the electricity. These rigs are very power-hungry and get very hot indeed—most run large cooling fans but often need room cooling to run efficiently. The costs can spiral quickly.

It has been reported that Chinese Bitcoin mining companies are moving to rural areas with hydroelectric power plants nearby providing cheap power to run and cool their warehouses of thousands of mining rigs. Sadly, the amateur hobbyist doesn't really have a chance!

When you ran the Python miner example, you probably would have been checking anything from a few hundred to around 100,000 hashes per second depending on the speed of your computer. My Mac, which is configured with Windows VM, a single processor, and only 1 GB of RAM, is only capable of around 50 hashes per second, whereas my 2017 32 GB RAM iMac is able to do about 90,000 hashes per second. For about $1200, you can buy an Antminer S9. This can carry out 14TH/s; that's 14 trillion hashes per second! And you still need an awful lot of them to make any money with Bitcoin.

The Proof-of-Work Concept

Proof-of-work is the concept of finding the solution to a hashing problem. The more computing power you have, the more likelihood there is that you will win the competition to find a blocks solution and be rewarded the new Bitcoin. However, the Bitcoin system works such that every 210,000 blocks mined, the reward will be cut in half. This means that on June 14, 2020, the reward will drop to 6.25 coins, then another 210,000 coins later, it will half again, until all the 21,000,000 coins that can ever be produced will be in circulation. At that point, miners will only receive transaction fees, which will not likely be sufficient to keep them in business, and the value of transaction fees will fall as miners try to accept every possible transaction on the network. There is a concern that this could eventually make Bitcoin unworkable as it could be unaffordable to run miners or even leave the network with few miners, making a 51-percent attack more possible. Alternatively, Bitcoin could stabilize, with a continuing rise in hard-currency value, then fees could be reasonably static but their value in fiat currencies could make the continuation of mining for fees alone profitable. Because of this, some cryptocurrencies such as Ethereum are looking to move to a system called proof-of-stake.

In Bitcoin, blocks are set to mine about every 10 minutes no matter how fast the computing power mining them becomes. The network calculates what the difficulty should be for the calculation to ensure that 10 minutes pass between blocks, using a formula similar to the following:

New difficulty = Old Difficulty * (Actual time of last 2016 blocks / 20160 minutes)

This ensures that the difficulty remains such that blocks will not be mined too quickly, or conversely, too slowly.

Once mined, the block is validated and added to the blockchain. Validation is critical to ensure that it is not a faked or duplicated block. The validation of a block includes the following:

• Block data is valid.
• Header hash is less than difficulty target.
• Timestamp is correct.
• Block size within limits.
• First (only) transaction is a coinbase (new coin) generation transaction.

Ethereum does things differently. Currently, only 15 seconds pass between each block, although at the time of writing, Ethereum developers are considering a hard fork to increase block times to 45 seconds and dropping the reward from five ether to three ether. In 2018, they are also looking to implement proof-of-stake to replace proof-of-work.

The Proof-of-Stake Concept

With proof-of-stake, you have no vastly complex calculations to do—you simply have to prove your “stake” or coin-ownership in the currency. For example, with Ethereum, if you owned and could prove you own 1 percent of all the Ethereum coin, then you could mine an average of about 1 percent of the transactions. This method forces miners to have a literal stake in the success of the coin. It also opens mining back up to the person at home. Even if they only own 0.000000001 percent of Ethereum, that will still enable them to potentially mine and receive reward, especially as part of a pool (which you will learn about in a moment). The reward is just transaction fees—no new coins are created.

In a proof-of-stake system, miners are called validators. Let's say that you have five validators competing to mine a block: one has 40 percent, one has 30 percent, one has 20 percent, and one has 5 percent. Each validator has a chance to mine the block commensurate with the stake they have. If you are paying attention, you will realize that this will make the rich richer. However, this also means that you are less likely to negatively attack the network or try to fork it as you risk devaluing or losing your increasingly valuable stake.

Proof-of-stake is also more environmentally friendly:

It is believed that Ethereum will move to a proof-of-stake some time in 2018 in an upgrade called Casper.

Mining Pools

As described at the start of this chapter, mining has become a very complex and expensive business. One of the largest miners in the United States recently told me that their current mining expense was costing at least $1000 per bitcoin. Of course, that is good when a single bitcoin is worth $4000, but when it drops to below $1000 as it did in early 2017, that's not so good for business. To help flatten out the investment, a number of mining pools are available for almost every cryptocurrency. The simple idea is that you collaborate with many other miners around the world, adding your mining power to the whole and then sharing the proceeds. Some mining pools have become very powerful indeed. For example, in Figure 5-1, which was produced by blockchain.info, you can see the percentage of blocks mined by each mining pool in a four-day period in late 2017. At the time of this writing, just four pools—AntPool, F2Pool, BTC, and BTC.TOP—make up over half the network power at the time. In fact, AntPool was mining one in every five blocks.

It is very easy to sign up with a mining pool—you simply download mining software and run it with the mining pool as the target and authenticate with a user name and password. The pools are essentially free to use, but they all charge a percentage of the coin that you are awarded for your efforts, which can lead to scams and mining fraud.

Mining Fraud

Like streets paved with gold, everyone loves the idea of running something on their computer and generating free money. Of course, when something seems too good to be true, it probably is. A large number of frauds are based around mining companies. Here are some examples:

Commission Scam Companies can make the percentages and charges for you mining with them very expensive, so although you may click the Terms and Conditions box in good faith, a mining pool can simply use your mining power and then give all manner of reasons why you haven't earned any coin. Or they can pay a very small amount and hope you don't notice.

Exchange Fraud It is fairly straightforward to set yourself up as an exchange in order to convert between regular currency and cryptocurrencies. You can take people's money and cryptocurrency, and when you have enough, you can close and run.

Software Miners We have looked at the fact that mining is very processor-intensive and costs money to run the machine and keep it cool. Rather cleverly, some companies have been using your visit to their website to briefly use your processor to mine some hashes. This came to the fore at the end of September 2017, when code to mine coins was found on CBS's Showtime and Showtime Anytime websites. Further investigation showed potential malevolent activity rather than CBS trying to make a few extra dollars. The JavaScript injected into the site carried the payment address and some unique code including the following strings:

coinhive.anonymous(‘

            and

coin-hive.com/lib/coinhive.min.js

A search on these strings on source code search site www.publicwww.com revealed almost 14,000 sites that contained the same code at the time of writing (see Figure 5-2).

Although not illegal per se, it's certainly underhanded if sites are adding this code on purpose. You could even argue that it's stealing processor cycles.

Pirate Bay admitted the same idea, but they were honest about it, suggesting that it could offset or reduce advertising on the site. This is quite a good idea if customers don't mind—perhaps a site visitor could opt in or out of this service.

You can find a good article about software mining at http://bit.ly/2oBqBG7.

Private Key Phishing Although not strictly mining fraud, several software tools are available for free download that purport to do coin mining. In the setup process, it asks you to enter your private key for payment! Those who are not well-informed are easily taken in by this.

Stealing Power For years, criminals have been siphoning power from neighbors or straight from the grid to provide the lighting and heating for growing marijuana. The same process of stealing power could be very useful to a cryptocurrency miner because it would remove a significant proportion of the cost of mining.

Misleading Promises Many websites, known colloquially as faucets, promise free bitcoin for either spending time on a website or visiting advertisements. My favorite example, which I will not include in the book as I am concerned about possible malware on the site, promises 200 satoshis per 5 minutes. That sounds good until you realize that 200 satoshis represents just over 1 cent, which means it would require you to spend more than 8 hours on the site to make $1. Not illegal—just misleading promises!

Summary

Mining is a fairly straightforward process that usually uses specialist equipment to solve hashing problems. It is unlikely that investigators will stumble across a crime that involves mining specifically, but they could get involved in investigating fraudulent mining software, power stealing, or other crimes. Most of these crimes are really just standard fraud, theft, and the like, but it is still useful to understand the underlying technology.