Installing the wrong firmware — or a tampered image pulled off a forum mirror — is one of the fastest ways to brick an ASIC or hand a stranger a foothold on your mining LAN. This guide covers the safe path: identify your exact model, download the correct official signed image from the manufacturer’s portal, verify it’s authentic, and flash it. Done carefully it’s a routine job — but treat every flash with respect: rush a step or lose power mid-write and you can lose a control board.
Rule Zero: Only Official, Signed Firmware
Current-generation Antminers (S19 XP-era and newer) ship firmware as a digitally signed package (typically a .tar.gz) and enforce that signature at flash time, refusing images they can’t verify — which is exactly the protection you want. Older units such as the S9 are far more permissive about what they’ll accept, which is all the more reason to be disciplined about where you source the file. Two hard rules follow regardless of generation:
- Download only from the manufacturer. For Bitmain hardware that means the official Bitmain support/firmware site. Never install a “modded”, “unlocked”, or re-hosted stock image from a marketplace, Telegram group, or random Google result — that is the classic vector for hashrate-stealing malware.
- Do not decompress or repackage the file. Upload the signed archive exactly as downloaded. Unzipping it and re-uploading loose files breaks the signature.
Step 1 — Identify Your Exact Model and Variant
Firmware is model-specific, and often hashrate-variant-specific. An S19 image will not run an S19 Pro, and a lower-hashrate S19 image is not interchangeable with a higher-hashrate S19 build. Get the exact string before you download anything:
- Read the label on the miner’s case or the sticker on the control board.
- Confirm it in the miner’s own web dashboard — the overview page reports the model and current firmware build.
- Note the generation so you download the matching chip-family image: S9 (BM1387), S17/T17 (BM1397), S19/S19 Pro/T19 (BM1398), S19j Pro (BM1362), S19 XP/S19k Pro (BM1366), S21 (BM1368), S21 Pro/XP (BM1370), L3+ (BM1485), L7 (BM1489).
Step 2 — Download the Correct Image
- Go to the manufacturer’s official support portal and open its firmware download section.
- The catalogue is organised by coin/algorithm first, then by model. For Bitcoin SHA-256 Antminers (S9, S17/T17, S19 family, S21 family) select the BTC/BCH branch; Scrypt units (L3+, L7) live under the LTC branch.
- Pick your exact model and hashrate variant, then download the latest published build unless you have a specific reason to hold an older one. Newer firmware carries security fixes and tuning improvements.
- Save the signed archive somewhere you can find it — your Downloads folder is fine. Any OS works; the miner does the flashing, your PC only serves the file.
Step 3 — Verify Before You Flash
Never flash a file you haven’t sanity-checked:
- Filename and model must match. The archive name encodes the model and often the hashrate — confirm both against Step 1.
- Checksum, if published. When the download page lists an MD5/SHA-256, compute it on your copy and confirm it matches. On Windows:
certutil -hashfile firmware.tar.gz SHA256; on Linux:sha256sum firmware.tar.gz; on macOS:shasum -a 256 firmware.tar.gz. A mismatch means a corrupted or altered file — delete it and re-download. - Signature is the backstop. On models that enforce signing, the miner’s own signature check will reject an unsigned or tampered image at install time rather than half-flashing it. Don’t rely on this alone on older units that don’t enforce it — the filename and checksum checks above are your first line of defence.
Step 4 — Install It on the Miner
Give the unit clean, uninterrupted power before you start. A flash interruption is the single most common way to brick a control board.
- Browse to the miner’s IP on your LAN (
http://<miner-ip>/) and log in. If it’s still on the defaultroot/rootcredentials, change them first — you don’t want to hand admin access to anything on the network. - Open the Firmware Upgrade page in the dashboard (under the System menu on stock Antminer firmware).
- Choose the signed archive you verified. If offered a “keep settings / preserve configuration” option, tick it to retain your pool and worker config; leave it unchecked for a clean wipe (useful when clearing a suspected infection).
- Start the upgrade and do not touch power, network, or the browser tab until it finishes. The unit writes the image, validates the signature, and reboots on its own — typically a couple of minutes.
Step 5 — Verify the Install Took
- Reload the dashboard after the reboot and confirm the reported firmware build matches what you downloaded.
- Check that all hashboards enumerate and the unit ramps to expected hashrate and chip temps.
- Re-confirm your pool/worker settings survived (or re-enter them if you did a clean wipe).
Common Mistakes
- Wrong variant. Right model, wrong hashrate image — the unit may reject it or run unstable. Match the variant exactly.
- Decompressing the archive. Upload the
.tar.gzas-is. - Power/network interruption mid-flash. The leading cause of a bricked board. Never flash a fleet on a flaky circuit.
- Third-party “stock” mirrors. If it didn’t come from the manufacturer, assume it’s compromised.
Security & Recovery Notes
Firmware installs are also your cleanup tool. If a miner is behaving oddly — unexpected pool redirects, unknown processes, hashrate quietly siphoned — a clean reflash of official signed firmware (settings NOT preserved) plus a credential change removes most infections. Bitmain also publishes its own antivirus/immunization utility for known miner malware; run it, then reflash. Keep the mining LAN on its own isolated VLAN with no direct inbound internet, and never expose a miner’s web UI to the open internet. If a unit won’t take a firmware upload at all, it usually needs an SD-card recovery flash or control-board repair rather than another web-UI attempt.
Related: once the correct image is on the unit, use How to Reload or Upgrade Firmware for the general upgrade/recovery workflow, browse model-specific documentation in our Manuals library, read the firmware glossary entry for background, and if a flash leaves a board dead run the ASIC Fault Finder to diagnose next steps.
