Security & verifying your download.
Abakos is fully open source. Here is how to check that what you downloaded is genuine — and why antivirus tools flag every mining app, including the well-known ones.
Why your antivirus may warn you.
The desktop app bundles the standard open-source miners (the XMRig and SRBMiner families). Many antivirus engines generically flag any mining software as “PUA / Coinminer” — a heuristic that hits every miner ever made, including the most trusted ones (XMRig, SRBMiner, lolMiner). It is not a statement that the file is malware.
Two things follow from this, and both are by design:
- The miner code is open. Everything the app runs is in the public repository — the miner integration, the payout engine and the chain. Nothing is hidden.
- You are always in control. Mining only runs when you start it, only on the hardware you choose, and stops when you close the app. 88% of the mined value is paid to you.
If your antivirus blocks the installer, allow-list the install folder, and only ever download Abakos from GitHub Releases or abakos.ai/download.
Check the file is genuine.
Every release lists SHA-256 checksums. Compare the hash of your download against the release notes — if they match, the file is bit-for-bit what we published.
Windows (PowerShell):
certutil -hashfile "Abakos.Provider_0.1.24_x64-setup.exe" SHA256
Current release (v0.1.24):
593205f57d6357a822a294054727339fc04ab1910231a8fe5287623261e1e540 setup.exe 1d27737a9563f3860e6e4e0dd84557542343c99052dee7663fb3cfe0ccfca111 en-US.msi
You can also scan the installer yourself on VirusTotal — expect the generic “coin miner” detections described above.
Signatures & updates.
In-app auto-updates are cryptographically signed: the app only installs an update whose signature matches the public key built into it, so a tampered download is rejected. Update signing has been live since the first release.
Windows Authenticode publisher signing (which removes the “unknown publisher” SmartScreen prompt) is being set up through the SignPath Foundation, which provides certificates to qualifying open-source projects at no cost. Until it lands you may see an “unknown publisher” prompt on first install — verify the checksum above and proceed. Note that publisher signing does not remove the generic antivirus coin-miner flag; nothing does, because it is inherent to bundling a miner.
Found a security issue?
The public sandbox intentionally runs real value rails as a proving ground, and meaningful findings are rewarded. Please report privately via GitHub private vulnerability reporting or info@abakos.ai (subject: SECURITY). See SECURITY.md.