Your Antminer model is not enough

The label can be right and the file can still be wrong

One label on the case. One download button. It looks simple.

Say an operator reads Antminer T21 on a machine and downloads a file labelled T21. The label may be right and the choice can still be wrong.

Why? Antminers in the same product line can use different control boards. The current VNISH catalog, for example, shows separate T21 routes for different board types. Bitmain also tells operators to identify the control board when a job needs board-specific firmware. The model name gets you close. It does not finish the job.

That is why the VNISH NINJA Firmware Dojo asks for more than a model name:

MODEL → BOARD → METHOD → VERSION → FILE → CHECKSUM → INSTALL

Every answer narrows the route and removes another place to guess.

A file can be correct for one route and wrong for the machine beside it. A checksum can tell you that the download has not changed. It cannot fix a bad choice. A rollback button only helps when the recovery route fits the board. Even a successful reboot proves less than most people think. The real test begins when the miner goes back to work.

The ninja rule is simple: identify first, move second.

The seven-part identity of a firmware build

Before a file reaches a miner, write down these seven fields. If one is unknown, the route is not ready.

1. Exact miner model

Use the physical label and the miner interface. Do not rely on a rack nickname, an old inventory row or the model somebody remembers buying.

Record the full designation. “S21” and “S21 Pro” are different products. Hydro and immersion variants are not interchangeable with air-cooled machines. A suffix can change the route.

Bitmain's current online-upgrade tutorial explicitly tells operators to confirm that the selected firmware matches the miner model before starting the upgrade. That check belongs at the beginning, not after an error message.

2. Control-board type

The control board is the mind of the miner. VNISH routes currently distinguish platforms including Amlogic (AML), CVITEK (CV), Xilinx (XIL) and BeagleBone (BB) where applicable.

Do not infer the board from the model alone. Use the board label, the hardware view in the install assistant or the identification method documented for that machine. Bitmain's support pages use board identifiers such as BB, AML and CV when directing operators to dedicated firmware.

If the board identity and the selected route disagree, stop. Do not test whether the file “might still work.”

3. Current firmware state

The machine's present software matters because installation paths change over time. A stock image may introduce signature restrictions, disable an interface or require a newer toolkit flow. A miner already running aftermarket firmware may have a different upgrade path from a stock unit.

Record:

• current firmware name and date;
• whether the machine is stock or already modified;
• whether SSH or the expected installation interface is available;
• any error reported by the installer;
• whether the exact board revision is unusual or uncertain.

For example, the current VNISH NINJA S21 Pro AML install kit warns that some recent stock images change the available installation route. It tells operators to use the documented toolkit flow and to contact support when the board revision is uncertain. If an unexpected lock appears, treat it as a clue. Stop and ask before you improvise.

4. Installation method

“Install VNISH” is an outcome, not a method.

Depending on the machine and its current state, the supported route may use a toolkit-based NAND installation, a web update, an SD-card recovery image or another board-specific procedure. The method shown by the Dojo must match the model and control board you actually have.

Never substitute a recovery image for a routine update merely because both are archive files. Never assume a process written for one board applies to another. And never interrupt power during a flash.

5. Release and build

Use the release selected by the current verified catalog for that route. As of 20 August 2026, the VNISH NINJA Dojo is serving 1.3.5-stable on the routes shown on the site. This is a dated observation, not a permanent instruction: the live route page is the source of truth when you install.

Record the complete filename, version and build identifier where one is published. “The latest file in Downloads” is not an audit trail.

The name tells you what it is:

• s21pro: model;
• aml: control board;
• nand: installation route;
• v1.3.5: release.

The filename is a useful cross-check. It does not replace the route page.

6. SHA-256 checksum

A firmware archive may pass through a browser, a download folder, a shared drive and an operator's laptop before it reaches the miner. The checksum answers one useful question: did those bytes change along the way?

SHA-256 produces a 256-bit digest. Compute it locally and compare the entire value with the one published on the exact VNISH NINJA route page. A one-character mismatch is a failed check.

A matching checksum proves that your file matches the file represented by the published checksum. It does not, by itself, prove that the source is trustworthy.

Start with the source. Download from the verified VNISH NINJA route, then compare its published digest. If the file and the checksum came from the same unknown message or mirror, you have not performed an independent check.

Do not shorten the value when you verify. The interface may abbreviate a checksum for display, but the comparison must use all 64 hexadecimal characters.

7. Recovery route

Do not enter a room until you know how to leave it.

Before the first write, confirm:

• where the stock-return control is located for this build;
• which settings will not survive rollback;
• whether you have recorded pools, workers and network details;
• whether the exact board has a separate SD recovery route;
• who will be present if the miner does not return to the network;
• where the verified recovery image comes from.

VNISH NINJA packages a return-to-stock path for supported builds. The normal route may take only a few minutes including reboot. That is not a universal promise for every failure state: a locked, interrupted or damaged board can require board-specific recovery and support. Verify the route for the machine in front of you.

What SHA-256 can and cannot tell you

People often ask a checksum to prove more than it can. Here is the clean version.

A matching SHA-256 answers:

“Is this download byte-for-byte consistent with the file represented by the published digest?”

It does not answer:

• whether you chose the right model;
• whether you identified the board correctly;
• whether the publisher is genuine;
• whether the build is appropriate for your cooling and power envelope;
• whether the machine is healthy enough to tune;
• whether a third-party firmware installation is covered by your warranty.

That is why Checksum Cut follows Board Sight. Integrity is one gate in the route, not the whole route.

The ten-minute preflight card

Use this card before every first install. It is deliberately boring. At 02:00, boring beats a dead rack.

If a row says Hold, resolve it. If a row says Stop, stop.

One miner is a test. A fleet is a consequence

The first test belongs on one representative miner, not on a rack.

Bitmain's general firmware-update guidance recommends upgrading a small batch first and observing it for at least 24 hours before continuing. VNISH NINJA narrows the first move further: begin with one machine, learn the route, then expand to a small cohort.

Before the canary, capture a baseline:

• pool-side accepted hashrate over a defined window;
• wall power from a trusted measurement point;
• temperature and cooling state;
• hardware errors;
• rejected and stale shares;
• uptime, resets and watchdog events;
• pool, worker and network configuration.

After installation, do not jump straight to the most aggressive preset. Confirm that the machine is visible, pools are correct, boards and chips enumerate normally, temperatures are stable and the expected power reading makes sense. The current S21 Pro AML guide recommends beginning with an efficiency preset and watching the first day.

After 24 hours, you have a useful checkpoint. You do not have perfect statistical certainty. Pool-side hashrate comes from accepted shares and can stay noisy when the sample is small. Keep the test running if the range is still wide or if the conditions changed during the day.

Scale only when the evidence reconciles:

1. the device is stable;
2. accepted work is consistent with the local view over a useful window;
3. wall power produces a credible J/TH result;
4. temperatures, errors and resets remain inside your limits;
5. the rollback route has been tested or is ready;
6. the next cohort matches the canary's hardware identity.

A successful canary approves a similar cohort. It does not approve every Antminer in the building.

Five shortcuts that are not shortcuts

The VNISH NINJA route

The Dojo walks through the same preflight:

1. choose the exact Antminer model;
2. identify the control board;
3. select the supported installation method;
4. open the route-specific install kit;
5. download the named stable build;
6. verify the full SHA-256;
7. follow the route with rollback in reach;
8. test one miner before expanding.

No hashrate or efficiency improvement is guaranteed. Results depend on the individual miner, silicon condition, power delivery, cooling, ambient conditions, network, pool and selected profile.

The route, in one line

Read the label. See the board. Choose the method. Verify the file. Keep the gate open. Move one miner. Measure before you scale.

This is how a careful operator moves quickly without making the whole fleet pay for one guess.