A Canadian man was extradited to the United States on October 28 to face charges over an alleged scheme to hack university computers, steal login credentials and use the machines to mine cryptocurrency, according to the Justice Department, as reported by Decrypt on November 5, 2026.
Ryan James Roach, 35, of Saskatchewan, was arraigned in Rochester, New York, and held pending a detention hearing. Extradition proceedings against his co-defendant, Mathiew James Stubbings, 41, of Ontario, were continuing in Canada.
Prosecutors allege years of unauthorized mining
A federal grand jury in the Western District of New York indicted both men on charges of conspiracy to obtain information from and damage a protected computer, obtaining information from a protected computer, and intentionally damaging a protected computer. The charges carry a maximum sentence of 10 years in prison and a $250,000 fine.
According to the indictment, the alleged scheme ran from June 2016 through December 2019. Prosecutors said the pair researched security weaknesses at U.S. educational institutions with supercomputers before breaking into their networks.
Once inside, they allegedly installed malware, stole login credentials and made the compromised computers mine cryptocurrency for their benefit. Victims included institutions in New York, Tennessee, North Carolina and Massachusetts, including a university in the Western District of New York.
Prosecutors also alleged that the men used virtual private servers in several countries, registered under false names, to distribute malware and mining software and store stolen credentials. They allegedly routed attacks through computers compromised at other victims to conceal their identities.
The cryptocurrency was not identified
The alleged activity is known as cryptojacking: using someone else’s computing resources to mine cryptocurrency without authorization, leaving the victim to bear electricity costs and reduced performance.
The Justice Department did not identify the cryptocurrency allegedly mined. Decrypt noted that Monero has long been a common choice for such schemes because it can be mined on ordinary hardware. That background does not establish that Monero was involved in this case.
In August, the Dutch national cyber agency warned that attackers were exploiting a flaw in Apple’s macOS Screen Sharing feature to install Monero miners on Macs.
Google warns of a shift toward stolen AI access
Separately, a Google Threat Intelligence Group report published on the Monday preceding Decrypt’s article said it expected attackers to “increasingly prioritize LLMJacking over traditional resource theft like cryptojacking.” LLMjacking involves hijacking companies’ access to AI models and leaving those companies with the bills.
Google said this abuse can generate large cloud charges within hours, rather than the more gradual resource drain associated with cryptojacking. In incidents investigated by its Mandiant unit during 2026, fraudulent charges exceeded $100,000 in a single day, while some organizations accumulated $1 million in charges before access was cut off. Google said attackers were reselling stolen access through underground services it calls “LLM Mixers.”
Original publication: November 5, 2026, at 20:00:01 UTC+8. Read the original article at Decrypt.