Dual Citizen Admits to Running 15,000-Mule Laundering Operation for Cybercriminals
Oleg Korniev, a 42-year-old dual citizen of Ukraine and Russia, has pleaded guilty in the U.S. District Court for the Western District of North Carolina to leading Your Mule Cashout (YMCO), an international money laundering organization that recruited more than 15,000 U.S.-based money mules to move funds stolen by cybercriminals. Prosecutors say YMCO has operated since September 2007 and laundered at least $10 million stolen from more than 750 U.S. bank accounts at 35-plus banks, with Korniev personally admitting responsibility for $14.7 million in actual and intended losses tied to confirmed victims.
The U.S. Department of Justice announced the plea on October 8, 2026. Korniev pleaded guilty to conspiracy to commit money laundering, money laundering, conspiracy to commit computer fraud, conspiracy to commit access device theft, and aggravated identity theft.
Incident Details
| Attribute | Value |
|---|---|
| Defendant | Oleg Korniev, 42 |
| Citizenship | Ukraine / Russia (dual citizen) |
| Organization | Your Mule Cashout (YMCO) |
| Operating since | September 2007 |
| Court | U.S. District Court, Western District of North Carolina |
| Money mules recruited | 15,000+ (U.S.-based) |
| Victim bank accounts | 750+ accounts at 35+ banks |
| Funds laundered (confirmed) | At least $7 million of $10 million+ |
| Total losses admitted | $14.7 million (actual and intended) |
| Charges | Money laundering conspiracy, money laundering, computer fraud conspiracy, access device theft conspiracy, aggravated identity theft |
| Sentencing exposure | 2 to 50 years in prison |
| Plea announced | October 8, 2026 |
How the Scheme Worked
Recruiting unwitting mules
YMCO recruited U.S. residents through spam email campaigns advertising work-from-home jobs at fake companies. Applicants went through what looked like a legitimate hiring process — onboarding paperwork, a job title, instructions from a "manager" — before being told their role was to "process payments" for the business. In reality, every recruit became a disposable conduit for stolen money, and none of them was ever paid for the work.
Moving stolen funds out of the country
Cybercriminals who had already compromised victims' bank accounts — through phishing, credential theft, business email compromise, and other intrusion methods — wired the stolen funds directly into mule-controlled personal bank accounts. Mules were then instructed to withdraw the cash and wire it, primarily via Western Union and MoneyGram, to so-called "cash-out contractors" based in Moldova, Ukraine, Russia, and Latvia. From there, the funds flowed back to the cybercriminal groups that had stolen them in the first place, minus YMCO's cut.
A revenue-share model for hackers
YMCO did not steal the underlying funds itself. Instead, it functioned as a laundering-as-a-service layer: hacking crews kept the proceeds of their own intrusions and paid YMCO a percentage fee simply for access to its mule network and cash-out pipeline. Court filings describe Korniev as a hands-on operator who managed, hired, and fired YMCO's employees, set performance-based rewards and penalties, and helped write the organization's internal policies and procedures — running the laundering operation with the structure of a legitimate business.
An international footprint
Beyond the United States, prosecutors say YMCO ran parallel mule-recruitment and cash-out schemes in Germany, Italy, the United Kingdom, and Australia, extending the same model to victims and financial institutions well outside North Carolina's jurisdiction.
Impact Assessment
| Impact Area | Description |
|---|---|
| Direct financial loss | $10 million+ confirmed stolen and laundered from U.S. accounts; $14.7 million in total admitted losses |
| Victim scope | 750+ individual U.S. bank accounts across 35+ financial institutions |
| Mule exposure | 15,000+ recruited individuals face potential account closures, fraud flags, and in some cases criminal liability exposure despite believing they held legitimate jobs |
| Cybercrime enablement | YMCO's cash-out pipeline functioned as critical infrastructure for unrelated hacking groups, demonstrating how laundering-as-a-service lowers the barrier to monetizing stolen credentials |
| International scope | Parallel schemes reported in Germany, Italy, the UK, and Australia broaden the operation's reach well beyond U.S. borders |
| Precedent | Four prior YMCO co-conspirators were already extradited and sentenced to 37-63 months each, with $9.1 million in restitution ordered per defendant, underscoring sustained multi-year law enforcement pressure on the network |
Recommendations
For financial institutions
- Flag newly opened personal accounts that quickly receive large incoming wires followed by rapid cash withdrawals or outbound wires to money-transfer services — a classic mule-account pattern.
- Strengthen know-your-customer (KYC) checks on accounts tied to work-from-home "payment processor" job postings, and train frontline staff to recognize mule recruitment narratives during account-opening interviews.
- Share suspicious-activity indicators with industry fraud-intelligence groups; YMCO's cross-border cash-out routes to Moldova, Ukraine, Russia, and Latvia match patterns seen across multiple unrelated laundering networks.
For security teams and incident responders
- Treat "money mule" disruption as part of the broader cybercrime kill chain — intrusions that lead to funds transfer fraud or business email compromise ultimately rely on networks like YMCO to convert stolen funds into cash. Reporting compromises promptly to banks and law enforcement increases the odds of clawback before funds reach overseas cash-out contractors.
- When investigating BEC or account-takeover incidents, check whether destination accounts match known mule-account indicators (newly opened, rapid turnover, inconsistent with account holder's profile) and report findings to FinCEN and the FBI's IC3.
For job seekers and the public
- Be skeptical of remote "payment processing," "money transfer agent," or "virtual assistant" job offers that ask you to receive funds into your personal bank account and forward them elsewhere — this is the single most common mule-recruitment tactic.
- Never agree to receive funds on behalf of an employer you have not independently verified, and never wire money to a third party at an employer's instruction without confirming the company's legitimacy through official channels.
- If you believe you may have unknowingly acted as a money mule, contact your bank and the FBI's Internet Crime Complaint Center (IC3) immediately — acting early can reduce personal liability exposure.
Key Takeaways
- Oleg Korniev, 42, pleaded guilty to leading YMCO, a money laundering organization that recruited more than 15,000 U.S. money mules since 2007.
- The network laundered at least $10 million stolen from 750+ bank accounts at 35+ institutions, with Korniev admitting to $14.7 million in total actual and intended losses.
- Mules were deceived through fake work-from-home job offers and never received payment; stolen funds were wired through Western Union and MoneyGram to cash-out contractors in Moldova, Ukraine, Russia, and Latvia.
- YMCO operated as a laundering-as-a-service business for unrelated cybercriminal groups, which paid a percentage fee for access to the mule network rather than laundering their own proceeds.
- Korniev faces a sentencing range of 2 to 50 years; four prior YMCO co-conspirators already received 37-63 month sentences and were ordered to pay over $9.1 million in restitution each.
- The case illustrates how dismantling money-mule infrastructure disrupts the broader cybercrime economy — organizations like YMCO are the monetization layer that makes many hacking and fraud schemes profitable in the first place.
Sources
- Man admits to running network of 15,000 money mules for cybercriminals — BleepingComputer
- Ukrainian-Russian dual citizen pleads guilty to running international money laundering organization — U.S. Department of Justice
- Ukrainian-Russian dual citizen pleads guilty to helping run $10M money laundering ring — Washington Times
- Cybercrime Laundering Leader Pleads Guilty In $10M Scheme — Law360