Ex-Employee Pleads Guilty in $45K ‘Cryptojacking’ Scheme

Apr 2

A Minnesota man has pleaded guilty for illegally accessing his former employer’s cloud computing accounts and using them to mine cryptocurrency.

Joshua Paul Armbrust, 44, of Orr, admitted Tuesday in U.S. District Court to one count of computer fraud tied to a months-long “cryptojacking” scheme carried out against Digital River, a Minnetonka-based e-commerce and payment processing company where he’d previously worked.

According to federal prosecutors, Armbrust resigned from Digital River in Feb. 2020 and later began accessing the company’s Amazon Web Services (AWS) accounts without permission. Between Dec. 2020 and May 2021, Armbrust used AWS resources tied to Digital River to mine Ethereum, a form of cryptocurrency, for his personal gain.

Prosecutors said the unauthorized access and mining operation racked up more than $45,000 in charges to the company. The mined cryptocurrency—valued at just over $7,000—was funneled into a digital wallet and then transferred to Armbrust’s Coinbase account before being liquidated into his personal Wells Fargo bank account.

FREE > Sign up for the MN CRIME newsletter

Federal investigators said Armbrust repeatedly accessed the AWS accounts remotely to continue the scheme, leveraging high-powered computing infrastructure without the company’s knowledge. Cryptojacking, the term used to describe this type of cybercrime, allows an unauthorized party to exploit another’s computing power to generate digital currency—typically leading to increased energy usage, diminished system performance and unexpected financial costs for the victim.

The U.S. Attorney’s Office described Armbrust’s actions as a clear misuse of his technical skills for personal profit:

“Cryptojacking is simply high-tech thievery,” said Acting U.S. Attorney Lisa D. Kirkpatrick in a statement. “Cybercriminals like Armbrust—who use their technical skills to victimize others—will continue to see federal justice.”

The FBI led the investigation and the case is being prosecuted by Assistant U.S. Attorney Bradley M. Endicott. A sentencing hearing has not yet been scheduled.

Digital River announced earlier this year that it would be shutting down its operations and laying off more than 120 employees, beginning at the end of March. The company went public in 1998 and was acquired by Siris Capital Group in 2015 for around $840 million.

> See more of our latest coverage