The rapid growth of decentralized physical infrastructure networks has created a new opportunity for hardware owners to earn cryptocurrency by contributing GPU computing power to distributed networks. With io.net launching its $IO token on April 28, 2024, and the platform aggregating GPU resources from over 130 countries, setting up a secure and efficient GPU node has become a valuable skill for crypto-enthusiasts and hardware operators alike. This advanced tutorial walks through the complete process of configuring a GPU node for DePIN participation, from hardware selection to security hardening, with specific focus on lessons learned from the io.net security incident that occurred just days before the token launch.
The Objective
This tutorial aims to guide advanced users through the process of setting up a production-grade GPU node for participation in decentralized compute networks like io.net, Render Network, and similar DePIN protocols. By the end of this guide, you will have a properly configured, security-hardened GPU node that can reliably contribute computing power to these networks while protecting your hardware, data, and earned tokens from common attack vectors.
The process involves hardware verification, operating system hardening, network security configuration, DePIN software installation, monitoring setup, and ongoing maintenance procedures. We will reference specific security considerations highlighted by the io.net April 2024 incident, where API vulnerabilities allowed attackers to manipulate device metadata, to illustrate why each security measure matters.
Prerequisites
Before beginning this tutorial, you should have the following: a dedicated GPU server with at least one NVIDIA GPU (GTX 1070 or newer; RTX 3000 or 4000 series recommended for competitive earnings), running Ubuntu 22.04 LTS Server edition. You need root or sudo access to the machine, a basic understanding of Linux command-line operations, and a cryptocurrency wallet set up for the DePIN network you plan to join. For io.net specifically, you need a Solana-compatible wallet like Phantom or Solflare.
Hardware requirements vary depending on the network, but generally you want a machine with a modern NVIDIA GPU with at least 8GB VRAM, 32GB of system RAM, a stable internet connection with at least 100 Mbps upload speed, and reliable power supply. Enterprise-grade hardware is preferred but not required — many successful DePIN participants use consumer GPUs. The key is stability and uptime, as networks reward consistent availability and may penalize nodes that go offline frequently.
Financial prerequisites include enough native tokens to cover transaction fees on the network — for io.net on Solana, this means a small amount of SOL. Some networks require a token stake as collateral, which can be slashed if your node underperforms, so understand the economic commitment before proceeding.
Step-by-Step Walkthrough
Step 1: Hardware Verification and Driver Installation
Begin by verifying your GPU is properly recognized by the system. Run nvidia-smi to confirm the driver is installed and the GPU is operational. If the command is not found, install the NVIDIA drivers using the official Ubuntu driver packages. For RTX 4000 series GPUs, you may need the latest driver version from NVIDIA’s official repository rather than the default Ubuntu packages. After driver installation, enable persistence mode to prevent the GPU from powering down between jobs.
Step 2: Operating System Hardening
Create a dedicated user account for running the DePIN node software — never run node services as root. Configure the firewall to allow only necessary connections. For most DePIN networks, you need SSH access on port 22, the specific ports used by the network protocol, and optionally a monitoring port. Block all other incoming connections and restrict outgoing connections to only the endpoints required by the network.
Install and configure fail2ban to protect against brute-force SSH attacks. Disable password authentication for SSH and use key-based authentication only. Set up automatic security updates to ensure critical patches are applied promptly. The io.net security incident demonstrated that API vulnerabilities can be exploited quickly — you want your underlying operating system to be as hardened as possible.
Step 3: Network Security Configuration
Set up a reverse proxy or VPN to mask your node’s real IP address from the public internet. This protects against targeted attacks and reduces the risk of DDoS attempts that could take your node offline. Configure network monitoring using tools like iftop or nethogs to track bandwidth usage and detect unusual traffic patterns that might indicate a compromise.
Create a separate network interface or VLAN for DePIN traffic to isolate it from your other network activities. This containment strategy limits the potential damage if the DePIN software or the network itself is compromised. The io.net incident showed that attackers exploited multiple APIs in a chain — network isolation prevents compromised services from accessing other systems on your network.
Step 4: DePIN Software Installation
Download the node software from the official repository only. Verify the checksum of downloaded files against the published hashes to ensure the software has not been tampered with. Install the software in a containerized environment using Docker when available, which provides an additional layer of isolation between the DePIN software and your host operating system.
Configure the node software with the minimum necessary permissions. Review the configuration file carefully and disable any features you do not need, such as diagnostic telemetry or community features that are not essential for node operation. For io.net specifically, ensure your device is registered with accurate metadata — the April 2024 attack involved manipulation of device metadata, so maintaining accurate records helps both you and the network detect unauthorized changes.
Step 5: Monitoring and Alerting Setup
Deploy monitoring tools to track your node’s health and earnings. Set up automated checks for GPU temperature, memory usage, and compute job completion rates. Configure alerts for anomalous conditions such as unexpected device status changes, unusual API calls, or earnings that deviate significantly from historical patterns. The io.net incident was detected by automated monitoring that flagged unusual write operations — applying the same principle to your node ensures you are informed of problems immediately.
Use a log aggregation system to collect and analyze logs from the node software, operating system, and network services. Centralized logging makes it easier to investigate incidents and provides an audit trail if you need to report suspicious activity to the network’s security team.
Troubleshooting
GPU Not Detected: If nvidia-smi does not show your GPU, check that the PCIe slot is properly seated and the power connectors are fully inserted. Verify the GPU is listed in lspci output. For consumer GPUs, ensure the card is not in a low-power state by running nvidia-smi -pm 1 to enable persistence mode.
Node Software Crashes: Check system logs for memory errors or GPU driver crashes. Insufficient system RAM is a common cause — DePIN node software typically requires significant memory in addition to the GPU VRAM. Monitor system memory usage during operation and upgrade if you see swap usage exceeding a few percent.
Connection Issues: Verify your firewall rules allow outbound connections to the DePIN network’s endpoints. Some networks use peer-to-peer connections that require specific port forwarding on your router. Check the network’s documentation for required ports and ensure your ISP is not blocking them.
Earnings Lower Than Expected: Compare your GPU’s benchmark scores against the network’s average. Lower-performance GPUs earn proportionally less. Also check that your node is not being penalized for downtime — even brief disconnections can reduce your reliability score and earnings. The io.net network rewards consistent uptime, so investing in a UPS and redundant internet connectivity can significantly improve earnings.
Mastering the Skill
Running a secure, high-performing DePIN node requires ongoing attention and adaptation. As networks evolve their security protocols — as io.net did when it accelerated its Auth0 and OKTA integration following the April incident — you must update your configuration accordingly. Join the community channels for your chosen networks to stay informed about security updates, software patches, and best practice changes.
Consider running nodes on multiple DePIN networks to diversify your earning streams and reduce reliance on any single platform. Each network has unique security considerations, and the skills you develop securing one node transfer to others. As the DePIN sector grows, the demand for experienced, reliable node operators will increase, creating opportunities for those who invest in mastering the technical and security aspects of decentralized infrastructure participation.
Disclaimer: This article is for educational purposes only and does not constitute financial or technical advice. Always conduct your own research and consult with appropriate professionals before deploying infrastructure or investing in cryptocurrency.
running the wallet machine on a pi zero with no internet facing services is the move. saved my IO tokens when the rig got compromised through a docker vuln
Kemal Yilmaz pi zero wallet setup is clutch. ran the same config for render nodes. the 50 dollar insurance policy for 10k worth of tokens
the io.net security incident happened literally days before the launch. timing was brutal but at least they disclosed it publicly
the timing of the security incident was brutal but full public disclosure actually built more trust. most projects would have tried to bury it
public disclosure within days of the token launch took guts. most founders would have lawyered up and buried it
io.net security incident days before launch and they still did full disclosure. rare in this space where founders usually lawyer up
The section on firewall rules is solid. Most guides skip this entirely and just tell you to open everything which is how you end up in a botnet.
Amir Rashid the firewall config alone should be its own post. most DePIN setup guides just say open ports 443 and pray
the firewall section saved me. was about to open all ports like an idiot. iptables rules for specific io.net endpoints only, everything else drop
gpu_sweat the iptables approach should be default in every DePIN guide. most tutorials still say open ports and hope for the best
gpu_sweat the iptables approach is underrated. most DePIN guides just say open ports and pray. specific endpoint rules should be the standard
Amir Rashid the firewall section is underrated. most DePIN guides say open these ports and pray. specific iptables rules for io.net endpoints should be mandatory reading
Daan V. most DePIN tutorials still say open ports 4001 to 4004 and move on. the fact that specific iptables endpoint rules need to be spelled out in 2026 tells you how bad the baseline is
been running a node since the io.net beta. biggest lesson: keep your wallet on a separate machine from the GPU rig. learned that the expensive way
separate machine for wallets should be rule #1 for any DePIN setup. hardware wallets on the rig is asking for trouble
nosleep_42 wallet on a separate machine is rule zero. I use a 10 dollar linux stick for signing and the GPU rig has no access to any keys whatsoever
separate machine rule is non-negotiable. i run a raspberry pi for wallet ops and the GPU rig has zero crypto access. saved me during the io.net incident
Anatoli G. been running the same raspberry pi wallet separation for 8 months. costs less than a tank of gas and saves your entire operation if the rig gets hit
Anatoli G. been running the same pi separation for 14 months. the npm package attack vector is scarier than GPU access though. one bad dependency update and your rig mines for someone else
the raspberry pi wallet setup is clever. costs 50 bucks and saves you from losing everything if your rig gets compromised
thermal_gap_ the 50 dollar pi setup is the best risk adjusted trade in DePIN. saved my tokens when my rig got hit through a compromised npm package
the raspberry pi wallet setup is genius for $50. saved my bags when my mining rig got compromised last august
thermals_ the raspberry pi wallet trick saved me $4k last september. mining rig got compromised but the attacker couldnt reach the rewards wallet
been running an io.net node since beta. npm package compromise was the scariest part, not the GPU setup itself
the firewall rules section alone is worth more than most paid DePIN courses. every setup guide I see just says open ports 4001-4004 and call it a day
io.net disclosing the incident before token launch was either brave or legally required. either way it set a standard other DePIN projects should follow
Ingrid B. full disclosure before token launch set a standard most DePIN projects would never meet. most would bury it and hope nobody notices