Reads like a ponzi scheme
however it is also entirely unsurprising... and it is also not economically sensible for these 9 to stay sat on a large hoard. Money only really works if its being churned around and spent after all.
Mining internet currency on websites with Coinhive scripts is a lucrative endeavor, but only for a handful of people. This according to researchers from RWTH Aachen University, who used a new detection technique to track pages mining the cryptocurrency and found that [PDF] just 10 users were responsible for 85 per cent of the …
They probably aren't sat on a large hoard, like most miners they probably exchange their coins into their preferred coin of choice. I am pretty certain they would be spending a chunk of the money as it comes in as well, I doubt there is a hoard anywhere, I mean it's not hard to spend crypto currencies online.
There is a large amount of XMR to be mined and CoinHive users are only mining a small fraction of it. The currency is far larger than just this web mining.
Imagine it like this. You own a movie theater, TPB. You have some magic setup so that patrons are handed a pick-axe as they enter, which they have to use to mine gold while they browse movies at TPB. You collect all the gold patrons mine while in your theater. There are other establishments running this same system of requiring pick-axe mining while in their establishment but not many have as many patrons to really compare with TPB. The are also a few enterprising people who have slipped the magic pick-axes into lots of different establishments and are collecting the gold unbeknown to the actual owners. That is just the CoinHive pick-axe mining though. Much more is being mined by professional miners with proper machines and stuff.
Also I would expect the vast majority of these XMR are being sold for fiat $. If you're referring to CoinHive's 30% cut as being ponzi-esque it's not. Think of it as a fee for renting the pick-axes. They are providing a service, that's all. There aren't multiple levels. Not an MLM, pyramid, or ponzi.
85% of links might be created by a few people, but that doesn't mean those people are actually getting anything out of it. If most of those links are being unknowingly inserted into whatever sites happen to be vulnerable, most of them likely see very little use at all. A single link on a really popular site could easily be making more than all of those 85% combined.
"They did use Alexa ranking, I assume to estimate traffic..."
No, they simply used the Alexa top 1 million list as one of their datasets, along with .com, .net and .org. More to the point, while they looked at unique users (or at least unique tokens, they do note that people could be using more than one) and link destinations, they don't say anything at all about where the links were actually placed, which is obviously the important thing for figuring out how much they might be used. A single page full of thousands of links created by one person could easily give that person 85% of all Coinhive links, but it wouldn't mean they're making the most money from them. Reality is unlikely to be quite that extreme, but a campaign of spamming links around forums and comment sections on small sites could easily give a similar effect.
You're way off. It would only be MLM if it required the top players to recruit distributors who then recruit a next level of distributor and so on. A Ponzi scheme can be and usually is a "flat" structure, although it can involve subsidiary reselling or recommendations.
There's also the key difference that MLM is based on maths that has to have a level who make little or nothing (so largely expectations fraud rather than direct misrepresentation), whereas a Ponzi scheme is simply attracting capital that is then used to pay out fictitious benefits to maintain an illusion of investment returns (so wholly and intentionally misrepresentation).