NiceHash
Last changed 2026-10-10 · Score recalculated — Rescored under Scoring v2, the published formula (avoid.net/scoring): 42 → 62. Problems weighed by who is responsible: incidents the subject suffered −20, problems around the subject, caused by others −3.4; legitimacy credit long-running +10; fact-check adjustments (−10) now shown as page reliability, not in the score. Version history →
Why this score
| Every page starts at | 65 |
| Incidents it suffered (e.g. hacks) | -20 |
| Problems around it, caused by others | -3.4 |
| Long-running | +10 |
| Sum | 52 |
Score: 62/100 (kept between 0 and 100)
How scoring works →Summary
NiceHash is a Slovenian cryptocurrency mining marketplace founded in 2014 that allows users to buy and sell hashing power. In December 2017 the platform suffered one of the largest crypto exchange hacks of that year, with attackers stealing approximately 4,736 BTC (valued at roughly $64 million at the time) after compromising an employee's computer through a spear-phishing attack. The breach was subsequently attributed to North Korea's Lazarus Group, and NiceHash completed a full user repayment program in December 2020 after a three-year effort funded from operational revenue.
Connected Entities
3 entities · 60 linked investigations- NiceHash→mentioned with→North Korea Lazarus Group — H1 2026 Systematic Crypto Theft Campaign(80%)
- NiceHash→mentioned with→Bitcoin(80%)
Connected Through
3 shared actors · 525 investigationsDistinct actors this investigation shares with others — holders, traders, and named parties. Shared infrastructure (exchanges, pools) is excluded.
- ♦Bitcointoken
- □North Korea Lazarus Group — H1 2026 Systematic Crypto Theft Campaignorganization
- □NiceHashorganizationalso in
Timeline(11 events)
2014
NiceHash founded in Ljubljana, Slovenia by Marko Kobal and Matjaz Skorjanc as a hashpower marketplace.
NiceHash Wikipedia6 December 2017
Attackers compromise a NiceHash engineer's computer via spear-phishing, gain access to the payment system, and drain approximately 4,736 BTC (approximately $64 million). NiceHash suspends all operations.
TechCrunch7 December 2017
NiceHash confirms the breach publicly. CEO Marko Kobal states that a compromised company computer was the entry point. Major news outlets report stolen amount ranging from $60 million to over $70 million.
CNBC21 December 2017
CEO Marko Kobal resigns. NiceHash relaunches its platform with redesigned payment infrastructure and enhanced security protocols.
Finance Magnates2 February 2018
NiceHash launches its formal Repayment Program, making an initial disbursement of 10% of owed balances to affected users, funded from platform fees.
CryptoNinjas2 July 2018
NiceHash announces that more than 55% of stolen funds have been returned to affected users through the Repayment Program.
CryptoNinjas18 December 2019
NiceHash pauses the Repayment Program after reaching 82% of total reimbursements, citing financial constraints and the need to maintain operational solvency.
Crypto Briefing2019
Matjaz Skorjanc (NiceHash co-founder) arrested in Germany on a U.S. extradition request related to pre-NiceHash Mariposa botnet and Darkode cybercrime forum charges.
Infosecurity Magazine2020
Skorjanc released after Germany and Slovenia both reject U.S. extradition request, citing double jeopardy protections.
NiceHash Wikipedia16 December 2020
NiceHash completes the final installment of its Repayment Program, returning all affected user balances to 100% of pre-breach levels — approximately three years after the original hack.
CoinGeek17 February 2021
The U.S. Department of Justice unseals an indictment charging three North Korean nationals (Jon Chang Hyok, Kim Il, Park Jin Hyok) as Lazarus Group members for a broad range of cyberattacks including the December 2017 theft of approximately $75 million from a Slovenian cryptocurrency company consistent with NiceHash.
U.S. Department of JusticeDecision Log
- slot 455367302 · hash 4SV7neEoCP9v4dPBwDXmspZDyWFKYvS47SQDUvoqEXp1
- slot 425424936 · hash 2NXjsacrq9xZ7pf6BfuGuA5CrR3pxaeyi9xjLh3k6sZX
- slot 425424933 · hash fNt5PVeoyT3S6krWZj7zSnjqjyHUh4g8p7H2cQgjkSX
- slot 423161153 · hash 8GBk82VGYSGmuDgvfQruXkFphxeEivJFBw92WRaTtPcg
This investigation is cryptographically anchored to the Solana blockchain (4 decisions). 18 of 18 cited source URLs have an Internet Archive snapshot.
model: claude-sonnet-4-5
generated: 5/30/2026, 12:59:37 PM
last updated: 10/10/2026, 6:47:27 PM
3 viewsavoid.net — verified advice for a post-truth world