11/05/2024

Northern Minnesota Man Indicted for “Cryptojacking” Scheme

United States Attorney's Office District of Minnesota

MINNEAPOLIS – A northern Minnesota man has been indicted for an illegal “cryptojacking” scheme that caused significant financial losses, announced U.S. Attorney Andrew M. Luger.

According to court documents, in February 2020, Joshua Paul Armbrust, 44, of Orr, Minnesota, resigned from his employment at Digital River, a Minnetonka-based global e-commerce and payment processing company. After leaving his job, between December 2020 and May 2021, Armbrust engaged in a cryptojacking scheme using accounts belonging to his former employer. Cryptojacking is a form of cybercrime where an unauthorized party uses someone else's computing resources to mine cryptocurrency, such as Bitcoin or Ethereum, by leveraging the victim's hardware, which can lead to reduced system performance, increased energy consumption, and higher operating costs.

As part of the scheme, Armbrust remotely accessed the company’s Amazon Web Services (AWS) account on multiple occasions without authorization and utilized AWS computers to mine Ethereum cryptocurrency. This unauthorized access resulted in substantial costs for the company, totaling over $45,000. The mined Ethereum was directed into a digital wallet and subsequently transferred to two Coinbase accounts registered solely in Armbrust’s name. Armbrust then liquidated the mined Ethereum, totaling over $7,000, and transferred the proceeds to his Wells Fargo banking account.