In brief
In April, Armbrust pled guilty to computer fraud after using his ex-employer’s AWS account to mine Ethereum.
Armbrust was sentenced to three years of probation and ordered to repay the full amount, court records show.
The mining operation cost his former employer over $45,000 in cloud fees while netting him about $5,800 in crypto.
A former engineer at e-commerce company Digital River was sentenced Tuesday to three years of probation for illegally mining crypto using his former employer’s cloud servers.
Joshua Paul Armbrust, 45, was sentenced by U.S. District Judge Jerry Blackwell after pleading guilty in April to a felony count of computer fraud documented by the U.S. Attorney’s Office for the District of Minnesota, with initial reporting on the sentence from local media outlet Duluth News Tribune.
After resigning from Digital River in February 2020, Armbrust continued accessing the company’s Amazon Web Services account between December 2020 and May 2021, running a program that mined cryptocurrency without authorization.
Armbrust “remotely accessed the company’s Amazon Web Services account on multiple occasions without authorization and utilized AWS computers to mine Ethereum cryptocurrency,” the DOJ’s announcement reads.
Defense attorney William J. Mauzy said Armbrust’s actions took place “during a time of extreme financial need and considerable emotional distress,” as he cared for his ailing mother, who has since died.Mauzy argued Armbrust was not a “malicious hacker” but instead was someone acting out of “desperation and despair,” noting how his client made no attempt to conceal the activity and had taken full responsibility for the losses.
Prosecutors said the operation generated more than $5,800 worth of Ethereum, which Armbrust converted for personal use, while Digital River incurred about $45,270 in cloud-service costs before the activity was discovered.
Decrypt reached out to the U.S. Attorney’s Office for the District of Minnesota to request a copy of the sentencing documents and confirm details. Efforts were made to procure comments from Armbrust’s legal representatives.
It’s worth noting that Armbrust was mining at a time when Ethereum still relied on a proof-of-work system, which demanded significant computing power and energy use, before its transition to proof-of-stake in September 2022.
He was indicted in November 2024 on one count of computer fraud for a “cryptojacking” scheme resulting in “significant financial losses,” according to the U.S. Attorney Andrew M. Luger.
Cryptojacking, per the DOJ’s 2024 definition, is a form of cybercrime where an unauthorized individual or party “uses someone else’s computing resources to mine cryptocurrency, such as Bitcoin or Ethereum,” by leveraging a victim’s hardware.
Armbrust’s covert crypto mining scheme used Digital River’s resources “between 6 p.m. and 7 a.m. daily” and transferred the Ethereum to his own crypto wallet, according to Endicott.
Prosecutors said Armbrust’s actions were not a “momentary lapse in judgment” but a deliberate misuse of company computing resources for personal gain, causing real financial losses and operational disruption.
Digital River filed for insolvency for its German subsidiaries in January at the Cologne Insolvency Court, after losing access to a revolving credit facility earlier that month.
The company has since closed its Minnesota headquarters, suspended most of its global services, and begun winding down its operations.
Decrypt has reached out separately to Digital River for comment on their former employee’s actions and sentencing.
Daily Debrief Newsletter
Start every day with the top news stories right now, plus original features, a podcast, videos and more.
