Mexico Raids Cartel-Linked Crypto Farm Over Suspected Power Theft
Key Takeaways
- •The suspected facility was found near the Nuevo Necaxa hydroelectric system in Puebla, alongside about 300 GPUs and other electrical and communications equipment.
- •Authorities are focused on alleged electricity theft, while possible organised-crime and money-laundering connections remain unproven and under investigation.
- •The GPU equipment does not demonstrate that Bitcoin was mined, identify the asset produced or confirm that cryptocurrency mining occurred.
- •Investigators would need ownership documents, mining-pool data, blockchain addresses and exchange or cash-out records to establish operators and any broader financial network.

Authorities in Puebla have dismantled a cryptocurrency facility near the Nuevo Necaxa hydroelectric system in Mexico’s Sierra Norte region, where investigators found around 300 graphics processing units (GPUs), medium-voltage equipment and satellite antennas, according to Reuters.
The central allegation is that the facility may have been connected illegally to nearby power infrastructure. If confirmed, the suspected theft would have reduced the cost of operating the machines, allowing the operator to retain mining rewards while avoiding what is typically one of the largest recurring expenses in a mining business.
Mining cryptocurrency is not prohibited in Mexico by itself. Authorities cited by Reuters and El País said the investigation is focused on suspected electricity theft. Reuters also reported that officials are examining possible links to organised crime and money laundering. Mexico’s federal prosecutor declined to comment because the case remains active.
The reports do not identify the operator, the crypto asset allegedly mined, a mining-pool account, a wallet address or an exchange account. Those omissions are significant because the physical equipment alone establishes computing capacity, not financial output.
The equipment does not establish that Bitcoin was mined
The seized hardware does not show which asset was produced, how much was generated or who received any resulting proceeds. The installation was described as GPU-based, and GPUs can support multiple cryptocurrency and other high-intensity computing workloads.
Bitcoin mining, by contrast, has long been dominated by specialised application-specific integrated circuit (ASIC) machines. ASICs displaced GPU mining for Bitcoin because they are substantially more efficient at performing the network’s SHA-256 calculations, according to the Cambridge Centre for Alternative Finance.
The GPU inventory therefore cannot establish that the facility was mining Bitcoin rather than another crypto asset, or that it was being used for cryptocurrency mining at all. It also cannot reveal the identity of any party controlling the operation.
Reuters reported that the Puebla site was the fourth crypto farm found near the dam since early 2025. That history gives authorities grounds to examine the area’s power infrastructure and usage patterns. It does not, by itself, prove common ownership among the facilities or demonstrate the existence of a single criminal network.
Mining equipment does not prove a laundering operation
If the facility was mining cryptocurrency, the alleged use of stolen electricity may have reduced the cost of producing crypto rewards. That possible economic incentive helps explain why authorities investigate unauthorised mining operations, but it does not establish that the Puebla site generated or laundered criminal proceeds.
A solo miner receives a reward through a blockchain block-reward transaction, which is unrelated to the Coinbase exchange. A miner operating through a pool receives payouts based on its share of the pool’s computing work. Identifying a relevant blockchain address or mining-pool account would allow investigators to examine subsequent transfers and seek records from exchanges if funds were deposited there.
Attribution is the difficult step. A transaction does not identify its owner on its own, while intermediary wallets and pooled payouts can make the movement of funds harder to trace. Once investigators identify an address connected to the operation, however, later transfers can provide additional transaction history.
That distinction is important to the case. Authorities would need to determine whether any cryptocurrency was simply the alleged product of an operation that avoided electricity costs, or whether it entered a wider laundering route. As with other analyses of illicit funds that remain traceable onchain, moving crypto between wallets does not necessarily erase the transaction record available to investigators. Coindoo has also examined this issue in its report on illicit crypto stranded onchain.
Unusual electricity use may provide the first clue
A lawful cryptocurrency mining business must pay for electricity, equipment, cooling, maintenance and the changing difficulty of mining. An operator that allegedly bypasses the grid would still face equipment and upkeep costs, but could avoid one of the operation’s largest expenses.
Remote locations can reduce visibility, yet Reuters reported that the Puebla facility attracted attention through unusual electricity consumption and mechanical noise. Meter anomalies, transformer records, equipment purchases, satellite-internet accounts and property-access records could help establish who operated the site before investigators identify any wallet or pool account.
Other raids have focused on power theft
Puebla is not an isolated example of alleged electricity theft involving cryptocurrency equipment, although the available cases do not establish a shared criminal network. In recent mining raids in Malaysia, authorities likewise focused on suspected unauthorised connections to the power grid rather than treating cryptocurrency mining itself as the offence.
The common alleged incentive is to shift the cost of electricity onto a utility or public grid. The crypto-related question is separate: what asset, if any, was generated; who controlled it; and how it was transferred.
Evidence that could establish wider links
Future disclosures about ownership documents, mining-pool records and wallet addresses may be more significant than the number of machines seized. Ownership records could connect the equipment to an operator. Pool data or blockchain addresses could identify any output, while exchange deposits, cash-out activity or transfers involving known criminal entities could show whether the funds entered a broader financial network.
The raid may indicate how the alleged operation was financed on a day-to-day basis: by attempting to avoid electricity costs. Wallet, pool and cash-out records would be needed to determine whether any resulting cryptocurrency became part of a provable cartel-finance or money-laundering chain.
This article is provided for informational purposes only and does not constitute legal, financial or investment advice.
Source: Coindoo