Volodymyr Kvashuk was a Microsoft employee from Ukraine. He worked at Microsoft's office in the U.S. as a tester, in which he placed mock online orders on Microsoft’s Online retail sales platform to make sure that everything was working as intended.
As a tester, Kvashuk account was able to place those mock purchases without having the shipment of the actual physical products. However, there was a bug in the system that didn't block testers like Kvashuk from purchasing virtual gift cards.
Discovering the bug, Kvashuk realized that he could use his test account to really buy store credits and use the credits to buy real products, without having to spend any of his money.
At first, Kvashuk bought a Microsoft Office subscription and a couple of graphics cards for himself.
Kvashuk made little effort to cover his tracks on his earliest purchases. He waited and no one was suspicious.
Knowing that he got away with the purchases, he began his quest for even bigger thefts.
But this time, he took more precautions.
Kvashuk didn't only used his test account, as he also used other test accounts by his colleagues. It was possible for him to do this because testers like Kvashuk keep their account credentials in a shared online document.
To also cover his tracks, Kvashuk also used disposable email addresses and used Virtual Private Network (VPN) services.
Knowing that he couldn't do many things with just store credits, he traded the credits on the internet for Bitcoins, to then sent them to a mixing service in order to hide the Bitcoins' origins.
He then cashed them out through Coinbase.
To again cover his tracks, he claimed to the Internal Revenue Service (IRS), which is the revenue service for citizens of the U.S., that the Bitcoins were a gift from his father. The IRS has a criminal investigation division in the cryptocurrency tax space, and to cover his tracks, he needed to lie.
In total, the rogue employee netted at least $2.8 million, which he used to buy a $160,000 Tesla electric car and a $1.6 million waterfront home.
Unfortunately for him, his employer caught him on track.
Kvashuk's scheme initially made him and other Microsoft employees under the glare of suspicion.
But Kvashuk was caught because he sometimes used the same VPN connection when attempting to steal from his employer. What this means, in many occasions, Kvashuk IP address remained the same when he accessed the many test accounts.
This allowed Microsoft to investigate and draw connection between Kvashuk known account, and those he used for other thefts.
What's more, Kvashuk also left digital footprints, allowing Microsoft to pinpoint Kvashuk as the culprit using device fingerprinting techniques.
When Microsoft reported it to the authorities, the government argued how the timing of Kvashuk's sudden Bitcoin wealth coincides with this case.
"The value of the Bitcoin deposits to Kvashuk's Coinbase account generally correlated with the value of the purchased and redeemed [Microsoft credit]," the government argued.
With that, a convinced jury convicted Kvashuk on "five counts of wire fraud, six counts of money laundering, two counts of aggravated identity theft, two counts of filing false tax returns, and one count each of mail fraud, access device fraud, and access to a protected computer in furtherance of fraud," the government wrote.
"Stealing from your employer is bad enough, but stealing and making it appear that your colleagues are to blame widens the damage beyond dollars and cents," said U.S. attorney Brian Moran said in a press release, as reported in a post by the U.S. Department of Justice.
At his sentencing hearing, U.S. District Judge James L. Robart said Kvashuk "didn’t have any respect for the law."
Kvashuk that is residing Renton, Washington, has been ordered to pay $8.3 million in restitution, sentenced to 9 years in jail, and may be deported following that.
Kvashuk worked first as a contractor in Microsoft and then as an employee from August 2016.
He was fired in June 2018. after the scheme came to light.
