Headline: Canadian Extradited to U.S. in Cryptojacking Scheme that Hijacked University Supercomputers
A Canadian man was handed over to U.S. authorities this week to face federal charges accusing him and an alleged co-conspirator of infiltrating university supercomputers to steal credentials and secretly mine cryptocurrency, the Justice Department said.
What prosecutors say happened
- Ryan James Roach, 35 (Saskatchewan), and Mathiew James Stubbings, 41 (Ontario), were indicted by a federal grand jury in the Western District of New York on counts that include conspiracy to obtain information from and damage a protected computer, obtaining information from a protected computer, and intentionally damaging a protected computer. Each count carries up to 10 years in prison and a $250,000 fine.
- Between June 2016 and December 2019, the pair allegedly targeted U.S. educational institutions that operated high-performance supercomputers. They are accused of researching security weaknesses, breaching networks, deploying malware, stealing login credentials, and forcing victim systems to mine cryptocurrency for their own profit.
- Victims named in the indictment include institutions in New York, Tennessee, North Carolina and Massachusetts, including at least one university in the Western District of New York.
- The defendants allegedly used virtual private servers (VPS) in multiple countries registered under false names to distribute malware and mining software, store stolen credentials, and route attacks through other compromised victim machines to obscure their identities.
Legal status
- Roach was extradited from Canada on Oct. 28 and arraigned in Rochester, New York; he is being held pending a detention hearing. Extradition proceedings for Stubbings are still ongoing in Canada.
Cryptojacking context and trends
- The scheme is classified as cryptojacking: covertly using other people’s computing resources to mine cryptocurrency, leaving victims with higher electricity bills and degraded performance.
- The Justice Department did not disclose which cryptocurrency was mined. Historically, privacy-friendly Monero has been a common choice for cryptojackers because it can be mined on ordinary hardware and is difficult to trace.
- Security agencies have continued to see crypto-mining malware. For example, the Dutch national cyber agency warned this year of attackers exploiting a macOS Screen Sharing flaw to plant Monero miners on Macs.
But attackers are evolving
- Google’s Threat Intelligence Group recently warned that attackers may be shifting focus from steady resource theft like cryptojacking to "LLMJacking"—abusing companies’ access to large language models and cloud-based AI services. LLMjacking can generate massive cloud bills in hours rather than the gradual drain of cryptojacking.
- Investigations by Google’s Mandiant unit found instances where fraudulent cloud charges exceeded $100,000 in a single day, with some victims incurring $1 million in costs before access was cut off. Google flagged underground resale ecosystems—so-called “LLM Mixers”—where stolen access is traded.
Why this matters to the crypto community
- Cryptojacking on high-performance academic infrastructure not only steals compute cycles and electricity, it can jeopardize research workloads and sensitive data.
- The case highlights two ongoing risks for organizations that host valuable compute: traditional cryptomining abuse and a growing new threat vector that leverages cloud-based AI access—both of which can produce significant financial and operational damage.
We’ll continue to follow developments as extradition proceedings progress for Stubbings and as prosecutors prepare for trial.
A Canadian man was handed over to U.S. authorities this week to face federal charges accusing him and an alleged co-conspirator of infiltrating university supercomputers to steal credentials and secretly mine cryptocurrency, the Justice Department said.
What prosecutors say happened
- Ryan James Roach, 35 (Saskatchewan), and Mathiew James Stubbings, 41 (Ontario), were indicted by a federal grand jury in the Western District of New York on counts that include conspiracy to obtain information from and damage a protected computer, obtaining information from a protected computer, and intentionally damaging a protected computer. Each count carries up to 10 years in prison and a $250,000 fine.
- Between June 2016 and December 2019, the pair allegedly targeted U.S. educational institutions that operated high-performance supercomputers. They are accused of researching security weaknesses, breaching networks, deploying malware, stealing login credentials, and forcing victim systems to mine cryptocurrency for their own profit.
- Victims named in the indictment include institutions in New York, Tennessee, North Carolina and Massachusetts, including at least one university in the Western District of New York.
- The defendants allegedly used virtual private servers (VPS) in multiple countries registered under false names to distribute malware and mining software, store stolen credentials, and route attacks through other compromised victim machines to obscure their identities.
Legal status
- Roach was extradited from Canada on Oct. 28 and arraigned in Rochester, New York; he is being held pending a detention hearing. Extradition proceedings for Stubbings are still ongoing in Canada.
Cryptojacking context and trends
- The scheme is classified as cryptojacking: covertly using other people’s computing resources to mine cryptocurrency, leaving victims with higher electricity bills and degraded performance.
- The Justice Department did not disclose which cryptocurrency was mined. Historically, privacy-friendly Monero has been a common choice for cryptojackers because it can be mined on ordinary hardware and is difficult to trace.
- Security agencies have continued to see crypto-mining malware. For example, the Dutch national cyber agency warned this year of attackers exploiting a macOS Screen Sharing flaw to plant Monero miners on Macs.
But attackers are evolving
- Google’s Threat Intelligence Group recently warned that attackers may be shifting focus from steady resource theft like cryptojacking to "LLMJacking"—abusing companies’ access to large language models and cloud-based AI services. LLMjacking can generate massive cloud bills in hours rather than the gradual drain of cryptojacking.
- Investigations by Google’s Mandiant unit found instances where fraudulent cloud charges exceeded $100,000 in a single day, with some victims incurring $1 million in costs before access was cut off. Google flagged underground resale ecosystems—so-called “LLM Mixers”—where stolen access is traded.
Why this matters to the crypto community
- Cryptojacking on high-performance academic infrastructure not only steals compute cycles and electricity, it can jeopardize research workloads and sensitive data.
- The case highlights two ongoing risks for organizations that host valuable compute: traditional cryptomining abuse and a growing new threat vector that leverages cloud-based AI access—both of which can produce significant financial and operational damage.
We’ll continue to follow developments as extradition proceedings progress for Stubbings and as prosecutors prepare for trial.