Gaming Company to Pay $1 Million for Secretly Using Customer Computers for Bitcoin Mining

The New Jersey Attorney General’s office said on Tuesday (19th November) that it had reached a $1m settlement with New York-based gaming company E-Sports Entertainment, which admitted in April this year that it had experimented with injecting bitcoin mining code into its users’ computers.

Named in the settlement order as being responsible for the malicious code were E-Sports' co-founder Eric Thunberg and software engineer Sean Hunczak, whose programming efforts reportedly allowed E-Sports employees "full administrative access to users’ computers" and allowed access to files, screen captures, mouse movements and monitor activity.

The software, which cost users $6.95 a month to use, watched their activity to see when they were active and what software they were using to take advantage of lulls in their GPU usage and mine for bitcoins.

During a two-week period back in April, the company reportedly mined a total of 29 bitcoins, (currently valued at around $15,000) which they subsequently donated to the American Cancer Charity; a sum around the order of $4,000 at the time.

In addition, the settlement order claims that, in at least some of the instances, "ESEA employers used the software to copy files from ESEA end-users’ computers" with the Attorney General adding:

"The company violated state consumer and computer abuse laws by putting malware on users’ computers, spying on them, and accessing their computers without their knowledge with the mining code."

The issue was first spotted by ScRaPPyCoCo on a thread on E-Sport's website, with their first response to the controversy appearing on 1st May, reading:

"With the whole fervor around bitcoin, we did conduct some internal tests with the client on only two of our own, consenting administrators’ accounts to see how the mining process worked and determine whether it was a feature that we might want to add in the future. We thought this might be an exciting new tool that we could provide to our community. Ultimately, we decided that it was not."

They went on to claim that they had killed the project, but discovered that "an employee who was involved in the test" had been using the test code for his own personal gain since 13th April.

E-Sports is required to pay the New Jersey state $325,000 of its $1 million settlement obligation whilst the remainder is suspended for 10 years, and will be vacated in the event that company abides fully by the settlement terms and avoids any future legal violations.