Cryptojacking Incident: Former Digital River Employee Misused Company Resources for Personal Ethereum Profit

A former employee of Digital River, Joshua Paul Armbrust, has been ordered to reimburse over $45,000 after misusing company systems to mine cryptocurrency. Armbrust, aged 45, was sentenced to three years’ probation by US District Judge Jerry Blackwell after admitting guilt to a felony charge of computer fraud.

Armbrust’s Covert Mining Scheme Exposed

Court documents reveal that Armbrust exploited the company’s resources unlawfully for over a year after his departure from Digital River in February 2020. He used the firm’s Amazon Web Services (AWS) account to mine Ethereum, yielding earnings of $5,895 while costing Digital River about $45,270.

The scheme came to light during an internal review when unusual AWS charges were traced back to Armbrust’s IP address, indicating he had run mining scripts on company servers during late-night hours long after he had left.

Assistant US Attorney Jordan Endicott remarked that the actions were not a simple misjudgment but a premeditated misuse of company resources for personal gain.

“The defendant’s conduct strikes at the core of digital trust and security in the modern economy. Unauthorized access to corporate cloud infrastructure not only creates financial harm but may expose sensitive systems to greater cybersecurity threats.”

Desperate or Calculated?

Defense attorney William Mauzy argued that Armbrust’s actions stemmed from desperation, related to financial struggles while caring for his ill mother. Mauzy pointed out that Armbrust didn’t intend harm, promptly admitted his actions and their consequences.

At the time of his indictment in November 2024, Armbrust lived in Orr, Minnesota, and has since relocated to St. Paul where he currently works in insurance. Both defense and prosecution recommended probation due to his clean prior record and cooperation with law enforcement.

Judge Blackwell noted that Armbrust’s skills could have been beneficially directed, pointing out the lost potential. The case highlights the importance of securing access to IT resources to deter long-term exploitation by former employees.

Cryptojacking—where hackers secretly mine cryptocurrency using victims’ computing power—remains a critical threat. A notorious example is Coinhive, used until its shutdown in March 2019, which was linked to the majority of such attacks.