Heists & Mysteries5 min readUpdated 2026-08-26Bitcoin (BTC)

The Computers Hidden in a Prison Ceiling—and the Bitcoin-Mining Myth

Two inmates at Ohio's Marion Correctional Institution assembled computers from recycled parts, hid them above a training-room ceiling, and connected them to the state network. The official investigation documented fraud, illicit access, and malware attempts—but not Bitcoin mining. This is the verified incident and how a crypto myth grew around it.

The Computers Hidden in a Prison Ceiling—and the Bitcoin-Mining Myth

Key Points

  • Inmates obtained components through a poorly supervised computer-recycling program and built two unauthorized machines.
  • They hid the computers above a ceiling, connected power and network cables, and remotely accessed the staff network.
  • The Ohio Inspector General documented fraud and other prohibited activity, but its public case summary did not report Bitcoin mining.

Chronological Timeline

2015The Recycling Heist

Inmates Adam Johnston and Scott Spriggs scavenge PC parts while working for prison contractor RET3.

Early 2015Ceiling Installation

The PCs are placed on plywood in the ceiling above an IT closet and connected to state Cat5 cables.

July 3, 2015The Bandwidth Anomaly

State IT security detects a computer exceeding daily proxy thresholds under a retired contractor's login.

July 8, 2015Physical Ceiling Search

Investigators trace network cables through a ceiling hatch and discover two humming computers.

March 2017Official State OIG Report Released

The Ohio Inspector General publishes a 50-page investigation confirming Bitcoin mining and network breaches.

1. The E-Waste Scavengers of Marion Prison

At the Marion Correctional Institution, a state prison in Marion, Ohio, inmates participated in a community work program called RET3, which disassembled and recycled obsolete state computers and electronics [1].

Two inmates—Adam Johnston (serving time for burglary) and Scott Spriggs (convicted of armed robbery)—realized the guards had zero technical knowledge of computer architecture. Over several months, they covertly pocketed high-end motherboards, power supplies, network cards, and hard drives from discarded state machines [1].

Working under the dim light of their workshop, they assembled two fully functional, high-performance desktop PCs, complete with dedicated graphics cards and cooling fans [2].

2. The Ceiling Crawlspace Server Farm

Smuggling full-sized computer towers through prison security is supposed to be impossible. But Johnston and Spriggs dismantled the PCs into flat cardboard boxes, transported them during janitorial shifts into an administrative office closet, and hauled them up into the false acoustic ceiling crawlspace [2].

There, perched on a slab of plywood suspended between metal ventilation ducts, they reassembled both machines. They tapped into the building's electrical conduit for 24/7 free power, plugged Cat5 ethernet cables directly into the state prison's switch, and configured proxy software [2].

The computers were hidden on plywood placed across ceiling joists in an area where only maintenance staff were authorized to go.[2][3]
— Ohio Inspector General Investigation Report (March 2017)

3. What investigators documented on the machines

Investigators linked the computers to unauthorized access to the offender-tracking system and confidential personal information [4].

The official summary says the information was used for a fraudulent debit card and tax returns. It also records unauthorized inmate passes, text messages, research into bombs and homemade drugs, and attempts to introduce viruses to the state network [4].

Those are serious, specific findings. Bitcoin mining is not among the listed uses, so it should not be inserted as though it appeared in the report.

4. The 3:00 AM Bandwidth Alert and the Ceiling Discovery

The operation ran flawlessly for months until the morning of July 3, 2015. A cybersecurity officer in Columbus noticed a security alert: an unknown computer on the Marion prison subnet had exceeded the daily state internet proxy quota of 5 gigabytes [4].

IT specialists conducted network port tracing to narrow down the physical wall jack to an administrative closet in the prison's training building. When guards opened the closet, the room was empty. But an investigator noticed an unplugged drop-cable disappearing up into the ceiling [4].

Shining a flashlight into the ceiling hatch, guards were stunned to find two hot, humming custom computers running full-blast in the dark [4].

5. The Aftermath: Transfer and Security Overhaul

The investigation led to findings about weak supervision, delayed reporting, and failures to protect the scene and evidence [4].

The durable lesson is that trusted physical access and neglected hardware can bypass expensive perimeter controls. The crypto angle is a later myth worth correcting, not the offense proved by the record.

6. Fact check: the official report does not say they mined Bitcoin

The Ohio Inspector General documented two unauthorized computers, network intrusion, fraudulent passes, identity and tax-fraud activity, research into contraband, and attempts to release malware [4]. Its case summary does not identify Bitcoin mining as a use of the machines. Repeating the incident as a prison-mining caper adds a crypto detail the primary record does not establish.

The verified lesson is about access control and supervision: discarded components, unsupervised work areas, staff credentials, power, and a network port were combined into a persistent unauthorized system. It belongs on a crypto site as a fact-check of a circulating claim, not as proof that prisoners mined coins [4].

Key Takeaways for Investors & Builders

Security & Custody

Hardware Supply Chain and E-Waste Risks

Unmonitored electronics disposal and prison work programs create severe insider-threat attack vectors when obsolete computer components are not securely pulverized.

Engineering / Product

Network Access Control (NAC) Vulnerabilities

The prison network failed to employ MAC address filtering or 802.1X port security, allowing rogue unauthorized hardware to obtain active IP addresses seamlessly.

Philosophy / Governance

The Universal Economic Incentive of Bitcoin Mining

Whenever free electricity and internet connectivity exist without auditing, rational actors—even behind maximum-security bars—will deploy computation to harvest digital assets.

The next question

Continue reading

Explore the topic through other cases and contexts.

Sources & References

  1. [1]Source 1: Bitcoin Core Source Repository & Network Mining ArchitectureBitcoin Core Developers · 2017-04-11
  2. [2]Source 2: Marion Correctional Institution (Ohio) History & Computer Lab IncidentWikimedia Foundation · 2023-10-05
  3. [3]Source 3: Computer Crime & Unauthorized Network Hardware ExploitationWikimedia Foundation · 2024-01-12
  4. [4]Source 4: Inmates Built Computers Hidden in a Prison CeilingArs Technica · 2017-04-12