Joshua Paul Armbrust, a resident of St. Paul, Minnesota, has pleaded guilty to his involvement in an illegal cryptojacking scheme, as announced by Acting U.S. Attorney Lisa D. Kirkpatrick. The scheme led to significant financial damage, primarily affecting Armbrust's former employer, Digital River.
Court documents reveal that in February 2020, Armbrust, aged 44 and previously from Orr, Minnesota, left his position at Digital River, a global e-commerce and payment processing business based in Minnetonka. Following his departure, from December 2020 to May 2021, Armbrust engaged in cryptojacking using accounts tied to Digital River. Cryptojacking is a cybercrime that involves unauthorized use of another's computing power to mine cryptocurrency, which can degrade system performance, increase energy usage, and elevate costs.
During the execution of the scheme, Armbrust gained unauthorized access to Digital River’s Amazon Web Services (AWS) account multiple times. He exploited AWS computers to mine Ethereum cryptocurrency, resulting in costs exceeding $45,000 for the company. The Ethereum generated was funneled into a digital wallet and later moved to Armbrust’s Coinbase accounts. Armbrust then liquidated the Ethereum, amounting to over $7,000, and transferred the funds to his Wells Fargo account.
"Cryptojacking is simply high-tech thievery," stated Acting U.S. Attorney Lisa D. Kirkpatrick. "Cybercriminals like Armbrust—who use their technical skills to victimize others—will continue to see federal justice."
Armbrust entered his guilty plea in the U.S. District Court before Judge Jerry W. Blackwell, admitting to one count of computer fraud. Details of his sentencing will be scheduled in the near future.
The investigation of this case was conducted by the Federal Bureau of Investigation, with prosecution by Assistant U.S. Attorney Bradley M. Endicott.