Cryptojacking Mastermind Arrested in Ukraine

Reading Time: < 1 minute
  • The National Police of Ukraine and Europol recently arrested a prolific cryptojacker
  • The perpetrator stole some $2 million worth of cryptocurrencies when they infiltrated a cloud mining provider
  • Cryptojacking has experienced a rebirth in recent months

The National Police of Ukraine, in collaboration with Europol and a cloud provider, recently announced the arrest of a 29-year-old individual believed to be the mastermind behind an intricate cryptojacking scheme. The arrest, executed in Mykolaiv, Ukraine, on January 9, followed months of cooperation to identify and locate the individual orchestrating the widespread cryptojacking operation. The suspect, accused of mining over $2 million in cryptocurrencies, now faces years behind bars.

Hacker Infiltrated Cloud Mining Provider

The individual, who hasn’t been named, gained unauthorized access to cloud computing infrastructure to harness its computational power for cryptocurrency mining, exploiting this access to mine $2 million worth of coins and evading the substantial costs associated with servers and power needed for mining.

The impacted cloud provider initially approached Europol in January 2023, sharing information about compromised cloud user accounts. Europol, in turn, contacted Ukrainian authorities to initiate an investigation, with the collaboration between law enforcement and the cloud provider playing a pivotal role in uncovering the scheme and pinpointing the individual. 

Cryptojacking Making an Unwelcome Return

The collaboration led to the perpetrator being identified and apprehended last week, with Europol’s European Cybercrime Centre setting up a virtual command post on the day of the arrest, providing analytical and forensic support to the Ukrainian National Police from Europol’s headquarters.

Cryptojacking was extremely common during the proof-of-work boom in 2016-18, but it was thought to have died off along with the drop in popularity of mineable coins. However, six months ago it was seen to have returned, as this arrest shows.