Hackers Mined Crypto on GitHub's Servers: Report

The activity was first noticed in November, according to the report.

AccessTimeIconApr 5, 2021 at 11:52 a.m. UTC
Updated Sep 14, 2021 at 12:35 p.m. UTC

Hackers have been using GitHub cloud infrastructure to covertly mine multiple cryptocurrencies, The Record reported.

The attacks were first spotted by a French software engineer in November, a fact the development platform's team confirmed to The Record last week via email.

The attack abused a GitHub feature called GitHub Actions, which allows users to automatically execute tasks and workflows triggered by a certain event happens inside their repositories. To launch crypto mining software, the attackers would fork an existing repository, add malicious GitHub Actions element to the original code, and then file a Pull Request with the original repository to merge the code back into the original, The Record wrote.

The original project owner didn't have to approve the malicious Pull Request because right after it was filed GitHub’s systems would read the attacker’s code and launch a virtual machine, which would download and run crypto-mining software, as Dutch security engineer Justin Perdok told The Record. He added that "attackers spin up to 100 crypto-miners via one attack alone, creating huge computational loads for GitHub’s infrastructure."

The mining software, according to screenshots published by The Record, included SRBMiner, a software for mining multiple cryptocurrencies using easy-to-buy consumer hardware, namely GPUs and CPUs.

In any case, it looks like the attackers didn't look to damage the repositories in any way, only to get free coins using GitHub servers, the report reads.


Please note that our privacy policy, terms of use, cookies, and do not sell my personal information has been updated.

CoinDesk is an award-winning media outlet that covers the cryptocurrency industry. Its journalists abide by a strict set of editorial policies. In November 2023, CoinDesk was acquired by the Bullish group, owner of Bullish, a regulated, digital assets exchange. The Bullish group is majority-owned by Block.one; both companies have interests in a variety of blockchain and digital asset businesses and significant holdings of digital assets, including bitcoin. CoinDesk operates as an independent subsidiary with an editorial committee to protect journalistic independence. CoinDesk employees, including journalists, may receive options in the Bullish group as part of their compensation.

Read more about