Setting up Stratum V2 on a Bitaxe: encrypted solo mining in five fields

One line in the AxeOS 2.14.0 changelog changed in June 2026 how a Bitaxe talks to its pool: “Add Stratum V2 (SV2) protocol support”. Since 8 September 2026 the Bitaxe Pool accepts Stratum V2 as well, on port 3336 and with its own authority key. This guide walks the whole way once: what the protocol really changes on your miner, which five fields in AxeOS are responsible for it, how to set the fallback cleanly and how to verify that the connection is actually encrypted. Plus the failure patterns from our support queue and a table of the pools that offer V2 to a Bitaxe today.

What Stratum V2 changes on your Bitaxe, and what it does not

Stratum V1 dates from 2012 and is a text protocol: JSON lines travelling unencrypted between miner and pool. Anyone reading along the way sees your Bitcoin address, your shares and every block template. Anyone who can not only read but alter the traffic, say on hotel Wi-Fi or through a compromised router, can slip your miner a different address. The miner notices nothing and simply keeps hashing, only for someone else. For a Bitaxe at home on your own network this is rarely a practical problem. It is a fundamental one nonetheless, and Bitcoin carried it around for long enough.

Stratum V2 closes both gaps. The connection is encrypted with the Noise protocol, the same framework WireGuard builds on; specifically Noise_NX with secp256k1 and ChaCha20-Poly1305. And the pool identifies itself during the connection setup with its authority public key, a public key you enter once in AxeOS. Your miner then checks on every handshake whether the other side holds the matching private key. If the key does not match, no connection is established. An attacker would have to not only redirect the traffic but also possess the private key of the pool.

On top of that, V2 speaks binary instead of text. Messages are smaller, and the miner receives new work a few milliseconds earlier. On a Bitaxe with one to five TH/s the effect on hashrate is not measurable. V2 is a piece of order rather than a performance gain.

What V2 does not change: your chance of finding a block. It depends on your hashrate and the network difficulty, not on the protocol. A Bitaxe Gamma finds a block over V2 exactly as often as over V1, which is to say, as Bitaxe block probability works out honestly, very rarely. The payout stays the same too: on the Bitaxe Pool a found block goes straight to your address via the coinbase transaction, over V1 and V2 alike. And the pool still adjusts your share difficulty automatically. Switching V2 on buys you security and tidiness, not faster blocks.

Extended or standard channel

AxeOS offers two channel types. Extended Channels are the normal case for any external pool: the pool sends the coinbase template along, the miner can read it and show on the dashboard who the block would pay. Standard Channels are meant for the case where your own SV2 node or a Job Declaration client on the same network builds the templates. For the Bitaxe Pool and every other pool in the table below the answer is Extended.

Job Declaration, the right of the miner to build the block template itself, is something the Bitaxe Pool deliberately does not offer. If you want to decide which transactions go into your block, you are better served by a node of your own than by a pool pretending to be one. Solo CKPool offers a Job Declaration port and states itself that it brings no advantage over your own JD client.

Prerequisites

If the firmware is too old, the update is the first step, easiest via the web flasher with the install type “Update”. The flasher preselects OSM-OS, our recommendation; it handles Stratum V2 exactly like the original. Since AxeOS 2.15.0 the web interface is embedded in the firmware file itself: esp-miner.bin is enough for an update, and you only need a www.bin for a custom interface. Reload the page in your browser once after the update, otherwise the browser shows the old dashboard from its cache.

The five fields in AxeOS

Open AxeOS in your browser (the IP address is on the display or in the device list of your router; since 2.15 http://bitaxe.local works too), then Pool in the menu on the left. Since 2.15 every pool has its own card there, up to eight of them, and at the top under “Active Pool Selection” you choose which entry is the Primary Pool and which the Fallback Pool. Expand the card you want to switch to V2, usually Pool 1.

1. Stratum Protocol: Stratum V2. This is the switch that unlocks everything else. As soon as V2 is selected, the V1 options (Suggested Difficulty, Extranonce Subscribe, TLS) disappear and the SV2 fields appear. If the field is missing altogether, the firmware is older than 2.14.0.
2. Stratum Host and Stratum Port. Host stratum.bitaxe.de, just the name, without stratum2+tcp:// in front and without a port after it. Port 3336. The V1 port 3333 does not work with V2: the miner would knock there with a binary handshake where the pool expects text.
3. SV2 Channel Type: Extended Channels. This is the default. Standard Channels only if you run your own SV2 node or Job Declaration client on your network.
4. SV2 Authority Pubkey. For the Bitaxe Pool 9awpfZGWfrRBH8fkf82mWvnXMSTC7i9M3mshB8M56cw9UXTGdYi, 51 Base58 characters, no spaces. The safest source is pool.bitaxe.de or the pool configurator, not a forum post. AxeOS only checks the length (40 to 52 characters) and the character set, not the content; a typo only shows up at the handshake. Technically the field is optional. Leave it empty and the miner connects on a trust-on-first-use basis without verifying the other side. That gives away the most important part of V2, so: fill it in.
5. User and Password. User is your Bitcoin address, optionally with .workername and #group for SOLO groups, exactly as with V1. The pool does not evaluate the password over V2; x is fine.

Two options below them deserve a look. Require Authentication, new in 2.15.0, forces the miner to refuse the connection if the pool cannot prove the authority key, instead of falling back to trust on first use. With a key entered, the option belongs on. Decode Coinbase Tx (under “Show Advanced Options”, on by default) reads the coinbase template from the extended channel and shows in the Block Header card on the dashboard, under “Outputs”, which address the block would pay; your own is marked with a star. On the Bitaxe Pool that has to be your own; if something else appears there, the User field is wrong.

Then Save and Restart: AxeOS only applies pool changes after the restart, as the message after saving points out. After one to two minutes the first shares flow, and the Pool card on the dashboard shows “SV2 Extended Channel” under “Mode”. Since AxeOS 2.15 you also see pending shares with V2, shares that have been sent but not yet confirmed by the pool. That is normal; the number stays small and oscillates.

Fallback: V1 as the safety net

The second slot in the pool list is the fallback pool. AxeOS switches to it when the primary pool could not be reached three times in a row, then checks it again every minute and returns as soon as it answers. Protocols may be mixed: V2 as primary with V1 as fallback works, the other way round too, and two V2 pools just the same. For the Bitaxe Pool this is the most sensible layout:

Why V1 as fallback is not a security hole: the fallback only kicks in when V2 fails, that is, during an outage, and it goes to the same pool. The alternative, no fallback at all, would mean your miner stands still whenever the V2 endpoint has trouble. For a device that is waiting for a rare hit anyway, an hour of downtime is bearable; for a NerdQaxe++ at 4.8 TH/s it is lost tickets. If you would rather have a second provider as fallback, enter another solo pool there, with or without V2; the payout goes to the same address either way.

Two special cases: if you pick “Fallback” yourself in the Pool card on the dashboard, the miner restarts immediately and stays there until you switch back with the same selector. And if primary and fallback both fail, AxeOS pauses mining and retries every 30 seconds.

Verifying that the connection really is V2

Flowing shares only mean connected. Three places show that it really is V2.

• Pool card on the dashboard. “Mode” reads “SV2 Extended Channel”, “URL” shows port 3336, and the miner’s display shows “Protocol: SV2”. If it reads “SV1” and the dashboard says “Using fallback pool” at the top, the V2 handshake failed and the failure patterns below are your next stop.
• Logs in AxeOS. Under Logs the connection setup shows lines such as Starting Noise handshake, Authority pubkey configured, will verify server certificate, Encrypted channel established (ChaCha20-Poly1305) and SV2+Noise connection ready, followed by Shares accepted with the response time in milliseconds. Without a key AxeOS logs No authority pubkey configured, server identity will not be verified. With V1 you would see JSON lines with mining.subscribe and mining.notify instead.
• Pool page. On pool.bitaxe.de enter your address; after two minutes the worker appears with hashrate and best difficulty. The pool statistics do not distinguish by protocol; your worker looks exactly the same there over V2 as over V1.

If you want to know for sure, look at the traffic itself: a capture on port 3336 shows nothing but noise after the handshake, a capture on port 3333 shows readable JSON with your address in it. That is the whole difference, and it is the reason for the five fields.

Stratum V1 and V2 compared

Which pools offer Stratum V2 to a Bitaxe

As of September 2026. Always copy the authority key from the page of the respective pool; we print it here for orientation, and a pool can change it at any time.

The matching authority public keys, as of September 2026:

• Bitaxe Pool: 9awpfZGWfrRBH8fkf82mWvnXMSTC7i9M3mshB8M56cw9UXTGdYi
• Solo CKPool: 9anrRNhBh7869XtNnFcCuGBRZP51E635qGbu457J5kHdszhfRc3
• Blitzpool: 9bCoFxTszKCuffyywH5uS5o6WcU4vsjTH2axxc7wE86y2HhvULU
• Braiins Pool and Public Pool: on the connection page of the respective provider

Which pool suits you is a different question from V1 or V2, and it is answered in choosing a Bitaxe mining pool. In short: solo pools pay only when a block is found, and then everything; Braiins pays fractions daily and is, for a Bitaxe, a piggy bank with a very small slot.

When V2 does not connect: the failure patterns

The following cases cover what has reached our support queue since June, ordered by frequency.

• Wrong or incomplete authority key. One character short, a trailing space, a capital I instead of a lowercase l: the handshake fails, no shares arrive, and after three failed attempts AxeOS switches to the fallback. Copy the key again from the pool page, clear the field completely, paste, save.
• Firmware too old. If the Stratum Protocol field is missing, the firmware cannot do V2. Update to 2.15.3, easiest via flasher.bitaxe.de, then reload the page in the browser.
• V1 port with the V2 protocol. Host is right, port 3333 instead of 3336: the pool answers the binary handshake with nothing and the miner retries forever. Check the port; for the Bitaxe Pool it is 3336 or 4336.
• “difficulty too low” in the logs. A known bug in 2.14.x when the pool sets a fractional difficulty and the miner rounds. Fixed in 2.15.0 (“Keep fractional SV2 pool difficulty”). Update.
• NerdQaxe loses jobs over V2 on a PPLNS pool. NerdOS before 1.1.0.1 had only a 2 KB receive buffer for V2 jobs; pools with many payouts in the coinbase overflow it. 1.1.0.1 raises it to 16 KB. Solo pools like the Bitaxe Pool send only a few outputs.
• Require Authentication on, key empty. The miner refuses every connection because there is no key to check against. Enter the key or switch the option off.
• Shares flow, but the Pool card shows SV1. The miner is sitting on the fallback because V2 was unreachable; the dashboard also reports “Using fallback pool”. Usually a firewall or guest network matter: allow outbound port 3336, restart the miner.
• Shares flow, but the pool page shows nothing. This has nothing to do with V2: nine times out of ten the User field holds a different address than the one you type into the pool page. The miner troubleshooter and the article Bitaxe connects to Wi-Fi but does not mine go through the remaining causes.

NerdQaxe, NerdOctaxe and large ASICs

NerdOS, the firmware on NerdQaxe++, NerdOctaxe and Nerdaxe Gamma, descends from the same code as AxeOS. Its fields live in the “Stratum Settings” card under Settings: Stratum Protocol, Stratum Host, Stratum Port, Username, Password, SV2 Authority Public Key and Require Authentication. There is no channel type choice; NerdOS always uses the extended channel. Stratum V2 has been in since 1.0.37, “Require Authentication” since 1.1.0. Enter the same values as above and restart; the NerdQaxe setup guide shows what the page looks like. Several devices on one address each get their own worker name after the dot; the statistics keep them apart, and a found block pays the same wallet.

Large ASICs without AxeOS, an Antminer running Braiins OS for instance, speak V2 through a single URL that carries the key: stratum2+tcp://stratum.bitaxe.de:4336/9awpfZGWfrRBH8fkf82mWvnXMSTC7i9M3mshB8M56cw9UXTGdYi. Port 4336 is the high-difficulty port of the Bitaxe Pool; everything above 4000 starts at a high difficulty so that a 200 TH/s machine does not flood the pool with shares. Stock firmware without V2 stays on V1 on port 4334 or puts an SV2 proxy in between; that encrypts from the proxy onward, not from the device.

An honest assessment

Stratum V2 does not make your Bitaxe faster or your block more likely. It makes the connection to your pool what it should have been in 2012: encrypted, with a pool that has to prove who it is. For a device that hangs on the network for years carrying a Bitcoin address, that is the right standard. The ten minutes of setup are well spent, and the V1 fallback catches the rest.

If you buy a miner today, all V2 needs is current firmware: Bitaxe Gamma and Bitaxe GT run AxeOS, NerdQaxe and NerdOctaxe run NerdOS, and an update through the web flasher takes two minutes. Five fields, and the rest is patience.