If you’ve never thought about whether your miner’s connection to its pool is encrypted, you’re not unusual. Stratum V1, still the most widely deployed mining protocol, sends everything in plaintext by design, and most of the industry has simply treated that as normal for over a decade. It’s worth asking what that plaintext default actually exposes.
What an unencrypted connection reveals
A plaintext Stratum connection exposes your worker names, your submitted shares, and the job data you’re working on, to anyone positioned to observe the traffic: a compromised router, a malicious actor on a shared or public network, a hosting provider with access to their own infrastructure, or an ISP under legal or commercial pressure to inspect traffic. None of that data is directly your Bitcoin holdings. But worker identification and mining activity patterns are still information you likely didn’t intend to broadcast to anyone who happens to be listening.
What an unencrypted connection allows, which is worse
Observation is one risk. Tampering is the sharper one. Without authentication and encryption, a party positioned between your miner and the pool can potentially intercept and modify the job before it reaches your hardware, or intercept and alter your submitted shares before they reach the pool. Neither of these requires the pool itself to do anything wrong. The vulnerability sits in the transport, not in either endpoint’s honesty.
How Stratum V2 addresses this
Stratum V2 runs over an authenticated, encrypted transport using a Noise protocol handshake by default, with the pool’s identity pinned to a known authority key the miner can verify. This is the same category of protection HTTPS gives web traffic, applied to a protocol that’s gone without it for over a decade. It doesn’t make your hardware find blocks faster. It makes the channel your hardware communicates over resistant to a specific, real class of interference that plaintext Stratum has simply never protected against.
Why authority-key pinning specifically matters
Encryption alone isn’t enough if the miner has no way to verify who it’s actually encrypting the connection with. Authority-key pinning means the miner’s firmware can check the pool’s identity against a known, published key, closing the door on an impersonation attempt that presents valid- looking encryption but isn’t actually the pool you intended to connect to. This detail is easy to skip in an implementation and easy to miss when evaluating one, which is exactly why it’s worth asking about directly rather than assuming “encrypted” covers it.
What this doesn’t protect against
Encrypting the connection protects the data in transit between your rig and the pool. It says nothing about what the pool does with your data once received, what it discloses in its terms, or whether its payout mechanism is custodial. Those are separate questions, worth their own scrutiny, and encryption on the wire doesn’t answer any of them.
A comparison worth making explicit
Web traffic went through this exact transition decades ago: plaintext HTTP was the default for years before HTTPS became the expectation, and the shift happened only once enough of the industry treated plaintext as a liability rather than a convenience. Stratum is roughly where HTTP was before that shift. Encrypted V2 connections existing as an option doesn’t finish the transition. Widespread adoption, on both the pool and firmware side, is what actually would.
NexusPool’s Stratum V2 connections run encrypted by default with authority-key pinning, on hardware that supports it, alongside plaintext V1 for older firmware. How that default posture compares to typical unencrypted stratum setups is broken down in NexusPool’s notes on its stratum encryption defaults. Free, non-custodial software, and no transport-layer protection changes the odds of finding a block, which the network’s difficulty alone sets.
Trust nothing. Verify the connection is encrypted, and verify who it’s encrypted with.
About NexusPool: NexusPool is free, non-custodial mining software that encrypts Stratum V2 connections with authority-key pinning by default, on hardware that supports it, while keeping plaintext V1 available for older gear. The setup is documented further on NexusPool’s stratum documentation.
