Takeover of Monero disrupted by alleged DDoS attack on Qubic mining pool

Update (Aug. 4, 2025, at 1:50 pm UTC): This article has been updated to add commentary by XMRig developer Sergei Chernykh.

A mining pool behind an attempted 51% takeover of Monero is reportedly under a distributed denial-of-service (DDoS) attack, disrupting the effectiveness of its attempt.

In a Sunday X post, Sergey Ivancheglo, who claims responsibility for the takeover attempt, said the Qubic mining pool he controls is under a DDoS attack. He added that the attack resulted in the mining pool’s hashrate falling from 2.6 gigahashes per second down to 0.8 GH/s.

One user questioned whether a DDoS is a sustainable response to the attempt on Monero, and asked Ivancheglo for an estimate of its cost. Ivancheglo said it has no cost due to presumed control over the Monero-mining malware network by the attackers. “Zero cost, if you already have a botnet to mine Monero. So we are building protection assuming they can do it indefinitely,“ he said.

A DDoS attack floods a target with traffic from multiple sources, overwhelming it and making it inaccessible. Those attacks are often conducted through malware-controlled infected computer networks called botnets.

Related: Monero likely pumped 50% due to suspected $330M Bitcoin theft: ZachXBT

Unlikely that Qubic mining pool under DDoS attack

On Monday, Ivancheglo said in another X post that “Qubic is under DDoS attack from Monero” and added that the DDoS attack had lasted six hours. He also said his team had implemented protections to mitigate the disruption.

“Let’s see what those desperate guys will manage to break this time,” he said.

Cointelegraph verified that direct queries to the Qubic mining pool returned an average response time of 0.188 seconds across three endpoints, with no dropped requests. Considering that traffic was routed through a virtual private network server, this falls within normal operational limits and does not suggest an ongoing DDoS attack.

Cointelegraph’s investigation concluded that the pool operated normally at the time of writing. Still, the investigation cannot prove whether a successful DDoS attack was previously performed.

MiningPoolStats data shows Qubic as the last mining pool with no hashrate, after it stopped reporting its hashrate on July 30. Still, Qubic’s hashrate tracking service claims that its intermittent mining sees peaks at 1.6 GH/s when the network’s intermittent mining operation switches to Monero (XMR).

XMRig developer accused of coordinating DDoS

Ivancheglo shared his suspicions that the developer of Monero mining software XMRig Sergei Chernykh had “orchestrated the [DDoS] attacks.”

In a screenshot of a Reddit comment verified by Cointelegraph, Chernykh talked about a “solution” when responding to a user comment referring to threats posed by actors in the illegal market who depend on Monero for anonymous transactions.

In a statement to Cointelegraph, Chernykh said that his publicly discussed plans cryptically suggested a legal solution. This can also be seen in the full comment shown in the screenshots above, where he wrote, “I have a solution (even a fully legal solution) for them.” He highlighted that he has yet to see proof of a DDoS attack even taking place and added:

“I’m not behind any DDoS attempts which allegedly happened.”

Monero is known for its privacy-first feature set and strong focus on anonymity. Due to its emphasis on anonymity, it is reputed to be used as a currency to pay for illegal goods and services on the so-called deep web and is reportedly accepted by nearly half of all black markets.

In other screenshots from what appears to be Discord and could not be verified by Cointelegraph, Chernykh purportedly discusses the upcoming start of a response effort to Qubic’s ongoing takeover attempt against Monero. He is also the author of the top comment on the now-deleted Reddit post with the title “Praise that XMRig dev:”

“He blaimed the alleged DDoS attack on me, which is a defamation, because I didn’t do it. It’s not like I’m the only person in the Monero community who is not happy with what they’re trying to do. But I would never resort to illegal methods like DDoS. Other people might.”

Chernykh hinted at other, fully legal, countermeasures that he is working on. He claimed to have deliberately kept his posts vague or even misleading to avoid revealing his countermeasures.

The XMRig developer added that DDoS attacks are not legal in most or all jurisdictions and were never considered by him. He admitted that he cannot speak for others in the community, adding:

“If my posts ‘encouraged’ someone, it was not my intention.“

Related: Japanese authorities trace Monero, arrest 18 in $670K laundering case

Monero network faces takeover threat

As Cointelegraph previously reported, the Qubic network is using its hashrate and economic incentives to attempt a network takeover of Monero. After seeing its Monero mining pool quickly rise to become the largest, Qubic saw its market share decline soon after the community became aware of the openly disclosed plan to take over the network.

The Monero mined by Qubic is used to fund token burns and buybacks for the Qubic ecosystem, where miners are paid in Qubic tokens. According to the project, mining Qubic is currently more profitable than mining Monero.

Ivancheglo, who also founded crypto projects NXT and Iota, has openly admitted that his operation was attempting a takeover of the Monero network. In an X post, he said that after getting control of most of the network’s hashrate, his pool would reject blocks mined by other pools, effectively centralizing the network into a single pool.

Chernykh said Monero should redirect hashrate to P2Pool or a small mining pool. He said that “having two or three pools controlling the majority of hashrate has been a long-term problem for Monero.”

Monero’s P2Pool is a decentralized mining pool that allows miners to collaborate without relying on a central server. It has no operator and no single point of failure, with each miner running a full node.

Magazine: Coinbase hack shows the law probably won’t protect you: Here’s why