TBF, it’s more likely just overconfidence/incompetence. Cracks are OFTEN flagged by AV, and it’s usually nothing malicious. The guys at 1337x aren’t dumb enough to think a crypto miner wouldn’t be found pretty quickly.
Hanlon’s Razor: Never attribute to malice that which is adequately explained by stupidity.
Maybe, it’s definitely a possibility. What’s weird is the original uploader (https://1337x.to/user/VitaminX/) remains unaffected and users were reporting this up to 3 days before it was taken down with very compelling evidence - the miner was barely hidden and only when it blew up on Reddit was any action taken.