News Desk · Fraud

Leader of money mule network for hackers pleads guilty in US

Oleg Korniev, a leader of Your Mule Cashout (YMCO), pleaded guilty to money laundering and computer fraud charges. The Justice Department says YMCO used over 15,000 US-based money mules to move at least $10 million stolen by hackers.

FraudUS8 Oct 20262 min read

Oleg Korniev, 42, a dual citizen of Ukraine and Russia, pleaded guilty on October 8, 2026, according to the US Department of Justice. Court documents describe him as one of the leaders of Your Mule Cashout (YMCO), a money laundering organization that served cybercriminals.

According to the Justice Department, YMCO recruited over 15,000 US-based money mules (people who receive and pass on funds for others) to launder at least $10 million stolen by hackers from over 750 US bank accounts. Hackers paid YMCO a percentage of the stolen money, and YMCO moved the funds to countries primarily in Eastern Europe. YMCO falsely told the mules that their job was to receive payments from businesses. The Justice Department says the mules never received payment for their services.

As part of his plea, Korniev admitted that YMCO was responsible for over $14.7 million in actual and intended losses by confirmed victims, and that he intended to launder over $9.7 million and did launder at least $7 million. He pleaded guilty to conspiracy to commit money laundering, money laundering, conspiracy to commit computer fraud, conspiracy to commit access device theft, and aggravated identity theft. He agreed to pay full restitution to known victims and to forfeit cash seized from him when he was arrested in the Republic of Georgia.

He faces a minimum of two years and a maximum of 50 years in prison; a federal district court judge will decide the sentence. The Justice Department says four other people linked to YMCO were extradited to the Western District of North Carolina, pleaded guilty to conspiracy to commit money laundering, and received prison sentences ranging from around 37 to 63 months. The FBI investigated the case.

Why it matters to AML professionals

Money mule networks give hackers a way to turn stolen bank balances into cash held overseas. Retail customers who act as mules often believe they have a real job, so their accounts can look ordinary until the pattern of inbound and outbound transfers is reviewed. AML professionals who spot mule activity early can stop funds before they leave the country and help identify the wider network.

Red flags in this case

If this landed in your queue

  1. Pull the account's full transaction history and compare recent activity with the stated occupation and expected activity from onboarding
  2. Trace the sources of the incoming funds and check for fraud claims or recall requests from the sending banks
  3. Search for other customers paying the same beneficiaries or using the same devices or IP addresses
  4. Escalate for SAR consideration and follow internal procedures on restricting the account when stolen funds are suspected

Key terms

Money mule
A person who receives money and moves it on for someone else, which helps hide where the money came from.
Restitution
Money a defendant is ordered or agrees to pay back to victims for their losses.
Forfeiture
The government taking property or cash linked to a crime.

Interview angle

How would you tell the difference between a money mule who is unaware of the scheme and one who is a knowing participant?

A strong candidate looks at evidence such as the customer's explanations, any warnings they ignored, payments they kept, and how their behaviour changed over time, while noting that a SAR should be filed on the activity either way.

Sources

Go deeper on AMLift

Found this useful? Share it with your network, or tell us if something looks wrong.

Every fact in AMLift News Desk stories comes from an official source: a regulator, court, government gazette or the company's own filing.