Cryptojacking Explained: What It Is and How to Protect Yourself

Cryptojacking is one of the most underreported forms of cryptocurrency crime — because victims often don't know it's happening. Your computer, phone, or server could be mining crypto for criminals right now, costing you money in electricity, degrading your hardware, and slowing your systems.

What Is Cryptojacking?

Cryptojacking is the unauthorised use of someone else's computing resources to mine cryptocurrency. Unlike ransomware or theft, cryptojacking is designed to go unnoticed — the criminal benefits as long as they have access to your device.

Browser-based cryptojacking: Malicious JavaScript code embedded in websites or ads runs mining scripts whenever you visit that page. This requires no download — simply visiting a compromised website activates it.

File-based cryptojacking: Malware downloaded via phishing emails, malicious apps, or software cracks installs persistent mining software on your device. This continues even when you're not browsing.

Cloud and server cryptojacking: Attackers compromise business cloud infrastructure, AWS instances, or web servers to run industrial-scale mining operations, often costing businesses thousands per month in compute fees.

Signs Your Device Has Been Cryptojacked

• Unusually slow device performance even with few programs open
• CPU usage spiking to 80–100% with no obvious cause
• Device overheating more than usual
• Fan running constantly at high speed
• Battery draining significantly faster than normal
• Higher-than-expected electricity bills (for server environments)
• Unusual network activity at odd hours

You can check CPU usage in Activity Monitor (Mac) or Task Manager (Windows). If a browser tab or unknown process is consuming 50%+ CPU, it warrants investigation.

How to Detect and Remove Cryptojacking

Browser-based detection and removal: - Install an ad blocker with anti-cryptomining capability (uBlock Origin or NoCoin extension) - Check which browser tab is consuming CPU by opening Chrome's Task Manager (Shift+Esc) - Clear all cookies and cache, then avoid the affected site

File-based malware removal: - Run a full scan with Malwarebytes or your preferred antivirus (free tier is sufficient for detection) - For severe infections, consider restoring from a clean backup or OS reinstall - Check startup programs and scheduled tasks for anything unrecognised

Network-level protection: - Use DNS filtering (Cloudflare 1.1.1.1 blocks many cryptomining domains) - For businesses: implement endpoint detection and response (EDR) tools - Audit cloud infrastructure for unauthorised resource usage regularly

Can You Recover Losses from Cryptojacking?

Recovery depends on the nature of the attack:

Electricity and compute costs: If your business has experienced significant cryptojacking-driven cost increases on cloud infrastructure, these may be partially recoverable through your cyber insurance policy.

Stolen crypto from hot wallets: If cryptojacking malware also exfiltrated private keys and drained your cryptocurrency wallets, CoinTrace Pro can trace those funds using the same blockchain forensics applied to other theft cases.

Legal action: For large-scale attacks on businesses, law enforcement (particularly dedicated cyber crime divisions) actively investigates cryptojacking cases. CoinTrace Pro can produce the forensic evidence required to support such investigations.

Last reviewed Sep 8, 2026 · Reviewed by our CEH-certified investigation team