Cryptocurrency mining malware took over from ransomware and other forms of malware last year as the top scourge of the internet. It comes as no surprise that Monero is still the coin of choice for crypto criminals looking to pilfer resources from the unsuspecting masses.

According to a new study from Universidad Carlos III de Madrid and King’s College London, cyber criminals have used malware to mine 4.3% of the entire supply of XMR. “Our profit analysis reveals campaigns with multi-million earnings, associating over 4.3% of Monero with illicit mining,” the report claimed.

The two researchers who conducted the study could not ascertain what proportion of this Monero has already been cashed out. They did put a figure on it though which is no small sum;

“Although this depends on when criminals cash-out their earnings, we estimate that the total revenue accounts for nearly $57M USD. These measurements exceed (and complement) estimations from parallel work focused on browser-based cryptojacking,”

The pair analyzed around 4.4 million malware samples over a 12 year period beginning in 2007 and identified over a million malware crypto miners. The paper cited a relatively low cost and high return as being the primary success of illicit crypto mining. It added that there was a lower threat to users and that antivirus companies have paid little attention.

It added that regular changes in the proof of work algorithms could discourage criminals due to the constant need to upgrade mining software. The study revealed that a common approach to disseminating the malicious software was to use legitimate infrastructure such as Dropbox or Github. Rogue mining tools and online services were also prevalent.

Bitcoin came in as the second most popular cryptocurrency to mine illegitimately but its popularity has declined over the past three years, due to an increase in hashrate and difficulty. Additionally mining Bitcoin on home computers is no longer viable so criminals switched to ASIC resistant coins such as XMR and BCN. Zcash came in third but it had a fraction of the total compared to Monero and Bitcoin. The Monero community has tried to tackle the problem but to little avail.

Last year alone saw a 4000 percent increase in mining malware with the majority flowing into Monero. Even in the midst of a long bear market illicit crypto mining and browser hijacking is still evolving to evade detection and botnets are primed to take off again. Monero may be down 88% from its ATH but that has not deterred cyber criminals one bit.