BT Daily News: Bitcoin Miners Are Starting to Emerge From Brutal Crypto Winter, and more
1. Bitcoin Miners Are Starting to Emerge From Brutal Crypto Winter
The bitcoin mining industry appears to be getting back on its feet after a long crypto winter that saw major bankruptcies and fire sales.Even though mining economics have improved only marginally as bitcoin trades above $20,000, capital is starting to flow into the sector once again.
“This shows that investor sentiment is still largely driven by BTC price action rather than mining fundamentals,” Ethan Vera, chief operating officer at Luxor Technologies, a crypto mining-services firm, said.
Meanwhile, lower energy costs in the last few months have also given miners some breathing room.
Shares of publicly traded bitcoin mining firms have outpaced bitcoin this year. A composite index of public mining rig manufacturers, foundries and miners compiled by Luxor is up by 52% so far this year, compared with bitcoin’s 44% rise.
In terms of percentage growth, the biggest winner in public markets has been Core Scientific (CORZQ), which is still traded over-the-counter amid its Chapter 11 bankruptcy. The value of its equity grew 693% in 2023, according to stock information platform TradingView, but the stock is still trading at about 30 cents. It is followed by Digihost, whose shares have risen 225%. Shares of Cipher Mining (CIFR), DMG Blockchain (DMGI), Bitfarms (BITF), Iris Energy (IREN) and Bit Digital (BTBT) have all at least doubled.
Meanwhile, when it comes to realized hashrate, a metric of miners’ competitiveness on the Bitcoin network, CleanSpark (CLSK) leads the pack, with 224% growth year over year, followed by Bit Digital (BTBT), Bitfarms and Riot Platforms (RIOT) following. Hashrate is a measure of computing power used to mine new bitcoin blocks and validate transactions on the network.
The earnings season that was kicked off by CleanSpark should reveal whether the rally in miners’ stock is justified.
The fourth quarter of 2022 was and could be the worst of the market cycle, according to investment bank H.C. Wainwright analyst Kevin Dede. He expects the upcoming earnings reports to show that the quarter was a trough one, making it the last step in the business cycle before a potential recovery.
The winners
With some major players out of the game, or in Core Scientific’s case on the bench, due to bankruptcy proceedings, opportunities abound for other companies.
Several publicly traded miners that were uncertain about their cash flow in the medium term, such as Greenidge Generation (GREE), TeraWulf (WULF) and Stronghold Digital Mining (SDIG), have been able to restructure their debt obligations in 2023 so that they can stay afloat.
Smaller firms are also seeing interest from investors in 2023. Sabre56 raised $35 million to build 150 megawatts of infrastructure, and mining machine supplier Minerset is preparing to merge with BlockQuarry, which also canceled $5 million in debt and raised $1.3 million in new capital.
Luxor’s Vera sees Hut 8 (HUT) and US Bitcoin Corp., which recently merged, as well as Galaxy Digital (GLXY.CA) as “positioning themselves to capitalize on the next bull run well.” He also noted that “a series of new startups are finding unique ways to build businesses in the space such as Block Green, Giga Energy and 360 Mining.”
Elsewhere, crypto lender NYDIG has access to more than 11.6 exahash per second of machines because of various loans that miners either restructured or defaulted on. If NYDIG were to bring all of those machines online, it would be a miner the size of Marathon Digital (MARA), one of the bigget publicly traded miners. The list of NYDIG’s borrowers includes Greenidge, Iris Energy, Core Scientific and Stronghold Digital Mining.
Don’t call it a comeback
Despite the rally in publicly traded miners’ stocks, the fundamentals are far from what investors saw back in the heady days of 2021.
“While that [the gains in the price of bitcoin] certainly gives some breathing room to struggling miners, it is still too soon to confidently be calling an industry rebound,” said Juri Bulovic, head of mining at Foundry Digital. Foundry is owned by CoinDesk’s parent company, Digital Currency Group.
The bitcoin network’s hashrate has grown by one-third since the start of 2023, with the difficulty of mining a bitcoin block reaching an all-time high of one in 43.05 trillion on Feb. 24. But when the network difficulty increases, miners’ profitability falls. The profitability of mining bitcoin, measured by Luxor’s hashprice, fell back to January levels when the difficulty increased on Feb. 24.
It's possible that miners might have found some relief this year, but with high inflation and interest rates still lurking in the background, miners are not out of the woods yet. The miners now have to implement risk-aversion strategies to survive the remainder of the down market.
Neil Galloway, COO of Rebel Mining, cautions that “we have a long way to go to get back to where we were” and so “it is crucial that miners remove additional risks” and “partner with a host who is financially solvent, owns and operates the underlying infrastructure and who has the systems in place to monitor and manage things appropriately.”
2. Crypto Winter Ends Era of Bitcoin Mining ‘HODLers’
The last publicly listed bitcoin miner to pursue a 100% “HODL” strategy since the bull market, Hut 8 Mining (HUT), said last week that it finally gave in and sold 188 bitcoins in February to fund operations.Miners in general have found it difficult to raise funds for operations, including in the form of capital in public markets, amid a slide in the broader financial market and narrowing margins. Some of the miners that opted to hold onto their mined bitcoin (BTC) through the last bull market and into this bear cycle are now starting to sell the coins, mostly to pay for their daily operating expenses.
Hut 8 hadn’t sold any bitcoin since January 2021, leaving it with 9,242 BTC at the end of February, after the sale. Marathon Digital Holdings (MARA), for its part, sold bitcoin for the first time in January, after it indicated that it would. Marathon still held 11,392 bitcoin in reserve as of the end of February.
Hut 8 CEO Jaime Leverton had previously said the company would sell bitcoin so that it could complete a merger with U.S. Bitcoin Corp.
A matter of time
“It was only a matter of time before these companies needed to be a little more careful with their cash on hand,” given rising interest rates and other obstacles, said Chris Brendler, an analyst at D.A. Davidson who covers the bitcoin mining industry.
Holding onto a reserve of bitcoin that miners produce can be very expensive. As other types of financing became less available, the companies had to sell what they mined to fund operations and growth.
“When the market was at its peak, public bitcoin miners were aggressively funding operations of existing assets and growth capital with equity issuances, which the market supported (or overlooked),” said Kerri Langlais, chief strategy officer at bitcoin miner TeraWulf (WULF).
Marathon Digital spokesman Charlie Schumacher said miners that held onto their bitcoin were getting “brownie points” from both investors who saw a ballooning balance sheet and the bitcoin community that is long on bitcoin.
But Langlais said that during the bear market, the practice of holding bitcoin resulted in “tremendous dilution” for shareholders while the price of bitcoin and mining stocks dropped. Eventually, investors were no longer willing to support companies’ strategy of “growth at any cost” or holding mined bitcoin, while funding operating losses with equity, she said.
At the same time, the prolonged bear market resulted in the bankruptcies of some large-scale miners, including Compute North and Core Scientific, as well as in debt restructurings by some other miners to keep their operations going.
“The example of debt-laden bitcoin miners going through bankruptcy protection or debt restructuring” contributed to the decision to sell bitcoin reserves, said Wolfie Zhao, head of research at TheMinerMag, a business started by BlocksBridge Consulting to provide research and data on crypto mining.
Tim Rainey, treasurer at bitcoin miner Greenidge Generation (GREE), said that the trend was likely kicked off by “the decrease in hash price [mining profitability]” and “the need for liquidity during the bear market to fund operations and other obligations.”
The liquidation of bitcoin holdings was particularly strong in June 2022, when miners sold 14,200 bitcoins, according to Zhao’s analysis. Roughly half of that was from now-bankrupt Core Scientific. Since then, miners tracked by Zhao have been selling 5,000 to 7,000 bitcoins per month, more than twice as many as they were selling between January and May 2022.
Timing is everything
Even though the writing was on the wall for miners selling off their holdings, timing the sale is crucial to maximize the benefit.
Core Scientific started offloading its massive bitcoin holdings in June 2022, when the price of bitcoin started dropping from around $40,000. According to Zhao, the miner could have earned $144 million more if it had started selling in January, instead of waiting for the market to start crashing in May.
Many miners and investors were forced to sell their bitcoin last year, but Marathon wanted to ensure that when it started selling, it was clear to the outside world that it was making “a conscious choice that had to do with treasury management and building the business,” Schumacher, the spokesman, said.
Marathon wanted to be “producing at a high enough capacity and had a good line of sight into our bitcoin production” in order to feel comfortable to sell, he said. The miner first started selling its mined bitcoin in January of this year to cover its operating expenses.
Impairment implications
Greenidge’s Rainey expects miners to report “large non-cash impairment losses for both digital asset holdings and other mining related assets, including miners and infrastructure” in upcoming earnings reports.
Riot Platforms (RIOT), one of the largest firms in the crypto mining industry, reported $147.4 million in non-cash impairments in cryptocurrencies for 2022, compared with $36.5 million the year before. Similarly, Hut 8 took a $113.9 million loss on mining equipment during 2022. The price of mining rigs roughly follows crypto prices.
Zhao expects more miners to “stick to a hybrid strategy until maybe whenever the bull returns. But then the question is will they become 100% holders and repeat the same again?”
3. Illicit Crypto Miners Find a New Fave in Privacy Coin Dero
Threat actors who mine digital assets using other people's infrastructure found a lucrative new cryptocurrency to motivate their hacking: privacy-focused currency Dero.The crypto crash of 2022 undercut the rewards of cryptojacking by between 50% and 90%, cybersecurity firm CrowdStrike said. Not so for Dero, "which offers larger rewards" to attract miners and provides cutting-edge anonymity features, making it a "perfect match" for attackers on the lookout for an illicit payday.
Hence what the cybersecurity firm said in research published Wednesday is the first-ever detected Dero cryptojacking operation. CrowdStrike said the operation has targeted Kubernetes infrastructure on three U.S.-based servers since February.
Cryptojacking is "always evolving," as adversaries learn how to monetize new cryptocurrencies and identify weaknesses in various attack surfaces, Manoj Ahuje, senior threat researcher for cloud security at CrowdStrike, told Information Security Media Group.
Bad actors have potentially deployed more than 4,000 miner instances during this campaign. It is tough to track funds in Dero wallets due to the cryptocurrency's privacy and anonymity features. Rather than resting on chronological blocks of transactions, Dero rests on a structure called a directed acyclic graph that's more akin to a tree with branches than a chain. The Dero white paper says transactions can't be followed "in a way that reveals who sent or received coins."
The campaign operators find and target exposed Kubernetes clusters that can be accessed anonymously through the application programing interface, along with nonstandard ports that can be accessed from the internet. A user with sufficient privilege can unintentionally expose a secure Kubernetes API on the host, allowing the threat actor to bypass authentication. The attacker then deploys a Kubernetes DaemonSet, which in turn deploys a malicious pod on each node of the Kubernetes cluster to allow the attacker to engage resources of all of the nodes at the same time. "The mining efforts by the pods are contributed back to a community pool, which distributes the reward, i.e., Dero coin, equally among its contributors through their digital wallet," CrowdStrike said.
In cryptojacking campaigns, the threat actors usually move laterally to attack other resources or scan the internet for discovery - steps that the latest Dero campaign does not follow post-compromise. The attackers also do not attempt to delete or disrupt the cluster operation but deploy a DaemonSet to mine Dero by masquerading as common Kubernetes log names.
"These focused behaviors seem to clarify the intent of this campaign, which is that the attackers are solely attempting to mine for Dero," CrowdStrike said.
The attack flow is nearly identical to that of a monero-focused campaign running in parallel to the Dero one. "Both campaigns are trying to find undiscovered Kubernetes attack surfaces and are battling it out," CrowdStrike said.
The monero campaign "kicks out the DaemonSets used for Dero cryptojacking in the Kubernetes cluster before taking it over," CrowdStrike said. The campaign focused on monero mining deliberately deletes existing DaemonSets to disrupt the Dero campaign before taking over the cluster and using the deployed resources for its own purposes.