Sebastian Sinclair

<div id="highlights-block_63203f5feedd2" class="highlights">
 <ul>
 <li>ETHW’s mainnet launch is a direct response to the Merge event for Ethereum</li>
 <li>A successful Merge will put Ethereum miners out of business, leading to a proof-of-work spinoff</li>
 </ul>
 
</div>



The controversial Ethereum proof-of-work (PoW) fork, ETHPoW (ETHW), is expected to formally launch within 24 hours after the Merge, stewards of the nascent network <a href="https://twitter.com/EthereumPoW/status/1569428021437935617?s=20&amp;t=500Dk049w3JY1LAG-S92lQ" target="_blank" rel="noreferrer noopener">said</a> late Monday.



The exact timing of ETHW’s mainnet deployment — the phase where fully-fledged blockchains are made available to the public — will be announced via a countdown timer one hour before going live, giving prospective participants a target to connect to the network.



The Merge event, which will see Ethereum transition to proof-of-stake (PoS), is slated for the very early hours of Sept. 15, once the blockchain reaches Terminal Total Difficulty of 58,750,000,000T.



Final code, binaries, configuration files, node info and the like for the Ethereum spinoff will be made available once the timer reaches zero, the stewards said.



Previously, miners on Ethereum have helped secure the network under a PoW-powered consensus mechanism. The transition to PoS will effectively put them out of business, leading major GPU miner <a href="https://cms.blockworks.co/ethereum-fork-may-be-doomed-to-fail-but-chandler-guo-is-all-in-again/" target="_blank" rel="noreferrer noopener">Chandler Guo</a> to rally support for ETHW.



Indeed, ETHW is a direct response to the Merge, with those hoping to maintain the older Ethereum state, including its transaction history and all records of assets, as a means of survival.



Several exchanges have already voiced their support for the PoW fork. This has led markets to spring up for <a href="https://www.coingecko.com/en/coins/ethereum-pow-iou">IOUs</a> of the network’s token, to be distributed by participating exchanges after the blockchain comes online.



<h3 class="wp-block-heading">Traders dumping Ethereum PoW could drag the price of ether</h3>



Skepticism abounds over whether ETHW will be particularly valuable (it currently <a href="https://www.coingecko.com/en/coins/ethereum-pos-iou" target="_blank" rel="noreferrer noopener">trades</a> for around $29, while the PoS <a href="https://www.coingecko.com/en/coins/ethereum-pos-iou" target="_blank" rel="noreferrer noopener">version</a> changes hands just below ether par, at $1,685).



Pricing for both ether and ETHW could be impacted if traders immediately sell their ETHW once their IOUs are swapped, Matt Weller, global head of research at FOREX.com told Blockworks in an email.



“Current grey market valuations for ETHW are at around 3% of the value of the main Ethereum network, so it wouldn’t be surprising to see ETH fall by ~3% immediately after even a successful Merge, akin to a stock going ex-dividend,” Weller said, as traders would hypothetically seek to offload the ether they bought to receive the fork token.



It&#8217;s not the first time the network has forked. Back in 2015, Ethereum split into two separate chains, Ethereum and Ethereum Classic (ETC), with the latter maintaining the original code and developed by Vitalik Buterin and Gavin Wood — complete with transactions associated with <a href="https://medium.com/swlh/the-story-of-the-dao-its-history-and-consequences-71e6a8a551ee" target="_blank" rel="noreferrer noopener">The Dao hack</a>.



<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter"><div class="wp-block-embed__wrapper">
<blockquote class="twitter-tweet" data-width="550" data-dnt="true">The ETHPoW whitepaper (linked from their official website) is pure performance art. There&#39;s a title page, a page that says &quot;The Original Ethereum Blockchain&quot;, and then 7 pages that just say &quot;intentionally left blank&quot;. <a href="https://t.co/nNHqTjZHUX">pic.twitter.com/nNHqTjZHUX</a>&mdash; frankie (@FrankieIsLost) <a href="https://twitter.com/FrankieIsLost/status/1567685957230673921?ref_src=twsrc%5Etfw">September 8, 2022</a></blockquote><script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script>
</div><figcaption>Onlookers have levied criticism at ETHPoW&#8217;s sparse &#8220;marketing <a href="https://ipfs.io/ipfs/bafybeiad2fsci44nzqoel4pvgpbugzzdugam53ylz42fdv2rbqj4r6fpxu/EthereumPoW%20Whitepaper.pdf" target="_blank" rel="noreferrer noopener">whitepaper</a>&#8221; in the leadup to its deployment.</figcaption></figure>



Chandler Guo was also a primary supporter of Ethereum Classic (ETC). While ETC has remained largely dormant relative to its developer activity and user adoption, it still commands a $5.2 billion market capitalization and currently ranks 19th in the top 20 coins.&nbsp;



ETC’s hash rate, which measures mining activity on the network, has repeatedly hit all-time highs leading up to the Merge, as miners speculate on which network will be most profitable once Ethereum abandons PoW. The network boasts less than 5% of Ethereum&#8217;s current hash rate.



Still, that traction has also buoyed its token price, with ETC up more than 10% on the week and more than <a href="https://cms.blockworks.co/crypto-markets-bet-big-on-whats-next-for-ethereum-miners/" target="_blank" rel="noreferrer noopener">180% in two months</a>.



<hr class="wp-block-separator has-alpha-channel-opacity"/>



Get the news in your inbox. Explore Blockworks newsletters:



<ul class="wp-block-list">
<li><a href="https://blockworks.co/newsletter/the-breakdown">The Breakdown</a>: Decoding crypto and the markets. Daily.</li>



<li><a href="https://blockworks.co/newsletter/0xresearch">0xResearch</a>: Alpha in your inbox. Think like an analyst. </li>
</ul>

cryptocurrency

Proof-of-work Ethereum Fork to Rally Miners with 1 Hour Countdown

<div id="highlights-block_6316fa577ec60" class="highlights">
 <ul>
 <li>Major bitcoin mining pool Poolin is short on liquidity after mass withdrawals</li>
 <li>Withdrawals from the service&#8217;s wallet were suspended on Monday evening</li>
 </ul>
 
</div>



Crypto mining platform Poolin — one of the largest in the world — has frozen withdrawals until further notice as its stewards wrestle with liquidity issues and operational stability.



Poolin suspended withdrawals by 6pm ET on Monday as part of a defensive move designed to navigate a “dull crypto market,” according to a <a href="https://medium.com/@PoolinWalletOfficial/sep-5th-announcement-on-the-temporary-suspension-of-withdrawals-96a8915bcff0" target="_blank" rel="noreferrer noopener">statement</a> from the firm on Sunday.



Flash trades and internal transfers within Poolin’s systems have also been halted indefinitely. The firm, which supports mining on multiple proof of work chains, said it would continue exploring “strategic alternatives with various parties.”



Still, Poolin said users&#8217; assets in its PoolinWallet are safe and that the company’s net worth was positive. Withdrawals <a href="https://help.poolin.me/hc/en-us/articles/10207618877977-Announcement-on-settlement-adjustment-and-ZERO-fee-promo" target="_blank" rel="noreferrer noopener">en masse</a> were partly to blame for the freeze, according to Poolin’s statement.



Daily mined coins have continued to be paid out per day, the firm said, while other coins have not been affected.



Liquidity has continued to plague multiple crypto firms, including <a href="https://cms.blockworks.co/crashing-prices-expose-bitcoin-mining-industrys-addiction-to-leverage/" target="_blank" rel="noreferrer noopener">major bitcoin mining companies</a>, following a market shakeout earlier in the year. It was later revealed large <a href="https://cms.blockworks.co/celsius-lost-potential-6b-bailout-after-refusing-to-show-financials-investor-says/" target="_blank" rel="noreferrer noopener">crypto lenders</a> had been overleveraged while exposed to troubled projects, making them susceptible to outsized crypto price moves.



In an effort to stabilize its liquidity woes, Poolin said it would slash certain fees and switch its payout method to bitcoin miners from Full-Pay-Per-Share (FPPS) to Pay-Per-Last-N-Shares (PPLNS).



The methods differ slightly with FPPS offering miners a share of transaction fees in a given pool while PPLNS only generates a profit based on the number of blocks mined.



Poolin has mined a tad over 10% (1,381) of all bitcoin blocks over the past three months, according to <a href="https://btc.com/stats/pool?pool_mode=month3" target="_blank" rel="noreferrer noopener">BTC.com data</a>, converting to 8,361 BTC ($166.4 million at current prices). The pool is currently mining around 3.6% of all ether blocks.



Poolin said it would take a snapshot of the remaining bitcoin and ether balances within its mining pools to determine what’s owed to miners.



An update to the payout schedule for remaining balances will be released when details are finalized, Poolin said, which expects further details, as well as solutions, provided to users sometime next week.



<hr class="wp-block-separator has-alpha-channel-opacity"/>



Get the news in your inbox. Explore Blockworks newsletters:



<ul class="wp-block-list">
<li><a href="https://blockworks.co/newsletter/the-breakdown">The Breakdown</a>: Decoding crypto and the markets. Daily.</li>



<li><a href="https://blockworks.co/newsletter/0xresearch">0xResearch</a>: Alpha in your inbox. Think like an analyst. </li>
</ul>

Bitcoin

Bitcoin Mining Pool Poolin Halts Withdrawals Amid Liquidity Crunch

Shalini Nagarajan

<div id="highlights-block_630f8072d1a9d" class="highlights">
 <ul>
 <li>VanEck found Bitcoin mining companies reward their executives far more than the US’ largest companies</li>
 <li>Riot Blockchain’s shareholders voted against an advisory vote on executive compensation in July</li>
 </ul>
 
</div>



A recent shareholder vote to reject a major Riot Blockchain advisory vote on executive compensation hints at a potentially high-risk trend across the bitcoin mining industry.



Riot’s shareholders, in a rustic example of TradFi (traditional finance) governance, are allowed to vote on various decisions related to how the bitcoin mining company is run.



An <a href="https://www.sec.gov/ix?doc=/Archives/edgar/data/1167419/000107997322000922/riot_8k.htm" target="_blank" rel="noreferrer noopener">8-K filing</a> shows Riot’s annual general meeting held on July 27 saw stockholders approve a number of proposals: electing a new director in Hubert Marleau; ratification of independent auditor Marcum LLP; and approval of an <a href="https://www.sec.gov/Archives/edgar/data/1167419/000107997322000922/ex10x1.htm" target="_blank" rel="noreferrer noopener">amendment</a> to the 2019 equity incentive plan. 



But shareholders didn’t agree with the board&#8217;s unanimous recommendation urging them to vote in favor of a “say-on-pay” proposal, noted <a href="https://www.vaneck.com/us/en/blogs/digital-assets/matthew-sigel-bitcoin-miners-excessive-comp-prompts-shareholder-concern/" target="_blank" rel="noreferrer noopener">VanEck</a> analysts, which would&#8217;ve paid out more than $90 million to five Riot executives.



CEO Jason Les and executive chairman Benjamin Yi were slated to receive about $21 million each. Even the lowest paid executive, general counsel William Jackman, was in line for a $13 million remuneration. Meanwhile, the annual bonuses were left blank, suggesting payments down the line.



The motion was designed to retain talent and ensure the achievement of long-term strategic goals.&nbsp;



VanEck’s head of digital assets research Matthew Sigel and product analyst Naomi Zimmermann then decided to zoom out from Riot and check compensation at other major mining firms.



The analysts found bitcoin miners collectively paid “enormous” awards to named executive officers (NEOs), relative to the energy and IT industries and companies listed in the <a href="https://www.investopedia.com/terms/r/russell_3000.asp" target="_blank" rel="noreferrer noopener">Russell 3000</a>. The analysts also described Riot’s and its competitors&#8217; compensation habits as “risky.”



The IT industry counted median total direct compensation of $2.2 million in 2022, according to VanEck. Riot other crypto mining companies paid out median compensation of $10.8 million — 390% more than the IT sector.



<figure class="wp-block-image"><img decoding="async" src="https://lh4.googleusercontent.com/VABNGJYO9xFxQrEUE_OSSSCCGBMFif-FkA6oV3awjRHdlclVukHD_sz5G1YRNHvXP9TU1drGeUm4Zc2sma5CQEZkoUC-ZYT7BLpccEL4BHilVOoDdqo07S-x_eWi9t57y0k_IZW2I5SvP8Ie_Q24I0QdMhrA5wD8_eqHcZYNGApSW5Ixm6T7laD0" alt=""/><figcaption>Image source: VanEck</figcaption></figure>



“These more excessive executive compensation practices (amongst RIOT and its peers) might lead to pressure on peer companies in the digital assets industry to provide similarly large awards, in the absence of shareholder pushback,” VanEck’s analysts wrote.



“Seeing eight-to-nine figure sums for the leaders of firms that have yet to make a profit may be discomforting in any industry.” Blockworks has reached out to Riot for comment.



VanEck expects increased awareness of the <a href="https://cms.blockworks.co/the-investors-guide-to-bitcoin-the-environment/" target="_blank" rel="noreferrer noopener">environmental impact of bitcoin mining</a> to draw attention to executive compensatory standards for the industry and other governance matters.



Riot, which has a market capitalization of over $1 billion, <a href="https://finance.yahoo.com/quote/RIOT/holders/" target="_blank" rel="noreferrer noopener">counts</a> Vanguard, Blackrock, Morgan Stanley and Mirae Asset Global Investments among its top institutional holders. 



The miner’s shares have plunged nearly 70% so far this year, and are down about 4% in the last month to $7.04 per share, data from <a href="https://www.tradingview.com/chart/?symbol=NASDAQ%3ARIOT" target="_blank" rel="noreferrer noopener">TradingView</a> shows.



<hr class="wp-block-separator has-alpha-channel-opacity"/>



Get the news in your inbox. Explore Blockworks newsletters:



<ul class="wp-block-list">
<li><a href="https://blockworks.co/newsletter/the-breakdown">The Breakdown</a>: Decoding crypto and the markets. Daily.</li>



<li><a href="https://blockworks.co/newsletter/0xresearch">0xResearch</a>: Alpha in your inbox. Think like an analyst. </li>
</ul>

Bitcoin mining

Bitcoin Mining Execs Make Serious Bank Versus Other Industries

<div id="highlights-block_630f28259bd10" class="highlights">
 <ul>
 <li>Nitrokod is currently featured at the top of Google search results for popular apps, including Translate</li>
 <li>The malware maliciously mines monero using users&#8217; computer resources, echoing once-prolific CoinHive</li>
 </ul>
 
</div>



An insidious malware campaign targeting users searching for Google applications has infected thousands of computers globally to mine <a href="https://cms.blockworks.co/crypto-mixers-and-privacy-coins-can-they-resist-censorship/">privacy-focused crypto</a> monero (XMR).



You’ve probably never heard of Nitrokod. Israeli-based cyber intelligence firm Check Point Research (CPR) stumbled upon the malware last month.&nbsp;



In a <a href="https://research.checkpoint.com/2022/check-point-research-detects-crypto-miner-malware-disguised-as-google-translate-desktop-and-other-legitimate-applications/" target="_blank" rel="noreferrer noopener">report on Sunday</a>, the firm said Nitrokod initially masks itself as a free software, having found remarkable success at the top of Google search results for “Google Translate desktop download.”



Also known as cryptojacking, mining malware has been used to infiltrate unsuspecting user’s machines since at least 2017, when they rose to prominence alongside crypto’s popularity.



CPR previously detected well-known cryptojacking malware CoinHive, which also mined XMR, in November of that year. CoinHive was said to be stealing <a href="https://www.checkpoint.com/press/2017/cryptocurrency-mining-presents-new-threat-business-says-check-point/" target="_blank" rel="noreferrer noopener">65% of an end-user’s total CPU resources</a> without their knowledge. Academics <a href="https://thenextweb.com/news/coinhive-mining-monero-profits" target="_blank" rel="noreferrer noopener">calculated</a> the malware was generating $250,000 per month at its peak, with the bulk of it going to less than a dozen individuals.



As for Nitrokod, CPR believes it was deployed by a Turkish-speaking entity sometime in 2019. It operates across seven stages as it moves along its path to avoid detection from typical antivirus programs and system defenses.&nbsp;



“The malware is easily dropped from software found on top Google search results for legitimate applications,” the firm wrote in its report. 



Softpedia and Uptodown were found to be two major sources of fake applications. Blockworks has reached out to Google to learn more about how it filters these kinds of threats.



<figure class="wp-block-image size-full"><img loading="lazy" decoding="async" width="935" height="445" src="https://blockworks-co.imgix.net/wp-content/uploads/2022/08/Picture1-1.webp" alt="" class="wp-image-29655" srcset="https://blockworks-co.imgix.net/wp-content/uploads/2022/08/Picture1-1.webp?w=935 935w, https://blockworks-co.imgix.net/wp-content/uploads/2022/08/Picture1-1.webp?w=300 300w, https://blockworks-co.imgix.net/wp-content/uploads/2022/08/Picture1-1.webp?w=768 768w, https://blockworks-co.imgix.net/wp-content/uploads/2022/08/Picture1-1.webp?w=428 428w, https://blockworks-co.imgix.net/wp-content/uploads/2022/08/Picture1-1.webp?w=470 470w, https://blockworks-co.imgix.net/wp-content/uploads/2022/08/Picture1-1.webp?w=389 389w, https://blockworks-co.imgix.net/wp-content/uploads/2022/08/Picture1-1.webp?w=80 80w, https://blockworks-co.imgix.net/wp-content/uploads/2022/08/Picture1-1.webp?w=50 50w" sizes="auto, (max-width: 935px) 100vw, 935px" /><figcaption>Image source: <a href="https://research.checkpoint.com/2022/check-point-research-detects-crypto-miner-malware-disguised-as-google-translate-desktop-and-other-legitimate-applications/" target="_blank" rel="noreferrer noopener">Check Point Research</a></figcaption></figure>



After downloading the application, an installer executes a delayed dropper and continuously updates itself on every restart. On the fifth day, the delayed dropper extracts an encrypted file.&nbsp;



The file then initiates Nitrokod’s final stages, which sets about scheduling tasks, clearing logs and adding exceptions to antivirus firewalls once 15 days have ticked by.



Finally, crypto mining malware “powermanager.exe” is surrepticiously dropped onto the infected machine and sets about generating crypto using open source Monero-based CPU miner XMRig (the same one used by CoinHive).



“After the initial software installation, the attackers delayed the infection process for weeks and deleted traces from the original installation,” the firm wrote in its report. “This allowed the campaign to successfully operate under the radar for years.”



Details of how to clean machines infected with Nitrokod can be found at the <a href="https://research.checkpoint.com/2022/check-point-research-detects-crypto-miner-malware-disguised-as-google-translate-desktop-and-other-legitimate-applications/" target="_blank" rel="noreferrer noopener">end of CPR&#8217;s threat report</a>.



Learn More: <a href="https://cms.blockworks.co/crypto-mixers-and-privacy-coins-can-they-resist-censorship/">Can Crypto Mixers and Privacy Coins Resist Censorship?</a> 



<hr class="wp-block-separator has-alpha-channel-opacity"/>



Get the news in your inbox. Explore Blockworks newsletters:



<ul class="wp-block-list">
<li><a href="https://blockworks.co/newsletter/the-breakdown">The Breakdown</a>: Decoding crypto and the markets. Daily.</li>



<li><a href="https://blockworks.co/newsletter/0xresearch">0xResearch</a>: Alpha in your inbox. Think like an analyst. </li>
</ul>

cryptocurrency mining