MN Man Left Job To Engage In 'Cryptojacking': Feds

ST. PAUL, MN — A St. Paul man has admitted to an illegal "cryptojacking" scheme that caused significant financial losses to his former employer, announced Acting U.S. Attorney Lisa D. Kirkpatrick.

"Cryptojacking is simply hi-tech thievery," said Kirkpatrick in a statement. "Cybercriminals like Armbrust—who use their technical skills to victimize others—will continue to see federal justice."

Joshua Paul Armbrust, 44, pleaded guilty Tuesday in U.S. District Court before Judge Jerry W. Blackwell to one count of computer fraud. A sentencing hearing will be scheduled at a later date.

In February 2020, Armbrust, formerly of Orr, Minnesota, resigned from his job at Digital River, a Minnetonka-based global e-commerce and payment processing company.

After leaving his job, Armbrust began a cryptojacking scheme using accounts belonging to his former employer, authorities said.

Federal authorities describe cryptojacking as a form of cybercrime where an unauthorized party uses someone else's computing resources to mine cryptocurrency, such as Bitcoin or Ethereum, by leveraging the victim's hardware, which can lead to reduced system performance, increased energy consumption, and higher operating costs.

As part of the scheme, Armbrust remotely accessed the company’s Amazon Web Services (AWS) account on multiple occasions without authorization and utilized AWS computers to mine Ethereum cryptocurrency, authorities said.

The unauthorized access resulted in substantial costs for the company, totaling over $45,000, according to investigators.

The mined Ethereum was directed into a digital wallet and subsequently transferred to Armbrust’s Coinbase accounts, prosecutors said.

Armbrust then liquidated the mined Ethereum, totaling over $7,000, and transferred the proceeds to his Wells Fargo banking account, authorities said.

This case is the result of an investigation conducted by the FBI. Assistant U.S. Attorney Bradley M. Endicott is prosecuting the case.