Cryptomining Inside AI Containers: Why GPU Utilisation Looks Normal and No Alert Fires
For executives
Cryptomining inside GPU containers is the most financially immediate GPU infrastructure attack. An attacker who gains access to an organisation's GPU compute can run cryptocurrency mining software on hardware that costs hundreds of dollars per hour to operate. The organisation pays for the compute. The attacker takes the proceeds. The reason this happens without detection is architectural: GPU utilisation from a cryptomining workload and GPU utilisation from a legitimate AI training workload look identical to every monitoring tool that operates above the CUDA execution layer.
The economics
GPU compute is expensive. An NVIDIA H100 node rents for approximately $8-30 per hour depending on the provider and contract structure. At scale, across a cluster of hundreds of GPU nodes, illicit cryptomining represents significant financial theft. This is not a hypothetical risk. Cloud providers have documented cryptomining attacks as among the most frequently observed financially motivated attacks on cloud infrastructure.
Why traditional detection fails
GPU utilisation: a legitimate AI training run sustains near-100% GPU utilisation continuously. A cryptomining workload sustains near-100% GPU utilisation continuously. The utilisation metrics are identical.
Network connections: cryptocurrency mining communicates with mining pools, but that traffic is HTTPS and blends with normal outbound traffic. Many AI training workloads make outbound connections for model downloads, dataset streaming, and telemetry.
Binary and process signatures: a sophisticated attacker does not name their mining binary xmrig.exe. They embed the mining code in a process that appears to be a legitimate training framework component.
What CUDA-level telemetry reveals
Cryptomining and AI training differ significantly at the CUDA execution level.
CUDA kernel patterns: mining algorithms have highly regular, repetitive kernel execution patterns. An AI training workload has a sequence of different kernel types that follow a structured but varied pattern. The kernel sequence is detectable if CUDA context and kernel launch telemetry is available.
Memory allocation patterns: cryptomining algorithms have characteristic memory requirements with highly predictable access patterns. AI training workloads allocate large, variable model parameter tensors.
UVM behaviour: legitimate AI workloads using Unified Virtual Memory show specific patterns of allocation and eviction. A mining workload using UVM shows different patterns. The GPUBreach research documented that even a hardware-level attack has distinctive UVM event signatures that are detectable before the attack completes.