The powers that be —

Massive cryptomining rig discovered under Polish court’s floor, stealing power

Top law enforcement agency taps IT experts to calculate stolen energy costs.

Massive cryptomining rig discovered under Polish court’s floor, stealing power

Police were called to dismantle a secret cryptomining rig winding throughout the floors and ventilation ducts of a Polish court in September, according to Polish news channel TVN24.

Several secured computers were discovered, potentially stealing thousands of Polish Zlotys worth of energy per month (the equivalent of roughly $250 per 1,000 Zlotys.) It's currently unknown how long the rig was running because the illegal operation went undetected, partly because the computers used were connected to the Internet through their own modems rather than through the court's network.

While no one has been charged yet with any crimes, the court seemingly has suspects. Within two weeks of finding the rig, the court terminated a contract with a company responsible for IT maintenance in the building, TVN24 reported. Before the contract ended, the company fired two employees that it said were responsible for maintenance in the parts of the building where the cryptomine was hidden.

Poland's top law enforcement officials, the Internal Security Agency, have been called in to investigate. The Warsaw District Prosecutor's Office has hired IT experts to help determine exactly how much electricity was stolen from Poland’s Supreme Administrative Court in Warsaw, TVN24 reported.

The Supreme Administrative Court is the last resort for sensitive business and tax disputes, but no records seem to have been compromised. Judge Sylwester Marciniak—the chairman of the Judicial Information Department of the Supreme Administrative Court—told TVN24 that the discovery of the cryptomine "did not result in any threat to the security of data stored" in the court.

Although very few instances have been publicized, the Polish cryptomining rig is not the only time public institutions have been targeted by bad actors seeking to siphon electricity to mine cryptocurrency. Experts told TVN24 that dishonest miners trying to rapidly collect as much cryptocurrency as possible are known to install illegal rigs in "less visited places" or to operate rigs during off hours when public institutions or enterprises targeted for electricity theft are typically closed.

There was at least one prominent case in the US of another cryptomine illegally and secretly set up at a public institution. That case provides some insight into how much electricity can be stolen to power a single rig.

Earlier this year, a cryptomine was found in a basement crawl space of a Massachusetts high school. It was powered by 11 computers that allegedly ran 24/7 over at least eight months.

The Department of Homeland Security investigated for three months, and a former employee who had been serving as assistant facilities director for the town, Nadeam Nahas, was accused of vandalizing the school and stealing at least $17,492 in electricity to operate the cryptomine.

According to Boston news station WHDH, police traced SKU numbers on ductwork that Nahas allegedly installed to keep the rig from overheating. Nahas reportedly got "nervous" when confronted with evidence allegedly showing that he purchased the materials from Home Depot, as well as his posts on the social platform formerly known as Twitter, which cops found indicated his strong interest in cryptocurrency.

Ars was not able to immediately determine the outcome in this case. Nahas resigned from his position in 2022 and, as of June 2023, has pleaded not guilty.

Channel Ars Technica