Ethereum

Jerry

River

April

Gains

A former Digital River employee has been ordered to pay more than $45,000 back to his previous employer after unlawfully using company computing systems to mine cryptocurrency.
Joshua Paul Armbrust, 45, was sentenced Tuesday to three years’ probation by US District Judge Jerry Blackwell, following his April guilty plea to a felony computer fraud charge.
<h2 id="armbrust-s-covert-mining-scheme-exposed">Armbrust’s Covert Mining Scheme Exposed</h2>
According to court filings, Armbrust <a href="https://www.duluthnewstribune.com/news/local/former-northland-man-sentenced-for-cryptojacking-scheme" rel="noopener noreferrer nofollow">continued</a> exploiting Digital River’s resources for over a year after leaving the Minnetonka-based e-commerce and payment processing firm in February 2020. He mined Ethereum using the company Amazon Web Services (AWS) credentials, which fetched him an earnings of $5,895 while incurring $45,270 in costs to Digital River.
The activity was uncovered during an internal investigation by Digital River, which shut down operations in January. Reviewers noticed unusual AWS fees and traced the activity to Armbrust’s IP address. This revealed that he had consistently run mining scripts on company servers between 6 p.m. and 7 a.m., long after his departure.
Assistant US Attorney Jordan Endicott said that it was “not a momentary lapse in judgment” but a “calculated and covert misuse of enterprise-level computing resources for private enrichment.”
<blockquote>
 “The defendant’s conduct strikes at the core of digital trust and security in the modern economy. Companies rely on former employees to act ethically, even after separation, and to respect corporate systems and data. Unauthorized access to corporate cloud infrastructure not only creates financial harm, as in this case, but also exposes sensitive systems to potential compromise and opens the door to more severe cyber threats.”
</blockquote>
<h2 id="desperate-or-calculated">Desperate or Calculated?</h2>
Defense attorney William Mauzy described Armbrust’s conduct as driven by desperation rather than greed. Mauzy said Armbrust faced severe financial pressure while caring for his terminally ill mother, who has since passed. He added that Armbrust did not attempt to damage systems, hide his actions, and accepted responsibility for losses.
At the time of his indictment in November 2024, Armbrust was living in Orr, Minnesota. He has since moved to St. Paul, where he now works in the insurance sector. Both the prosecution and defense recommended a probation sentence under the plea deal, citing his clean record and cooperation with authorities.
Judge Blackwell remarked that Armbrust’s technical talents could have been applied lawfully, pointing to the wasted potential. The outcome underscores the need for companies to secure access to computing resources and prevent long-term misuse by former employees.
Cryptojacking, also called malicious cryptomining, still <a href="https://cryptopotato.com/cryptojacking-attacks-skyrocketed-by-400-in-h1-2023-sonicwall-report/" rel="noopener noreferrer nofollow">remains</a> a critical threat vector. It’s a cyber threat where hackers secretly use a computer or mobile device to mine cryptocurrency. Before its shutdown in March 2019, Coinhive was a widely <a href="https://cryptopotato.com/cryptojacking-attempts-surge-in-q2-2020-as-bitcoin-price-increases/" rel="noopener noreferrer nofollow">used</a> cryptojacking tool and was estimated to be involved in more than two-thirds of all such attacks.
The post <a href="https://cryptopotato.com/cryptojacking-scandal-ex-digital-river-worker-exploited-company-systems-for-personal-ethereum-gains/" rel="noopener noreferrer nofollow">Cryptojacking Scandal: Ex-Digital River Worker Exploited Company Systems for Personal Ethereum Gains</a> appeared first on <a href="https://cryptopotato.com/" rel="noopener noreferrer nofollow">CryptoPotato</a>.

Cryptojacking Scandal: Ex-Digital River Worker Exploited Company Systems for Personal Ethereum Gains

Table of Contents

CryptoPotato_News

Other articles published on Oct 22, 2025

Join our free newsletter for daily crypto updates!