US Extradites Canadian Suspect in University Supercomputer Cryptojacking Ring

A Canadian national has been extradited to the United States to face federal charges alleging he breached university supercomputers to mine cryptocurrency and harvest login credentials, the US Department of Justice announced on Tuesday ¹.

A federal grand jury in the Western District of New York indicted Ryan James Roach, 35, and Mathiew James Stubbings, 41, on counts of conspiracy to obtain information from and damage a protected computer, intentionally damaging a protected computer, and obtaining information from a protected computer ¹. Roach was extradited from Canada on Oct. 28 and arraigned in Rochester, New York, where authorities held him pending a detention hearing ¹. Extradition proceedings involving Stubbings remain ongoing in Canada ¹.

Prosecutors stated that between June 2016 and December 2019, Roach and Stubbings targeted higher education facilities equipped with supercomputing power in New York, Tennessee, North Carolina, and Massachusetts ¹. The indictment alleges the pair probed network vulnerabilities, planted malware, and commandeered institutional hardware to execute unauthorized crypto mining ¹. To conceal their activities, the defendants allegedly routed network traffic through compromised victim systems and maintained virtual private servers registered under pseudonyms across multiple countries to distribute mining scripts and store compromised credentials ¹. Each charge carries a maximum statutory penalty of 10 years in prison and a fine of up to $250,000 ¹.

Shift From Cryptojacking to Model Hijacking

The indictment arrives as cross-border cyber enforcement ramps up, mirroring broader patterns seen in US extraditions targeting international crypto-related offenses. Cryptojacking relies on external infrastructure to absorb electrical and processing expenses while yielding mining proceeds ¹. While the DOJ did not specify the digital assets mined, threat actors historically favored privacy-focused networks such as Monero due to accessible hardware mining algorithms ¹.

However, corporate cybersecurity units report that computational theft is evolving toward machine learning resources ¹. According to a report by Google's Threat Intelligence Group, malicious actors are pivoting from standard cryptojacking toward "LLMjacking," which involves compromising corporate accounts to utilize expensive artificial intelligence models ¹. Google's Mandiant unit found that while cryptojacking represents an ongoing operational drain, unauthorized AI usage can generate cloud computing bills exceeding $100,000 in a single day, with access subsequently monetized across illicit online marketplaces ¹.