Money Mule Network Leader Pleads Guilty to Laundering Millions for Cybercriminals Worldwide
Oleg Korniev, 42, a dual citizen of Ukraine and Russia, pleaded guilty on October 8, 2026, to leading an international money laundering organization known as Your Mule Cashout (YMCO). According to the U.S. Department of Justice, YMCO recruited more than 15,000 U.S.-based money mules to launder funds that cybercriminals stole from more than 750 U.S. bank accounts at upwards of 35 banks, moving at least $10 million out of the country. Prosecutors say Korniev personally helped launder at least $7 million of the roughly $9.7 million he received from hackers, and that YMCO's activity caused more than $14.7 million in actual and intended losses to confirmed victims. He was arrested in the Republic of Georgia, where authorities seized cash tied to the scheme, and the case was prosecuted in the Western District of North Carolina following a years-long FBI investigation run out of its Charlotte field office.
Case Details
| Attribute | Value |
|---|---|
| Defendant | Oleg Korniev, 42 — dual citizen of Ukraine and Russia |
| Organization | Your Mule Cashout ("YMCO") |
| Charges | Conspiracy to commit money laundering; money laundering; conspiracy to commit computer fraud; conspiracy to commit access device theft; aggravated identity theft |
| Plea Date | October 8, 2026 |
| Court | U.S. District Court, Western District of North Carolina |
| Money Mules Recruited | 15,000+ U.S. residents |
| Victim Bank Accounts | 750+ accounts across 35+ U.S. banks |
| Funds Laundered (organization-wide) | At least $10 million |
| Funds Laundered (Korniev personally) | At least $7 million of ~$9.7 million received from hackers |
| Total Losses Attributed to YMCO | More than $14.7 million (actual and intended) |
| Sentencing Exposure | Minimum 2 years, maximum 50 years in federal prison |
| Arrest Location | Republic of Georgia |
| Co-Conspirators | Four other YMCO members previously extradited to the Western District of North Carolina; sentenced to 37–63 months each, with $9.1 million+ in restitution ordered per defendant |
| Investigating Agency | FBI (Charlotte Field Office), with DOJ Criminal Division (CCIPS) and USAO-WDNC prosecuting |
How the Scheme Worked
Recruiting Mules Through Fake Job Offers
YMCO operated since at least September 2007, recruiting U.S. residents through spam emails and online job postings that impersonated legitimate companies. Applicants went through what looked like a normal hiring process — job descriptions, onboarding instructions, and account setup — before being told their role was to receive "business payments" into their personal bank accounts, withdraw the cash, and wire it to the hiring company's overseas "partners." In reality, recruits were never employees of any real business, and they were never paid for the work they performed.
Moving Stolen Funds Out of the Country
The money flowing into mule accounts was not legitimate business revenue — it was proceeds that cybercriminals had already stolen from victims' bank accounts using stolen credentials and unauthorized access. Once a mule withdrew the cash, YMCO instructed them to wire it through Western Union and MoneyGram to "cash-out contractors" based primarily in Moldova, Ukraine, Russia, and Latvia. From there, funds were distributed to the hackers who had stolen them, minus YMCO's cut for laundering services. Beyond the United States, YMCO is alleged to have run comparable mule schemes in Germany, Italy, the United Kingdom, and Australia.
Korniev's Role at the Top of the Organization
Court documents describe Korniev as one of YMCO's leaders, responsible for developing the organization's internal policies and procedures, and for managing, hiring, and firing the employees who ran day-to-day mule recruitment and cash-out logistics. He is accused of rewarding and punishing staff based on performance and of securing illicit services that supported the broader operation — effectively running YMCO like a criminal business with its own HR function.
Impact Assessment
| Impact Area | Description |
|---|---|
| Financial | $14.7 million in actual and intended losses tied to YMCO; $10 million confirmed laundered through the mule network |
| Victim Exposure | 750+ compromised U.S. bank accounts across 35+ financial institutions, plus unknown numbers of mules whose identities and accounts were exploited |
| Law Enforcement | Demonstrates sustained multi-year FBI investigative capacity against cross-border mule networks, resulting in extradition and prosecution of leadership years after initial arrests of lower-level members |
| Legal Exposure for Mules | Money mules — even unwitting ones — can face account seizure, liability for facilitating fraud, and reputational/credit damage, despite receiving no actual payment |
| International Scope | Scheme extended beyond the U.S. to Germany, Italy, the UK, and Australia, indicating the mule-recruitment model is reusable across jurisdictions |
| Restitution | Korniev agreed to full restitution for known victims and forfeiture of seized cash; four co-conspirators were already ordered to pay $9.1 million+ each |
Recommendations
For Banks and Financial Institutions
- Flag accounts that receive irregular third-party deposits followed quickly by large cash withdrawals or wire transfers to Western Union/MoneyGram locations, especially to Eastern European corridors.
- Strengthen onboarding checks for personal accounts suddenly used to process "business" payments inconsistent with the account holder's stated employment or transaction history.
- Share suspicious activity patterns with FinCEN and law enforcement promptly — YMCO's structure relied on thousands of small, individually unremarkable transactions that only became visible in aggregate.
For Individuals Evaluating Remote Job Offers
- Treat any "job" that asks you to receive payments into a personal bank account and then forward money via wire transfer or money order as a near-certain money mule scam, regardless of how legitimate the hiring process appears.
- Verify any company offering remote "payment processing" or "money transfer agent" work through independent research — real businesses do not route payroll or vendor payments through a stranger's personal checking account.
- If you suspect you have acted as an unwitting money mule, contact your bank and the FBI's Internet Crime Complaint Center (IC3) immediately; acting early can limit both financial and legal exposure.
For Security and Fraud Teams
- Treat money mule networks as persistent infrastructure, not one-off fraud — YMCO operated for close to two decades before its leadership faced prosecution, meaning similar cash-out services are very likely still active.
- Incorporate mule-network indicators (rapid in-and-out transaction patterns, remittance transfers to specific overseas corridors) into account takeover and business email compromise detection, since the laundering stage is often the most detectable part of the attack chain.
- Coordinate with law enforcement task forces on mule-recruitment intelligence; this case shows cross-border extradition and prosecution are achievable even when organizers operate from outside the United States.
Key Takeaways
- Oleg Korniev, 42, pleaded guilty on October 8, 2026, to leading Your Mule Cashout (YMCO), an international money laundering organization that serviced cybercriminals.
- YMCO recruited more than 15,000 U.S.-based money mules to launder at least $10 million stolen from over 750 U.S. bank accounts.
- Mules were deceived through fake job offers and were never paid; stolen funds were wired overseas via Western Union and MoneyGram to contacts in Moldova, Ukraine, Russia, and Latvia.
- Korniev personally laundered at least $7 million and faces a sentencing range of 2 to 50 years in federal prison.
- Four other YMCO members were previously extradited and sentenced to 37–63 months each, with over $9.1 million in restitution ordered per defendant.
- The case, built on a multi-year FBI investigation, underscores that cash-out organizers operating from overseas remain prosecutable years after a scheme's lower-level participants are caught.
Sources
- BleepingComputer
- U.S. Department of Justice — Office of Public Affairs
- U.S. Department of Justice — USAO-WDNC