Hacked routers running the Coinhive script for mining cryptocurrency have been injected with new code to mint digital coins after the service shut down. The service was essential in establishing connections between a client and a server, so no mining is possible now. Despite the number of hacked routers going down significantly, there are hundreds of them that still have the coinhive code. Malwarebytes says that recent telemetry data still shows an average of 50,000 mining blocks per day. Another service, CoinIMP, is also mining cryptocurrency, although not at the rate recorded in 2017.
Source: https://www.bleepingcomputer.com/news/security/coinhive-dead-but-browser-based-cryptomining-still-a-threat/