I have been watching the top miner address on the Kryptex pool for a few days, and I want to share what I have seen with the community, as I believe it is relevant to Tari’s decentralization and worth being aware of. The live stats page is here, so anyone can verify the data:
First, some data
Tari has four independent PoW lanes. One of them, Tari RandomX, is the standalone mining lane, which is what Kryptex’s xtm-rx uses. According to block explorer data, this lane has only about 79 MH/s network-wide.
This top address, at full load, puts almost all of its hashrate (around 50 to 80 MH/s) on this single lane. In other words, most of the current network hashrate on the Tari RandomX lane comes from this one address. It essentially dominates the lane on its own.
Its payout history shows it has been running steadily for a long time. It has been paid roughly 113 million XTM in total, has produced 500,000 to 1,100,000 XTM per day over the past month, and shows one payout per hour without interruption. This is not short-term activity.
A few notable traits
1. It gives up merge mining. Tari’s Monero RandomX lane supports merge mining with Monero, which would let a miner earn Monero (instantly sellable) at the same time as XTM. But this address chooses to mine only Tari RandomX and forgoes the Monero. This suggests it is not after immediate revenue, but after maximizing the quantity of XTM itself.
2. Its worker profile looks more like a mining botnet than a normal operation. It has around 17,000 workers, but the online ratio is extremely low. When I observed it, it was often around 200 online and over 16,000 offline. The worker names are all random strings generated by XMRig’s default. Its hashrate follows a steady daily cycle over the week, swinging between about 75 MH/s and near zero, as if many devices come online and go offline with their owners’ daily routines.
To be clear: these traits point toward a botnet, but this is an inference from behavior patterns, not proof.
The core issue
Regardless of who is behind it, the fact is that the Tari RandomX lane is currently heavily dominated by a single source. For a network whose core narrative is decentralization, this is a reality worth taking seriously.
A balancing point
Tari’s four-lane design is itself a form of protection. Even if this one lane is dominated, it only accounts for part of the network’s block production. The other three lanes (SHA-3X, Monero RandomX, Cuckaroo C29) are still contributed by more distributed sources. So this does not mean the entire network is controlled by one person, only that one lane is overly concentrated.
Finally
As for why this address accumulates XTM, the pool data cannot tell, and given Mimblewimble’s privacy, on-chain tracking may not work either, so I will not speculate.
I am sharing this not to cause alarm, but because I believe honestly seeing the current state is the first step to paying attention to the problem. I welcome those with more technical knowledge to look at this data and correct my judgment.