How to find and remove a hidden cryptominer from your homelab

Published Nov 2, 2026, 2:30 PM EST Patrick Campanale has been in the tech space for well over a decade, specializing in PC/gaming news and reviews, as well as maker-focused products to build small businesses. With a start in technology back in 2010 surrounding the Palm/webOS ecosystem, Patrick spent his formative years developing mobile applications as well as blogging for various publications, eventually leading to starting his own website in 2014. After running a technology blog for a few years, he stepped out of that role and into the world of high-end custom PC manufacturing and building, with a focus on YouTube video production and overclocking. Then, in 2017, Patrick joined the 9to5Toys team as an editor/writer/reviewer with over 14,000 articles being published during his time there, ranging from deals and roundups to in-depth reviews on the latest technology, video games, 3D printers, and more. In his free time, Patrick loves to create projects from wood using various robots and methods, including leveraging the technologies of CNCs and lasers. If Patrick isn't working on a computer or playing video games, he's likely in his 2-car garage workshop creating something unique. In addition to all this, Patrick is also the media director at his local church where he feels God has called him to serve, and he loves every minute of it. I broke the cardinal rule of homelabbing—open ports and reverse proxies without properly locking things down. This led to not just one, but two of my servers being compromised over the period of a few months. I’ve locked things down now, but here’s how you can tell if your homelab has been hijacked by a cryptominer. Cryptominers don't always max out your CPU Mine was loud, but plenty are built to stay quiet Credit: Patrick Campanale / How-To Geek Cryptominers come in all shapes and sizes. Earlier this year, I was hit by one and it wound my CPU up to 100% and kept it there. My server got quite noisy (it was a rack-mount data center-grade system that had very loud fans) and that immediately tipped me off to it happening. Later in the year, the same thing happened again but on one of my NAS systems. I still don’t know how they got into that system, it was locked down—or so I thought. But that time, it didn’t spin the fans up to 100%. Instead, it kept things throttled and actually went under the radar for several days before I noticed it. I only noticed it because I was trying to use the NAS for something and it felt slower than normal, so I dug in and found a cryptominer hiding on it. A quiet server doesn’t mean it hasn’t been compromised. I thought that any compromised server would be noisy and easy to spot, but I was wrong. Your usage graphs will tell you more than your fans Look for a baseline that crept up and never came back down The best way to notice that you’ve been hijacked by a cryptominer is to pay attention before it ever happens. The best thing to do is deploy some type of monitoring software in your homelab early, like Grafana and Prometheus, that logs your system’s performance over time. If you start to notice any oddities in the graphs, like a busy CPU overnight unexpectedly or odd spikes throughout the day, it might be time to take a look. An energy-monitoring smart plug could also point this out by showing increased power draw when you’re not expecting it. More advanced cryptominers can also hide themselves quite well. For instance, some are capable of hiding themselves from the top command in Linux so you won’t actually see it running there. But with a smart plug, you’ll see extra power being drawn and “nothing” to show for it. Proxmox is another good indicator of this, as the Proxmox system itself can show you what a VM is actually using resource-wise, even if the VM internally says it’s mostly idle because the miner is hiding from top. Check what's actually running, not what the name says Miners love to pretend they're a normal system process Often, these cryptominers are hiding themselves in plain sight. Instead of a very obvious name like I had on my first system, they’ll hide under fake kernel-sounding names that look like kworker or something similar. Or, they’ll have random names like ctrnd that could be anything. The giveaway is where the processes are running from. You’ll want to look for processes running from /tmp or /dev/shm that you don’t recognize. If a process is running from either of those places and you didn’t intentionally start it, there’s a good chance it shouldn’t be there. Another place to look is inside of Docker. Some cryptominers like to spin up random Docker containers to hide the processes, so, if you suspect a cryptominer is running on your system, check docker ps -a for any containers that you didn’t create. If you notice something fishy, use docker stats to see what resources it’s using. If there’s an unknown container using more resources than you’d expect, chances are it’s malicious and you should look deeper into it. The network traffic is the hardest thing for a miner to hide It has to phone home to get paid One thing that no cryptominer can hide is network traffic. At the end of the day, it needs to get things out of your network. Start by doing a sudo ss -tunp to see what outbound connections are happening to unfamiliar IPs or ports. This is a great starting place, but not the end game. Something like Pi-hole or AdGuard Home could also show you what these miners are doing. They’ll have to phone home, and you can typically search for mining pool domains and block them at the DNS level. Of course, the miner could always set its own DNS if it's inside of a Docker container, so that’s not a complete fix. But, something they can’t do is bypass your router for their connections, so that’s another area where having a Grafana dashboard could come in handy. Look for the hooks that bring it back after a reboot Killing the process is only half the job Many cryptominers are built to come back after a reboot. I found this out with one of the ones that got into my homelab. I thought I'd found it, squashed the process, rebooted, and it came right back. This happens because cryptominers know that they’re going to be found and they hope that you’ll just kill the process and forget about it by the time you reboot. However, you should definitely check your cron entries and look for new systemd services if you feel like your system might be compromised. Also, look for new keys in authorized_keys because the attackers could have added themselves there for easier access. Found one? Here's where to go next I've already been through the cleanup, so start there If possible, I'd recommend disconnecting the machine from the network and then killing the malicious process through an offline terminal. Yes, it might come back on reboot, but start by killing it first. This immediately stops the mining from happening and will let you start to figure out how the attackers got in. It's definitely more work to have to pull a monitor out and try to connect to the system without a network, but it's a sure-fire way to kick the attackers out and shut everything down. If your system itself is what got compromised, don’t panic and just make sure the miner gets stopped first and foremost. Then, go through and check the areas I already mentioned—cron jobs, systemd services, and any other startup services that your operating system might have. Look for entires you don’t recognize and start from there. When in doubt, Google it or ask Claude, ChatGPT, Gemini, or whatever AI you’re using at the moment. It can do research faster than you can and provide sources for you to check. That’s what I did and I was up and running within an hour or so after discovering the miners on my server. The best practice is to restore the server using a known-good backup from before the attack began. I didn't have that so I did the best that I could, but just cleaning up a system could carry some risk that certain aspects might have gotten missed. A quiet server isn't always a clean server Always remember that just because you don’t hear your server going crazy doesn’t mean it hasn’t been hijacked. Just the other day, my Ugreen DXP4800 GT NAS’s hard drives were making more noise than usual. I immediately thought it might be compromised because you might be able to hide running processes, but you can’t hide hard drive reads and writes (and the system has no SSDs). It turned out that it was just my Time Machine backup thrashing the drives, but I’m still glad I checked because it’s better to be safe than sorry. When in doubt, check your server out to verify that there’s nothing malicious running on it. There has never been a time I regretted verifying that I didn’t have a cryptominer running on my server.