Minnesota Man Pleads Guilty in “Cryptojacking” Scheme

ST. PAUL, Minn. - Joshua Paul Armbrust, currently of St. Paul, Minnesota, pleaded guilty for his role in an illegal "cryptojacking" scheme that caused significant financial losses, announced Acting U.S. Attorney Lisa D. Kirkpatrick.

According to court documents, in February 2020, Joshua Paul Armbrust, 44, formerly of Orr, Minnesota, resigned from his employment at Digital River, a Minnetonka-based global e-commerce and payment processing company. After leaving his job, between December 2020 and May 2021, Armbrust engaged in a cryptojacking scheme using accounts belonging to his former employer. Cryptojacking is a form of cybercrime where an unauthorized party uses someone else's computing resources to mine cryptocurrency, such as Bitcoin or Ethereum, by leveraging the victim's hardware, which can lead to reduced system performance, increased energy consumption, and higher operating costs.

As part of the scheme, Armbrust remotely accessed the company's Amazon Web Services (AWS) account on multiple occasions without authorization and utilized AWS computers to mine Ethereum cryptocurrency. This unauthorized access resulted in substantial costs for the company, totaling over $45,000. The mined Ethereum was directed into a digital wallet and subsequently transferred to Armbrust's Coinbase accounts. Armbrust then liquidated the mined Ethereum, totaling over $7,000, and transferred the proceeds to his Wells Fargo banking account.

"Cryptojacking is simply high-tech thievery," said Acting U.S. Attorney Lisa D. Kirkpatrick. "Cybercriminals like Armbrust-who use their technical skills to victimize others-will continue to see federal justice."

Armbrust pleaded guilty yesterday in U.S. District Court before Judge Jerry W. Blackwell to one count of computer fraud. A sentencing hearing will be scheduled at a later date.

This case is the result of an investigation conducted by the FBI.

Assistant U.S. Attorney Bradley M. Endicott is prosecuting the case.