Joshua Samuel Aaron, one of five co-conspirators who hacked into the highly secure servers of the nation’s largest financial institutions and controlled a small credit union to conceal an illegal Bitcoin operation that was generating $30 million a month in ACH payments, was arrested Wednesday at JFK International Airport.
Preet Bharara, U.S. Attorney for New York’s Southern District in Manhattan, said Aaron is expected to appear before a U.S. District Court Judge Thursday morning.
Aaron, 32, an American citizen, had been living in Moscow, Russia. Authorities there took him into custody and flew him back to the U.S.
“Joshua Samuel Aaron allegedly worked to hack into the networks of dozens of American companies, ultimately leading to the largest theft of personal information from U.S. financial institutions ever,” Bharara said.
In addition to Aaron, Yuri Lebedev, Anthony R. Murgio, Gery Shalon, Joshua Samuel and Ziv Orenstein allegedly operated a sprawling criminal enterprise that raked in hundreds of millions of dollars.
Shalon and Orenstein were arrested by Israeli authorities in July 2015 and were extradited from Israel in June 2016.
From 2012 to mid-2015, the leader of the criminal enterprise, Gery Shalon, allegedly orchestrated massive computer hacking crimes against seven U.S. financial institutions, including JPMorgan Chase Bank, national investment brokers Scott Trade and E*Trade, and the Dow Jones & Co. The other financial institutions were not identified in court documents.
Federal prosecutors said personal information belonging to more than 100 million customers of these financial institutions was stolen. Of that total, JP Morgan Chase accounts for 76 million households and seven million small businesses that were compromised.
Shalon, Aaron and Orenstein allegedly used personal IDs they had stolen to send out emails to unsuspecting investors to promote and pump up the price of publicly traded penny stocks that the three men and others owned. Once the price of the penny stock increased over the course of days or weeks, Shalon, Aaron and Orenstein dumped their shares, often resulting in millions of dollars in profits while exposing investors to significant losses.
The three were indicted on multiple felony counts of wire, computer, identity fraud and money laundering. Murgio was also charged with several felony counts of money laundering, bribery, wire fraud and conspiracy. In addition, Murgio’s father, Michael J. Murgio of Florida, was charged with bribery and wire fraud charges in connection to the credit union. Lebedev was charged with felony counts of bribery and making bribes to influence a financial institution officer.
This group of men also allegedly operated Coin.mx, which allowed customers to exchange cash for Bitcoins. Starting in October 2013, Coin.mx exchanged millions of dollars for Bitcoins for customers across the U.S., prosecutors alleged.
Murgio set up a fake association to hide the Bitcoin exchange scheme. To open bank accounts needed to manage Coin.mx’s huge cash flows, Murgio told major financial institutions that he was operating a members-only association that bought and sold collectable items such as stamps and sports memorabilia.
In 2014, to continue hiding Coin.mx’s illegal operations, the men made more than $150,000 in bribes to Trevon Gross, former board chair of the failed Helping Other People Excel Federal Credit Union of Jackson, N.J. Gross, who is also a pastor at Hope Cathedral in Jackson, placed individuals on the board from the Coin.mx organization. This allowed the company to control the credit union and conceal its Bitcoin operations.
After the Coin.mx business was integrated into the operations of the credit union, which had just $290,000 in assets and 96 members, it was processing more than $30 million a month in ACH payments, according to court documents.
Gross was indicted on bribery charges in March.
Court documents showed Gross was becoming worried about the “tap dancing” he and others were doing to avoid raising concerns among federal regulators about the payment processing activities Murgio and others were conducting through the cooperative.
“We can’t certify that all the people we let [pass] money through this credit union … weren’t doing something illegally with the money,” Gross wrote in an email to Murgio.
He also acknowledged the credit union had not performed appropriate Bank Secrecy Act procedures and, as a result, the credit union’s account may have been used for money laundering and other crimes.
Although the NCUA learned the credit union was processing millions each month in ACH transactions, court documents did not say when the federal agency found out about it or when it forced the New Jersey cooperative to stop processing the ACH transactions.
The NCUA also required the credit union to remove the new board members appointed by Gross.
The NCUA liquidated the credit union in November 2015.
