Originally published by Decrypt on November 5, 2026, at 20:00:01 UTC+8.
A Canadian man was extradited to the United States to face charges over an alleged scheme to breach university computer networks, steal login credentials and use the institutions’ computing power to mine cryptocurrency, according to the US Justice Department.
Ryan James Roach, 35, of Saskatchewan, was extradited from Canada on October 28 and arraigned in Rochester, New York. He was held pending a detention hearing. Extradition proceedings against his co-defendant, Mathiew James Stubbings, 41, of Ontario, were continuing in Canada at the time of the report.
Charges concern attacks from 2016 to 2019
A federal grand jury in the Western District of New York indicted both men on charges of conspiracy to obtain information from and damage a protected computer, obtaining information from a protected computer, and intentionally damaging a protected computer. The charges carry a maximum sentence of 10 years in prison and a $250,000 fine.
According to the indictment, the pair targeted US educational institutions with supercomputers between June 2016 and December 2019. Prosecutors allege that they researched network security weaknesses before breaking in, deploying malware, stealing credentials and making victims’ computers mine cryptocurrency for their benefit.
The affected institutions were in New York, Tennessee, North Carolina and Massachusetts, including a university in the Western District of New York, prosecutors said.
The defendants allegedly used virtual private servers in several countries, registered under false names, to distribute malware and mining software and store stolen credentials. They also allegedly routed attacks through computers compromised at other victims to conceal their identities.
Stolen computing power, from crypto mining to AI access
The alleged activity is known as cryptojacking: using someone else’s computers to mine cryptocurrency while leaving the owner to absorb electricity costs and reduced performance. The Justice Department did not identify the cryptocurrency allegedly mined in this case.
Decrypt noted that Monero has long been favored in such schemes because it can be mined on ordinary hardware. In August 2026, the Dutch national cyber agency warned that attackers were exploiting a flaw in Apple’s macOS Screen Sharing feature to install Monero miners on Macs. That warning was separate from the allegations against Roach and Stubbings.
The report also cited a Google Threat Intelligence Group assessment published that week predicting that attackers would “increasingly prioritize LLMJacking over traditional resource theft like cryptojacking.” LLMjacking involves hijacking companies’ access to AI models and leaving them with the resulting bills.
Google said this activity can generate substantial cloud charges within hours. In incidents investigated by its Mandiant unit in 2026, fraudulent charges exceeded $100,000 in a single day, while some organizations accumulated $1 million in charges before access was cut off. Attackers resell stolen access through underground services that Google calls “LLM Mixers.” These findings were broader cybersecurity context, not allegations about the two defendants.
