Mining you never see
Cloud mining scams examined by Ilia Zavialov: the dashboard, the rigs and the arithmetic
English version for the United States.
Cloud mining sells the most attractive thing in the field: income from equipment you never have to buy, house, cool or repair. The offer is a contract for the output of machines somebody else operates, and the buyer sees a dashboard where a balance grows every day. The difficulty is structural. Almost nothing in that arrangement can be verified by the person paying for it, and the one thing they can see is the one thing that costs nothing to fabricate. In December 2025 a regulator filed a case alleging that one such operation raised over 95.6 million dollars from roughly 6,400 investors while selling hosting agreements for far more mining rigs than it was actually running.
01What is actually being sold
There are two common shapes. A hosting agreement, where you are told a specific machine is yours and is running in a named facility, and a hashrate contract, where you buy a share of computing power with no machine attached to your name.
The second shape is harder to check and therefore more common in fraudulent versions. A share of an aggregate cannot be photographed, serial numbered or inspected, and disputes about it have no physical object at their center.
Both are sold on the same promise: passive income without the parts of mining that are inconvenient. No electricity contract, no noise, no heat, no hardware failures, no technical knowledge.
Legitimate operations of both kinds exist. That is precisely why the category works as a cover, and it is why the checks below are about verification rather than about whether the concept is real.
There is also a third shape that is rarely described honestly. Some offers are simply a deposit product with mining as the decoration: the money is never used to run any machine, and the word mining is present because it explains a return without requiring the operator to explain anything else.
02The dashboard is a web page
The balance that rises every day is a number rendered by the operator's own software. It is not a reading from a machine, it is not a blockchain record, and nothing outside the site confirms it.
Real mining output is verifiable. Payouts arrive on chain, from a pool, to an address you control, and anybody can inspect the transactions with a public explorer. If the earnings exist only as a figure inside an account on a website, the earnings have not been demonstrated.
This is why small early withdrawals are so often allowed. Paying out a fraction of what was deposited converts a suspicion into apparent proof, and it costs the operator a small portion of money they already hold.
The test that matters is whether you can withdraw the whole balance to an address you own, on demand, without a fee that must be paid in first. Everything else on the screen is decoration.
Photographs of a hall full of machines prove nothing either, and they are worth a reverse image search before anything else. Images of real facilities circulate freely, and the same hall appears on the sites of operations that have no connection to each other or to the building.
| The promise | What it actually means | How to check it |
|---|---|---|
| Passive income, no hardware | You own a contract, not a machine | Ask which serial number is yours |
| A dashboard showing daily earnings | A number rendered by their software | Withdraw the full balance to your own address |
| A fixed daily percentage | A company promise, not mining output | Mining income moves with price and difficulty |
| Thousands of rigs in our facility | A claim with a power requirement | Name the address and check the power supply |
| Rewards paid from the pool | Verifiable if true | Ask which pool, then look for the transactions |
| Referral bonus for friends | Revenue coming from deposits | A network does not pay for recruitment |
| Lock your funds for a higher tier | Slowing the outflow | Read the withdrawal terms before depositing |
| Pay a fee to release the withdrawal | The clearest marker in the category | A real operator deducts from the balance |
03What a regulator found when it looked
On 17 December 2025 the Securities and Exchange Commission filed a case against Danh C. Vo and VBit Technologies Corp. The filing alleges the operation raised over 95.6 million dollars from approximately 6,400 investors through bitcoin mining hosting agreements.
The central allegation is the one that matters for anybody holding a similar contract. According to the filing, hosting agreements were sold for far more mining rigs than the company was actually operating, which means the contract described equipment that did not exist in the quantity sold.
The filing also alleges that 48.5 million dollars of investor funds were misappropriated and that large sums were used for gambling and gifts to family members before the defendant left the country.
This is an allegation in a public case rather than a finding of guilt, and it should be read that way. What makes it useful is the shape it describes, because that shape is repeated: a real company, real contracts, a working dashboard and a gap between the machines sold and the machines running.
04The arithmetic anybody can do
Mining revenue is not mysterious. It is determined by the machine's hash rate, the current network difficulty, the block reward, the price of the coin and the cost of electricity. Every one of those is published.
So a promised return can be checked against reality before any money moves. Take the machine model the contract names, find its hash rate, and calculate what it produces at today's difficulty and price. Then subtract the electricity the contract says you are paying for.
A promise that survives falling prices is the strongest signal available. Mining income falls when the coin falls and when difficulty rises, so a contract offering a fixed daily percentage regardless of either is not describing mining at all.
Difficulty rises over time by design. A projection that assumes today's difficulty for a two year contract is overstating the result even if everything else about the operation is honest.
If the arithmetic only works at a coin price well above the current one, the offer is a bet on price wearing the clothes of an income product, and it should be judged as a bet.
05Staking and fixed yield
The same structure appears with staking. Genuine staking produces a variable reward set by a protocol, published openly, and it changes with participation and network conditions.
A fixed percentage paid daily or weekly is therefore a promise by a company rather than an output of a protocol. That is not automatically fraudulent, and it does mean the risk is the company, not the network.
Once the return is a company promise, the questions are ordinary financial ones. Where does the money come from when the protocol pays less than the promise, who is liable if it stops, and what happens to the principal in that case.
A structure that pays earlier participants from the deposits of later ones can run for a long time while the deposits grow. It fails when they stop growing, which is why these operations expand aggressively and offer referral commissions.
06What can be checked before paying
The company: a registration number verified in the register that supposedly issued it, the named directors, the age of the entity and whether it holds any license it claims. A number that belongs to a different company answers the question by itself.
The facility: a named address, verifiable on a map, with a power capacity that makes sense. Mining consumes serious electricity, and a facility claiming thousands of machines in a location that cannot supply them is describing something that is not there.
The machines: a model, a serial number and, for a hosting agreement, a specific unit tied to your contract. Vague references to our fleet are the part that turns into a dispute with nothing at its center.
The payouts: whether rewards arrive from a mining pool to an address you control, and whether the pool is named. Payouts that exist only as an internal balance are the configuration described in the case above.
The exit: the withdrawal terms in writing, including minimums, delays and any fee. A fee payable before a withdrawal is released is the single clearest marker in this entire category.
07Signals that it is a pyramid rather than a fleet
A referral commission for bringing other people. Mining revenue comes from a network, and a network does not pay more because a customer recruited a friend. A structure that does is paying from deposits.
Tiers and lock periods. Higher returns for larger amounts and penalties for early withdrawal both exist to slow the outflow, which is only necessary when the outflow is the threat.
Marketing that emphasises the passive income rather than the operation. Real operators talk about power costs, uptime, hardware generations and pool fees, because those are the things that decide whether they survive.
A story that changes when the coin price falls. An honest operation reports lower revenue. A structure that reports the same return through a downturn is reporting a policy rather than a result.
Pressure to reinvest rather than withdraw. Bonuses for compounding, tiers that reset if funds are taken out and support staff who treat a withdrawal request as something to be talked out of are all mechanisms for keeping money inside a structure that cannot afford to release it.
08If money is already in
Attempt a full withdrawal to an address you control, and treat any fee demanded before release as the answer rather than an obstacle. Do not pay it.
Export everything now: the contract as it reads today, the dashboard, the payout history, every message and the terms page. Operations of this kind rewrite their terms and their help pages quickly.
Report to the financial regulator in the country where the company claims to be registered, and to the police. Cases against operations of this size are assembled from many individual reports.
Expect a follow up offer to recover the funds for an advance payment. People who have just lost money on a contract of this type are on exactly the list those operations buy.
09Questions and answers
Is cloud mining always a scam?
No, and that is what makes it usable as a cover. Legitimate hosting and hashrate contracts exist. The difficulty is that almost nothing in the arrangement can be verified by the buyer, so the checks have to be done before paying rather than after.
My dashboard shows earnings every day. Does that prove it is working?
No. The dashboard is a page produced by the operator's software. Real mining output arrives on chain from a named pool to an address you control, and that is the only version of earnings anybody outside the company can confirm.
They paid out my first withdrawal. Is that reassuring?
Only slightly. Paying back a small fraction of what is already on deposit is the cheapest way to convert doubt into apparent proof. The meaningful test is a full withdrawal on demand with no fee required in advance.
What did the regulator actually allege in the VBit case?
In a filing dated 17 December 2025 it alleged that over 95.6 million dollars was raised from approximately 6,400 investors, that hosting agreements were sold for far more rigs than were actually operating, and that 48.5 million dollars of investor funds were misappropriated. It is an allegation in a public case, not a verdict.
Is a fixed daily return possible in mining?
Not from mining itself. Revenue moves with the coin price and the network difficulty, both of which change constantly. A fixed daily figure is a promise made by a company, which means the risk being taken is the company rather than the network.
What is the single most useful check?
Ask for the pool the rewards are paid from and the address they are paid to, then look for the transactions yourself in a public explorer. Genuine output is visible outside the company's own website.
Written by Ilia Zavialov, digital security consultant. Profile of Ilia Zavialov
10Read next
- Ilia Zavialov Explains How a Crypto Transfer Actually Works, Step by Step How crypto works
- Ilia Zavialov Explains the Types of Crypto Scams and How Each One Is Built Scam types
- Ilia Zavialov on the Crypto Wallet Protections That Hold After a Breach Protection
- Ilia Zavialov on the First Hours After a Crypto Theft: What Actually Helps Incident
- Where Fraud Losses Actually Go: Ilia Zavialov Reads the 2025 Numbers In numbers
- Ilia Zavialov fraud: how one photograph becomes the face of an advert nobody filmed A face from one photo
- Ilia Zavialov on crypto exchange scams: how the operation is built and what litigation achieves How exchange scams are built
- Ilia Zavialov on the fee to unlock a withdrawal and what a real exchange delay looks like Blocked withdrawals
- Services that promise to recover lost crypto: Ilia Zavialov on how the offer is built and why refunds never arrive Crypto recovery
- Ilia Zavialov on crypto investment scams: the long con taken apart stage by stage The long investment con
- Ilia Zavialov on passkeys: why a stolen password stops being worth anything Signing in without a password
- Ilia Zavialov on the seed phrase and the fake wallet support desk Seed phrases
- Checking a wallet address before you send: the checks Ilia Zavialov runs first Wallet checks
- Ilia Zavialov Explains How an Approval Drainer Empties a Wallet Wallet drainers