NORTON▊
- ENTITY
- Gen Digital Inc. (then NortonLifeLock) — the antivirus your dad's PC came with FACT
- OPERATION
- "Norton Crypto" — an Ethereum miner shipped inside Norton 360, announced June 2021, rolled out broadly by January 2022 FACT
- EVENT
- The antivirus started installing a cryptominer — activation opt-in, presence not FACT
- THE CUT
- "Our fee is currently 15% of the crypto allocated to you" — the company's own terms of service SELF-PUBLISHED
- DISPOSITION
- MINING DISABLED — after Ethereum's Sept 2022 move to proof-of-stake killed GPU mining; per Norton, "disabled… while we evaluate alternatives"
Here is the guard dog — the animal paid to keep cryptominers off your machine — observed installing one itself, taking a 15% cut of what it dug up, and growling at anyone who tried to remove it.
Official channel: @Norton on X — the handle linked from us.norton.com. FACT
On the record, first-party: the fee — “Our fee is currently 15% of the crypto allocated to you” (Norton Crypto Terms of Service). And the ending — “Ethereum has changed how it can be mined. GPU mining is no longer possible. As a result, we have disabled our mining feature while we evaluate alternatives” (Norton support). SELF-PUBLISHED
Nothing in this file is secret, illegal, or even — strictly — broken. That is what makes it worth keeping. An antivirus vendor looked at its quarter-billion-endpoint install base and saw a mining fleet with a subscription attached. The feature was opt-in, disclosed, and documented; the outrage was about what it revealed, not what it hid.
The archive marks the taxonomy problem: when the security product and the resource-consuming coin miner are the same executable, every definition the industry uses for "potentially unwanted program" gets awkward. Every claim carries its receipt; the defense gets equal time.
the drama timeline
ACT I — THE GUARD DOG LEARNS TO DIG (JUN 2021)
Crypto is at all-time highs. Somewhere in a product-planning meeting, the line between "we block miners" and "we are the miner" gets moved.
-
JUN 2021
Norton Crypto announced
NortonLifeLock announces Norton 360 will let users mine Ethereum from inside the antivirus — pitched as a safe alternative to shady miners that "sacrifice their security" by disabling protection. Early-adopter rollout begins; the terms of service establish the company's cut: 15% of mined crypto, plus the usual pool and gas costs borne by the user.
ACT II — THE INTERNET NOTICES (JAN 2022)
The broad rollout lands the miner on ordinary machines, and the reaction writes itself: why is my antivirus mining crypto, and why can't I delete it?
-
JAN 2022
"Norton 360 Now Comes With a Cryptominer"
Krebs on Security reports the miner is now present on Norton 360 installs by default — mining off until a user opts in, but NCrypt.exe delivered regardless — and quotes Norton's FAQ conceding that removing the binary means disabling Norton's own tamper protection first. Users and commentators object loudly; PCMag headlines the "hard-to-delete" miner irking Norton 360 users.
The tamper protection worked perfectly. That was the complaint.
-
JAN 2022
Norton answers; the economics get audited
Norton's position, as carried in the coverage: Norton Crypto is opt-in only, mining never starts without user consent, and users can disable it; the tamper protection that guards NCrypt.exe is the same protection that guards the rest of the suite from malware. Critics' arithmetic, per The Verge's roundup: after the 15% cut, pool fees, Ethereum gas fees, and the user's own electricity bill, small-rig mining margins thin toward zero — the house takes its cut either way.
-
JAN 2022
The sibling: Avira, 500 million users
Krebs reports Avira — acquired into the same corporate family — ships "Avira Crypto" to its roughly 500-million-user base on the same opt-in model. The miner-in-the-antivirus is not an experiment; it is a product line.
ACT III — THE MERGE ENDS THE ARGUMENT (SEP 2022)
No regulator, no lawsuit, no recall. What kills the feature is Ethereum itself.
-
SEP 2022
Proof-of-stake; the shovels go quiet
Ethereum's Merge ends proof-of-work mining. Norton's own support page closes the book: "Ethereum has changed how it can be mined. GPU mining is no longer possible. As a result, we have disabled our mining feature while we evaluate alternatives." Balances remain transferable from the Norton Wallet to Coinbase.
The feature was retired by the blockchain, not by the backlash. The archive notes which one moved first.
both sides, on the record
The security product became the payload. An antivirus quietly delivering a mining binary onto customer machines — conduct the same industry classifies as "potentially unwanted" when anyone else does it [1] [3].
The house took 15% of customers' mined crypto, on top of pool fees, gas fees, and the customer's own electricity — terms in the company's own ToS [2].
Removal required disarming the guard. Deleting NCrypt.exe meant switching off Norton's tamper protection — the antivirus defended the miner [1] [5].
Opt-in, disclosed, documented. Mining never ran without the user turning it on; the feature, the fee, and the wallet mechanics were published in plain terms of service, not buried [2] [4].
The safety pitch was coherent: hobbyist miners routinely disable antivirus and run unvetted binaries from forums; a miner inside the security suite, guarded by tamper protection, is arguably the safer configuration — the same mechanism critics called "hard to delete" is the suite's standard malware defense [1] [4].
No adjudication exists. No regulator acted, no court found any wrongdoing, and when Ethereum ended GPU mining the company disabled the feature and left users their balances [6].
YOU DECIDE
Scoped to the claims. That Norton 360 shipped a cryptominer, took 15%, and sheltered the binary behind its own tamper protection is documented — most of it in the company's own paperwork. That this was wrong is an opinion; Norton's opt-in defense is real, and nothing here was ever adjudicated anywhere.
Weigh the costly signal: the company was willing to spend the one asset an antivirus vendor lives on — the presumption that everything it installs is there to protect you — for a 15% cut of hobbyist Ethereum. The feature died when the coin changed; the precedent is still installed.
The archive does not judge. It keeps the terms of service.
evidence locker
PRIMARY & INVESTIGATIVE
SUBJECT'S OWN CHANNELS
@Norton on X SELF-PUBLISHED — the official handle, linked from us.norton.com.
x.com/norton
The standard. The feature, the fee, and the shutdown are sourced to the company's own terms of service and support pages; the removal-difficulty mechanism and the backlash are sourced to named reporting and stated as theirs. Nothing here alleges illegality, fraud, or hidden conduct — the entire record was disclosed, which is precisely what makes it a case file. The defense — opt-in, user-controlled, arguably safer than the alternative — is presented at full strength. If it couldn't survive a defamation challenge, it wouldn't be on this page.