ASIC Firmware Lock & Security Event Tracker: Can You Still Flash Custom Firmware?

Every few months a rumour goes around that Bitmain has “finally” locked custom firmware out for good. The reality is more precise and more useful: Bitmain has added layered locks over several years, and which one you hit depends entirely on how old your miner’s stock firmware is. This tracker records only the events that change what you can actually do with your hardware — install BraiinsOS+/VNish/LuxOS/DCENT_OS, keep SSH, or roll back — not every release note. Each event is dated, graded for evidence, and marked for whether it’s bypassable and how.

Quick answer

Can you still flash custom firmware on a 2026 Antminer? Yes — but the path depends entirely on your board's firmware age, because Bitmain has layered three locks. The 2022 Security Firmware disabled SSH. From March 2024, Amlogic control boards block direct custom-firmware installs (unlockable with a ~US$85 kit — "Path B"). And in September 2025 a stock update blocked the micro-USB port that unlock kit needs, so post-Sept-2025 boards must first be SD-downgraded to the August-2025 build, then unlocked ("Path C", ~2 hours). BraiinsOS+, VNish, LuxOS and DCENT_OS all remain installable once the board is unlocked — none of them lock you in, and all are reversible to stock.

The lock that matters is Bitmain's, not the custom firmware's: stock is the thing that fuses SSH, secure-boot and the micro-USB port. Custom firmwares stay reversible — you can always go back to stock. Check your stock firmware date first; it decides whether you're on the 45-minute path or the 2-hour one.

Lock & security events (dated)

2022-01 Bitmain signed-firmware / SSH lock grade A

Bitmain's Security Firmware added firmware-signature verification and DISABLED root SSH on the miner. Stated as anti-malware; the practical effect is that SSH — historically the on-ramp for flashing custom firmware — is gone on these builds.

Models: S15, S17/S17+, S19/S19 Pro, Z11 — all 'Security Firmware' S-gen Bypassable: partial — custom firmware is still installable via Toolbox/SD on Zynq/BeagleBone boards; the SSH lock only removes the SSH install path, not every path on pre-Amlogic hardware. 2026 status: Baseline behavior on all modern stock firmware; SSH flashing is not the standard 2026 route. Superseded in importance by the Amlogic control-board locks below. Source: Bitmain support: Antminer Security Firmwares Q&A
2024-03 Bitmain secure-boot / control-board lock grade B

Bitmain began shipping Amlogic-based control boards (no SD slot; a micro-USB port instead) whose firmware blocks direct installation of BraiinsOS+, VNish or LuxOS. Third-party firmware can no longer be flashed straight onto these boards without unlocking them first.

Models: S19k Pro, S21, T21, and late S19/S21 units on Amlogic control boards (2023+) Bypassable: yes — via a third-party Amlogic unlock kit (~US$85) that uses the micro-USB/UART path to boot an older unlocked build, after which a normal Toolbox install proceeds (~45 min, 'Path B'). 2026 status: Still the governing lock for boards on March-2024 through August-2025 firmware. Actively worked around in the field; this is the beginning of the control-board lock era. Source: D-Central firmware update guide; millionminer install guide; Altair Technology
2025-09 Bitmain port block (micro-USB) grade C

Bitmain shipped an update that disables/blocks the micro-USB port on Amlogic control boards — the exact port the unlock kit relies on. This closed the direct hardware-unlock path that had worked since the March-2024 locks. It is NOT an SSH-specific lockout and NOT new signed-firmware enforcement; it kills the physical micro-USB unlock on-ramp.

Models: Amlogic-control-board miners on Sept-2025+ stock firmware (S21-series, S19k Pro, T21 class) Bypassable: partial — not directly. You must first downgrade stock firmware to the ~August-2025 pre-lock build via SD card, THEN apply the normal UART unlock. The unlock kit alone fails on post-Sept-2025 firmware (~2 hr, 'Path C'). 2026 status: Still in effect as of mid-2026; the longest, riskiest install path. Custom firmware remains installable, just harder. Source: millionminer install guide; Altair Technology — ⚠ corroborated by independent installers but NOT pinned to a primary Bitmain release note; date is month-only
2024 Braiins install method (reversible) grade A

Braiins Toolbox became the preferred install path, supporting remote batch installs across all common S19/S21 control-board families including Amlogic. SD-card install remains available for Zynq/BeagleBone and leaves internal NAND intact.

Models: Antminer S19/S21 series (Zynq/Xilinx, Amlogic, BeagleBone Black, Cvitek control boards) Bypassable: n/a — this is an install method, not a lock. Included because reversibility is the counter-story to Bitmain's locks. 2026 status: Current standard install tooling. SD-card installs are fully reversible (remove the card and stock firmware boots with prior settings); NAND install is the permanent option. Source: Braiins Academy — installation docs

Per-firmware lock state (2026)

Firmware	Dev fee	Locks you in?	Reversible?	Install in 2026	Open source
BraiinsOS+	2–2.5% range (verified 2026-07); effectively 0% when mining on Braiins Pool	None — does not secure-boot the device against you; you can leave.	Fully reversible. SD-card install leaves stock NAND intact; revert to Bitmain stock supported.	Braiins Toolbox (preferred, remote batch) or SD card; on Mar-2024+ Amlogic boards needs an unlock first, and on Sept-2025+ firmware needs an SD downgrade to the Aug-2025 build, then unlock.	partial — much tooling and the BCB100 open-hardware path are open, but production ASIC-control binaries are closed. Do NOT claim 'fully open source'.
VNish	2–2.8% range (verified 2026-07); charged on hashrate regardless of pool — no free/pool-tied tier	Aftermarket firmware; adds no secure-boot lock-in beyond stock.	Reversible to stock via standard reflash on unlocked boards.	Web-UI / toolkit reflash on unlocked control boards; same Amlogic unlock prerequisites apply as for any custom firmware.	no — closed source (described here only at feature/dev-fee level).
LuxOS	~2.8% (verified 2026-07); waived when mining on Luxor Pool	Aftermarket firmware; no added secure-boot lock-in.	Reversible to stock on unlocked boards.	Vendor tool/API reflash on unlocked control boards; same Amlogic unlock prerequisites apply.	no — closed source.
DCENT_OS	0% (D-Central's own OS; sovereignty-first positioning)	No user lock-in by design; no secure-boot-against-owner.	Reversible per open-firmware norms.	Via the /flash/ web flasher and DCENT tooling; subject to the same underlying Bitmain Amlogic unlock prerequisites on locked hardware.	yes — public beta, GPL-3.0.
Bitmain stock	0% (no dev fee; monetized via hardware + optional pool)	LOCKS YOU IN on Amlogic boards — signed firmware + disabled SSH (2022), escalated to control-board firmware locks (Mar 2024) and a micro-USB port block (Sept 2025).	Anti-downgrade enforced on newer builds; an SD-card downgrade to a pre-lock build is the field workaround where hardware permits.	Ships stock; official updates via web UI/SD. Removing it for custom firmware now requires unlock steps that scale with firmware age.	no — closed source.
MicroBT (Whatsminer) stock	0% (no dev fee)	Historically more permissive than Bitmain for third-party firmware, but no first-class custom-firmware ecosystem equivalent to Antminer's.	Vendor-controlled; not the focus of the 2024/2025 Bitmain lock events.	Stock via WhatsMinerTool; custom-firmware support is narrower than Antminer.	no — closed source.

Open data (CC BY 4.0): CSV · JSON · API: /wp-json/dc/v1/firmware-lock-events

The three install paths, decoded

Because the locks are layered, installers now talk about three paths by firmware age. Path A is the old world — Zynq/BeagleBone control boards with an SD slot, where you flash straight from a card and it’s fully reversible. Path B covers Amlogic control boards on March-2024 through August-2025 firmware: a ~US$85 unlock kit uses the micro-USB/UART port to boot an older build, then Toolbox installs your firmware (~45 minutes). Path C is the post-September-2025 world: that stock update blocked the micro-USB port the kit relies on, so you first downgrade stock to the ~August-2025 build via SD card, then unlock and install (~2 hours). None of this makes custom firmware impossible — it makes it slower and raises the stakes of a mistake, which is exactly the calculus Bitmain is counting on.

Two caveats we won’t paper over

Honesty about what we don’t firmly know is part of the value here. The September-2025 port block is real — it’s consistently described by independent installers — but we could not pin it to a primary Bitmain release note or an exact firmware version string, so it carries our lowest evidence grade (C) and a month-only date. And the Amlogic system-on-chip part number is cited two different ways across reputable sources (A113D vs A311D), so we leave it unverified rather than pick one. If you’re about to unlock a specific board, verify against your firmware first; unlocking can brick a miner, and the right path is the one that matches your build date, not the one a forum post from last year describes.

Who actually locks you in

The per-firmware table above makes the point that gets lost in the noise: the firmware that fuses SSH, enforces secure boot and blocks the micro-USB port is stock. The custom firmwares people worry about — BraiinsOS+, VNish, LuxOS, and our own DCENT_OS — are all reversible; you can go back to stock from any of them. They differ mainly on dev fee (BraiinsOS+ 2–2.5%, VNish 2–2.8%, LuxOS ~2.8%, DCENT_OS 0%) and openness, not on whether they trap you. For the full feature-by-feature breakdown see the firmware comparison and the firmware feature matrix; for model-by-model install compatibility, the firmware compatibility dataset; and for the step-by-step unlock itself, the Antminer firmware update guide. If you’d rather not risk the bench work, D-Central unlocks and flashes miners as a service.

Related products, repair, and setup paths

Last reviewed July 18, 2026.