Feds Charge Driver in Alleged $12M Cargo Theft Scheme

Federal prosecutors put a number on an alleged cargo theft conspiracy on October 21: at least 24 hijacked freight shipments and more than $12 million in retail-value merchandise stolen — losses attributed to a single defendant, 33-year-old Nursulton Khaydarov, a citizen of Uzbekistan and lawful permanent U.S. resident.

The U.S. Attorney's Office for the District of Connecticut announced charges against Khaydarov, who pleaded not guilty in federal court in Bridgeport. Prosecutors accuse him of joining a conspiracy targeting interstate shipments originating in California and other locations. The case, led by the FBI with assistance from Homeland Security Investigations, IRS Criminal Investigation and the DOT Office of Inspector General, remains open — and several facts are conspicuously absent from the public record.

How did the alleged scheme work?

According to investigators, the operation began around September 2025 and ran through multiple motor carriers. Participants purchased trucking businesses or otherwise assumed control of existing operations, obtaining DOT numbers, motor carrier identification numbers, business email accounts and ownership identities. They then impersonated prior owners to negotiate transportation agreements with freight brokers.

The method matters to every broker reading the indictment. The suspects did not build sham carriers from scratch; they exploited operating histories, established credentials and broker relationships that pass routine vetting precisely because their federal records show years of activity. FMCSA has warned against buying, selling or leasing operating authority outside legitimate corporate transactions — a warning this case appears to vindicate.

After drivers collected merchandise from distribution facilities, the shipments vanished before reaching scheduled delivery points. The stolen freight spanned hard drives, stereo equipment, clothing, electronics, computer equipment, food, nicotine products and other consumer goods.

The indictment also details operational tradecraft: switched tractor license plates, burner phones with encrypted messaging, and efforts to defeat electronic shipment tracking. After pickups, participants allegedly offered false explanations for delayed or missing freight.

What do the ransom and identity details show?

Investigators documented ransom demands — cryptocurrency or electronic transfers in exchange for returning merchandise. An FBI affidavit traces roughly $121,000 in cryptocurrency received by Khaydarov's Coinbase account across 33 transactions between November 2025 and May 2026. That averages out to under $3,700 per transfer, though investigators concede they did not establish that every payment represented ransom.

Court documents describe five fraudulent driver's licenses bearing different names, each displaying Khaydarov's photograph with altered facial features. He also held a valid New Jersey commercial driver's license. One documented incident involved a pistachio shipment departing Terra Bella, California, for Laredo, Texas, on December 19, 2025; the driver presented an Illinois license identifying him as Sayid Makhmudarov, a name state motor vehicle records could not match.

The trail eventually led police in Ontario, California, to a tractor-trailer on May 18. During a traffic stop, Khaydarov presented his valid New Jersey license. Officers found suspected counterfeit identification and a nicotine product matching merchandise from an earlier theft. Police impounded the equipment, and the FBI later searched the tractor under a federal warrant. Khaydarov was arrested in Ontario on June 1, 2026. A grand jury in New Haven returned an indictment on September 22 charging conspiracy, which carries a maximum five-year prison sentence. He has remained in custody since arrest. Assistant U.S. Attorneys David T. Huang and Larysa J. Kern are prosecuting; U.S. Attorney David X. Sullivan and FBI Special Agent in Charge P.J. O'Brien announced the charges.

What does the case leave unanswered?

The gaps are as instructive as the charges. Investigators have not publicly identified the affected carriers, brokers, shippers or distribution facilities — meaning the market cannot yet measure which brokerage channels were compromised. Authorities also have not disclosed how participants acquired control of the trucking businesses, and the recovery status of the stolen merchandise remains unresolved. The charges are allegations until proven at trial. Anyone with information can contact the FBI's New Haven Field Office at 203-777-6311.

For brokers and shippers, the commercial lesson is blunt: an active DOT number, valid insurance and a long operating history cannot establish who actually controls a carrier. Recent ownership changes, updated contact details, unfamiliar email domains and insurance inconsistencies all warrant independent verification before freight changes hands — and with federal attention now fixed on authority-trading, expect vetting standards to tighten.