15,000 Americans caught up in massive cybercrime money laundering scheme

An international criminal operation tricked thousands of Americans into laundering millions of dollars stolen by hackers, using fake jobs to move the money overseas.

A Ukrainian-Russian dual citizen has pleaded guilty to running an international money laundering operation that recruited more than 15,000 people in the United States to help cybercriminals move stolen money out of the country.

According to the US Department of Justice, the criminal network laundered at least $10 million stolen by hackers from more than 750 US bank accounts, using Americans tricked into thinking they had landed legitimate jobs.

Key takeaways

• Oleg Korniev, 42, pleaded guilty to running an international money laundering operation serving cybercriminals
• The network recruited more than 15,000 US-based money mules to help move stolen funds overseas
• Victims were tricked into believing they worked for legitimate businesses processing payments
• The organization helped launder at least $10 million stolen from more than 750 US bank accounts
• Korniev faces up to 50 years in prison, with sentencing to be scheduled
• Job offers asking people to receive and forward money through personal bank accounts are a major red flag

A money laundering service for hackers

Oleg Korniev, 42, pleaded guilty on Oct. 8 to operating a sophisticated money laundering organization known as Your Mule Cashout (YMCO).

The operation provided a crucial service to cybercriminals: turning money stolen from American businesses into funds that could be transferred overseas while obscuring their criminal origins.

According to court documents, YMCO maintained an elaborate network of money mules and online infrastructure that allowed hackers to transfer stolen funds, primarily to Eastern European countries.

A money mule is someone who receives and transfers money on behalf of another person or organization, often helping criminals hide the origins of illegally obtained funds.

Some money mules knowingly participate in criminal activity. Others are recruited through fake job ads, online relationships, or fraudulent business opportunities and have no idea they are helping criminals.

In return for its money laundering services, YMCO took a percentage.

The organization functioned much like a business, with Korniev helping establish internal policies, hiring and firing employees, managing performance, and securing illegal services to support its activities.

Korniev admitted that YMCO was responsible for more than $14.7 million in actual and intended losses involving confirmed victims. He also acknowledged personally laundering at least $7 million and intending to launder more than $9.7 million.

Thousands of Americans tricked into laundering stolen money

Perhaps the most striking aspect of the operation is how it recruited ordinary Americans.

YMCO deceived people into believing they were working for legitimate companies that needed help processing business payments.

The supposed employees were instructed to receive payments into their personal bank accounts, withdraw the money, and wire the funds to business partners overseas.

In reality, they were handling money stolen by hackers.

The arrangement allowed cybercriminals to move illicit funds through legitimate US bank accounts before sending them abroad, making the transactions harder to trace.

To make matters worse, according to the DOJ, the people recruited into the scheme never received the payments they had been promised.

Korniev faces up to 50 years in prison

Korniev pleaded guilty to five offenses, including conspiracy to commit money laundering, money laundering, conspiracy to commit computer fraud, conspiracy to commit access device theft, and aggravated identity theft.

He faces a minimum prison sentence of two years and a maximum of 50 years. A sentencing date has not yet been announced.

As part of his plea agreement, Korniev agreed to compensate known victims for their actual losses and forfeit cash seized when he was arrested in the Republic of Georgia.

Four other people connected to YMCO were arrested overseas earlier, extradited to the United States, and convicted of conspiracy to commit money laundering.

They received prison sentences ranging from 37 to 63 months and were each ordered to pay more than $9.1 million in restitution.

“Money mules play crucial roles in cybercrime, so the Justice Department pursues mules and their recruiters wherever they operate and however long it takes,” said Assistant Attorney General A. Tysen Duva of the Justice Department’s Criminal Division.

“Alongside our international partners, we will dismantle criminal networks that attack Americans. No amount of distance or time puts these criminals beyond the reach of justice.”

How to avoid becoming a money mule

The YMCO case is a reminder that not every cybercrime victim loses money directly to hackers. Some people are manipulated into helping criminals move stolen funds, potentially exposing themselves to serious financial and legal trouble.

Here are some precautions worth taking:

• Be suspicious of jobs involving your personal bank account. Legitimate employers generally don't need employees to receive company payments into personal accounts and forward the funds elsewhere
• Research unfamiliar employers. Verify the company's website, business registration, contact information, and recruitment process before accepting an offer
• Watch for unusually easy money. Offers promising generous commissions for receiving and transferring payments, with little actual work involved, are a major red flag
• Never forward money for someone you don't know or trust. This applies to supposed employers, online acquaintances, and people claiming to need help with international transfers
• Be wary of unexpected recruitment messages. Scammers often approach potential victims through social media, messaging apps, and unsolicited emails
• Act quickly if you suspect you've been recruited. Stop transferring funds, contact your bank, preserve relevant messages and transaction records, and report the activity to law enforcement

If you've already transferred money as part of a suspicious job arrangement, don't assume that simply ending contact will resolve the situation. Your bank may need to investigate the transactions and secure your account.

In the United States, suspected cyber-enabled financial crimes can be reported to the FBI's Internet Crime Complaint Center (IC3).

On topic:

700-person scam empire brought down by Dutch police

Ransomware recovery boss accused of secretly paying hackers

The money trail behind investment scams