Dedicated server hacked for bitcoin mining

So, I rented a VPS, updated Debian distro and installed Valheim dedi server. Nothing else. A week later, it suddenly stopped working. I restart, and to my surprise notice that it uses 500% CPU (probably because its a VPS) and 100% memory. Very strange, I kill the process but the memory is still in use. So I search for process :

root@server:/home/valheim/.configrc4/a/tors# ps -eaf | grep valheim
valheim      878       1  0 Dec14 ?        00:00:00 rsync
valheim      893       1  0 Dec14 ?        00:00:03 ./bin/tor -f etctor/tor/torrc1 --RunAsDaemon 1

What, I didn't install tor… And then I find this :

root@server:/home/valheim/.configrc4/a/tors# ls
bin  cleandirs.sh  etctor  libtor  share  start.sh  stop.sh

Libtor huh ? https://github.com/MagicalBitcoin/libtor

So yeah… I have no idea how that got installed. There is no mods, nothing else but a valheim server running on a naked server 1 week old.

Check your server guys, especially if you manage them yourselves