Northern Minnesota Man Indicted for “Cryptojacking” Scheme

MINNEAPOLIS - A northern Minnesota man has been indicted for an illegal "cryptojacking" scheme that caused significant financial losses, announced U.S. Attorney Andrew M. Luger.

According to court documents, in February 2020, Joshua Paul Armbrust, 44, of Orr, Minnesota, resigned from his employment at Digital River, a Minnetonka-based global e-commerce and payment processing company. After leaving his job, between December 2020 and May 2021, Armbrust engaged in a cryptojacking scheme using accounts belonging to his former employer. Cryptojacking is a form of cybercrime where an unauthorized party uses someone else's computing resources to mine cryptocurrency, such as Bitcoin or Ethereum, by leveraging the victim's hardware, which can lead to reduced system performance, increased energy consumption, and higher operating costs.

As part of the scheme, Armbrust remotely accessed the company's Amazon Web Services (AWS) account on multiple occasions without authorization and utilized AWS computers to mine Ethereum cryptocurrency. This unauthorized access resulted in substantial costs for the company, totaling over $45,000. The mined Ethereum was directed into a digital wallet and subsequently transferred to two Coinbase accounts registered solely in Armbrust's name. Armbrust then liquidated the mined Ethereum, totaling over $7,000, and transferred the proceeds to his Wells Fargo banking account.

The indictment charges Armbrust with one count of computer fraud. Armbrust made his initial appearance on November 1, 2024, in U.S. District Court before Magistrate Judge John F. Docherty.

This case is the result of an investigation conducted by the FBI.

Assistant U.S. Attorney Bradley M. Endicott is prosecuting the case.

An indictment is merely an allegation and the defendant is presumed innocent until proven guilty beyond a reasonable doubt in a court of law.