Dutch turbine engineer tried to turn wind into crypto, ends up generating community service
Techie wired cryptominers into Nordex's network while company reeled from cyberattack
A Dutch wind farm operator learned the hard way that its turbines weren't just spinning to generate electricity – they were also powering someone else's crypto wallet.
A court in Assen has sentenced an unnamed man – born in 1979, and working at the time as a technical manager for Nordex's wind turbine parks – to 120 hours of community service for siphoning electricity and breaking into systems across two sites.
The judgment, delivered on November 13, found that he connected three cryptomining rigs and two Helium nodes to Nordex's internal network between August 16 and November 22, 2022.
According to the ruling, the defendant set up the cryptominers at the Gieterveen wind farm, plugging them directly into a Nordex router at a substation. He then installed the Helium hotspots inside turbines at the Waardpolder wind farm, again hooking them into Nordex's network.
The court said the setup amounted to theft of electricity and what Dutch law terms as "computer breach," noting that he had abused his insider access. "He has seriously damaged his employer's trust by abusing his position as technical manager," the court said.
Prosecutors charged him with three offenses, including an allegation that the mining rigs had "added data" to Nordex's automated systems. But the court threw out that count, delivering an unusually detailed explanation of why cryptocurrency and Helium traffic doesn't legally qualify as adding data. For an "addition" charge to stick, judges said the data has to be identifiable and concrete – malware being the classic example. By contrast, blockchain verification traffic and Helium network packets are "indivisible data traffic," even if they're running across someone else's network. As a result, he was acquitted of this count.
That didn't spare him the remaining charges. He admitted both theft and unlawful access to Nordex's routers and servers, and the court stressed he had shown "no concern" for the risk of a "potential disruption in the operation of the turbines," underscoring that this was happening inside operational industrial systems, not spare office kit.
Nordex's victim statement played a significant role in escalating the seriousness of the case. At the hearing, the company told judges that it had been dealing with a cyberattack shortly before discovering the cryptomining computers and Helium nodes, in what appeared to be a reference to the 2022 ransomware attack claimed by the Conti cybercrime crew. The court said this meant "the crimes committed by the suspect have therefore had an even greater impact."
The public prosecutor had pushed for 240 hours of community service, noting that offenses involving industrial networks could easily justify prison time. But the court cut the sentence in half, citing several mitigating factors: the defendant is a first-time offender, he fully admitted the proven facts, and the case had breached the reasonable time requirement by more than five months. Judges also accepted evidence that he'd been struggling with depressive symptoms and burnout at the time.
The financial penalties were more straightforward. Nordex filed a civil damages claim and was awarded €4,155.65, plus statutory interest. The court also issued a compensation order requiring the defendant to pay the same amount to the state for Nordex's benefit, warning that failure to pay could trigger a "hostage" measure of up to 51 days in custody. And if he doesn't complete his community service, he faces 60 days of substitute detention.
For anyone tempted to run a side hustle off their employer's infrastructure – especially one attached to giant rotating machinery – consider this a friendly Dutch reminder: not all renewables are yours to monetize. ®