Stratum V2 Security: How Noise Stops Hashrate Theft

Published July 24, 2026, 07:00 UTC

The strongest argument for Stratum V2 is not speed, it is security. Plaintext Stratum V1 leaves your mining connection open to snooping and, more seriously, to outright hashrate theft. This guide explains exactly how V2 closes those holes: the Noise handshake, the cipher doing the work, and the authority key that proves you reached the real pool.

The V1 threat model: postcards, not envelopes

A Stratum V1 session is like mailing postcards. Every message, your payout address, worker names, jobs, and shares, is readable by anyone who handles it: a compromised router, a hostile Wi-Fi network, an ISP, or anyone who has inserted themselves on the path. Two distinct attacks follow:

Passive eavesdropping. An observer learns your payout address, your worker layout, and how much hashrate you run. That is a privacy leak that maps your whole operation.
Active hijacking. Far worse, because nothing authenticates the pool, an attacker in the middle can rewrite the session and redirect your accepted shares to their own account. Your miner reports healthy, accepted shares the whole time, while the rewards flow to a stranger. Plaintext hashrate hijacking is not theoretical; it has been shown in the wild more than once.

The Noise handshake: sealing the channel

Stratum V2 runs every session inside the Noise protocol framework, the same well-audited cryptography that secures WireGuard. When your miner or proxy connects, the two sides perform an authenticated key exchange: they agree on fresh session keys that only they know, using ephemeral keys, which help protect past sessions even if a long-term key is later compromised.

Once the handshake completes, all traffic is encrypted with ChaCha20-Poly1305, an authenticated cipher. ChaCha20 provides confidentiality so nobody can read the stream, and Poly1305 provides integrity so any tampering is detected and the connection drops. Together they turn the postcard into a sealed, tamper-evident envelope.

The authority key: proving the pool is real

Encryption alone is not enough; you also need to know you are talking to the genuine pool. Stratum V2 solves this with an authority key pair. The pool keeps the private key secret and publishes the public half. Your miner pins that public key in its configuration, and during the handshake the pool cryptographically proves it possesses the matching private key. An impersonator without that private key simply cannot complete the handshake.

mkpool's authority public key, the same across every chain, is:

9c9aZWzETaiJyqGGUSCn8GqFgTpxs96ert4d4jGeRnvxqRqhZar

It is also printed on every connect page. Pin it in your miner or translation proxy, and impersonation stops being something you have to watch for and becomes something that is mathematically impossible.

What this defeats, concretely

Attack	Plain V1	Stratum V2
Read your address and workers	Possible	Blocked (encrypted)
Tamper with jobs or shares	Possible	Blocked (Poly1305)
Impersonate the pool and steal hashrate	Possible	Blocked (authority key)

The cost: essentially nothing

People sometimes assume encryption is expensive. It is not, here. The Noise handshake runs once per connection, and ChaCha20-Poly1305 was designed to be fast in software, even on devices without hardware crypto acceleration. Encrypting the thin trickle of jobs and shares is trivial for any machine capable of running mining firmware. There is no meaningful performance argument for staying on plaintext.

Getting the security today

If your firmware speaks V2, point it at your chain's SV2 port and pin the key above. If it does not, you have two solid options: run an SV2 translation proxy for the full protocol, or use Stratum over TLS for encryption in a single settings change. Either beats mining in the clear. For how V1 and V2 differ across every dimension, see Stratum V1 vs V2.

Frequently asked questions

How does Stratum V2 encrypt the connection?

Stratum V2 uses the Noise protocol framework to perform an authenticated key exchange, then encrypts all traffic with ChaCha20-Poly1305, an authenticated cipher that provides both confidentiality and tamper detection. It is the same cryptographic family used by WireGuard, and it is fast even on low-power mining hardware.

What is an authority key in Stratum V2?

An authority key is a public key the pool publishes and the miner pins in its configuration. During the Noise handshake the pool proves it holds the matching private key, so your miner knows it reached the genuine pool and not an impersonator. mkpool publishes its authority key on every connect page.

Can hashrate really be stolen on Stratum V1?

Yes. Because V1 is plaintext and unauthenticated, an active attacker between you and the pool can rewrite the session and point your accepted shares at their own payout account. You would see normal-looking activity while mining for a stranger. This has been demonstrated repeatedly, which is a core reason V2 exists.

Does encryption slow mining down?

No meaningfully. The Noise handshake happens once per connection, and ChaCha20-Poly1305 is extremely fast; encrypting the small stream of jobs and shares is trivial work for anything that can run mining firmware. In exchange you get confidentiality, integrity, and pool authentication.

Is Stratum V2 more secure than V1 over TLS?

They overlap but V2 goes further. TLS gives V1 encryption and, with certificates, server authentication. Stratum V2 bakes in encryption plus a pinned authority key and also redesigns the message format. If you cannot run V2 yet, V1 over TLS is a strong interim step that closes the biggest holes.

Newsletter

Mining insights in your inbox

New guides, hardware reviews, and pool updates. No spam, unsubscribe anytime.

Comments

Loading comments...

Keep reading

GuidesStratum V2Bitcoin8 min read

Bitaxe on Stratum V2: Encrypted Solo Mining Setup

How to run a Bitaxe over Stratum V2 on mkpool: use a translation proxy for encrypted, hijack-proof solo mining today, with the exact endpoint, port and authority key.

Mecanik1337

2026-07-23

GuidesStratum V2Bitcoin8 min read

Stratum V1 vs V2: Every Difference That Matters

Stratum V1 vs V2 compared point by point: encryption, pool authentication, binary vs JSON, bandwidth, stale shares, job declaration, and which one to run in 2026.

Mecanik1337

2026-07-23

← back to all articles

Stratum V2 Security: How Noise Stops Hashrate Theft

The V1 threat model: postcards, not envelopes

The Noise handshake: sealing the channel

The authority key: proving the pool is real

What this defeats, concretely

The cost: essentially nothing

Getting the security today

Frequently asked questions

How does Stratum V2 encrypt the connection?

What is an authority key in Stratum V2?

Can hashrate really be stolen on Stratum V1?

Does encryption slow mining down?

Is Stratum V2 more secure than V1 over TLS?

Mining insights in your inbox

Comments

Leave a comment

Keep reading

Bitaxe on Stratum V2: Encrypted Solo Mining Setup

Stratum V1 vs V2: Every Difference That Matters

We value your privacy

The V1 threat model: postcards, not envelopes

The Noise handshake: sealing the channel

The authority key: proving the pool is real

What this defeats, concretely

The cost: essentially nothing

Getting the security today

Comments

Leave a comment