A former core infrastructure engineer at a New Jersey industrial company has been sentenced to 32 months in federal prison after admitting that he attacked his employer’s computer network and demanded a Bitcoin ransom.
Daniel Rhyne, 59, of Kansas City, Missouri, pleaded guilty in April to extortion involving a threat to damage a protected computer and to intentionally damaging a protected computer. U.S. District Judge Michael A. Shipp imposed the sentence on September 28 in Trenton, according to federal prosecutors.
The company involved has not been identified. Prosecutors said it is headquartered in Somerset County, New Jersey, and provides services to industries including biopharmaceuticals, oil and gas. Rhyne had worked there as a core infrastructure engineer and was the company’s subject matter expert on hosting virtual machines—software-based computers that can run inside a physical network.
According to reporting by Decrypt, the incident began in November 2023 and involved the use of that technical access to interfere with the employer’s systems. The case illustrates how access held by a trusted employee can be used to disrupt critical network controls and demand payment in cryptocurrency.
The ransom demand and network disruption
At around 4 p.m. on November 25, 2023, the company’s network administrators began receiving alerts that passwords for hundreds of accounts were being reset. They then discovered that all other domain administrator accounts had been deleted, according to the FBI’s criminal complaint.
Forty-four minutes later, employees received an email titled “Your Network Has Been Penetrated.” The message claimed that the company’s IT administrators had been locked out and that its backups had been deleted. It threatened to shut down 40 additional servers each day for 10 days unless a ransom was paid by December 2.
The email demanded 20 Bitcoin, which was worth approximately $750,000 at the time. The complaint also described the ransom as €700,000 payable in Bitcoin. These figures reflected the value of the requested cryptocurrency when the demand was made, rather than a fixed dollar payment.
Investigators said the attack had been prepared in advance. An unauthorized virtual machine was created on the company’s network on November 9. On the morning of the attack, a remote desktop session from that machine created scheduled tasks designed to delete 13 administrator accounts, change passwords across 254 servers and 3,284 workstations, and shut down dozens of servers beginning December 3.
How investigators linked the attack to Rhyne
The FBI traced the unauthorized virtual machine to Rhyne through his company laptop. The machine used the password “TheFr0zenCrew!”, which was also later assigned to an administrator account, 301 user accounts and the email account used to send the ransom demand.
Investigators cited several details connecting Rhyne to the activity. Browsing on his company laptop stopped when browsing activity took place on the hidden virtual machine. Building access records showed that Rhyne entered the company’s headquarters minutes before his account logged in.
On the day of the attack, his laptop connected to the company network through an internet address assigned to his home in Warren County, New Jersey. That connection occurred minutes before the session that created the malicious scheduled tasks.
The complaint also said that, days before the incident, the virtual machine’s user had searched for instructions on clearing Windows logs from the command line and remotely shutting down a computer using the command prompt. Those searches were among the evidence cited by investigators.
Charges and current Bitcoin market picture
Rhyne originally faced an additional wire-fraud charge, but that count was not included in the two-count information to which he ultimately pleaded guilty. The extortion charge carried a maximum sentence of five years, while the intentional-damage charge carried a maximum of 10 years.
The 32-month sentence follows the guilty plea and resolves the federal case described by prosecutors. The company’s name and the extent of any financial loss beyond the threatened ransom were not disclosed in the source material.
Moneyiar market data at 09:23 on October 8, 2026, put Bitcoin at $82,973.60344859, down 0.94% over 24 hours and 0.84% over seven days. The other assets tracked in the same data were Monad at $0.0255953639, down 4.4% in 24 hours and 20.26% over seven days; Compound at $23.6527760703, up 1.42% over 24 hours and down 3.07% over seven days; and Ontology at $0.0585968992, up 1.82% over 24 hours and down 0.05% over seven days.
The current Bitcoin price is different from the cryptocurrency’s value at the time of the 2023 ransom demand. That difference highlights why a Bitcoin-denominated ransom can change in dollar or euro terms between the moment it is demanded and the time it might be paid.
