A Canadian citizen, Ryan James Roach, 35, was extradited to the United States on Oct. 28 to face a federal indictment accusing him of conspiring with Ontario resident Mathiew James Stubbings, 41, to infiltrate university networks and run cryptocurrency mining operations on high‑performance computers. According to the US Justice Department, the scheme spanned June 2016 through December 2019 and targeted institutions in New York, Tennessee, North Carolina and Massachusetts.

Details of the alleged hack

Prosecutors say Roach and Stubbings first probed security weaknesses in the networks of four universities that host powerful supercomputers. After gaining access, they allegedly installed custom malware, harvested login credentials and forced the machines to mine cryptocurrency for their own benefit. The indictment lists three counts: conspiracy to obtain information from a protected computer, obtaining information from a protected computer, and intentional damage to a protected computer, each carrying up to ten years in prison and a $250,000 fine.

Technical methods and cryptocurrency used

The duo is reported to have routed traffic through virtual private servers registered under false identities in multiple countries, using compromised victim machines as stepping stones to obscure their tracks. While the Justice Department did not disclose the specific coin mined, privacy‑focused Monero is frequently cited in similar cryptojacking cases because it can be mined on standard hardware and obscures transaction trails. Recent alerts from the Dutch cyber agency highlighted Monero miners being deployed via a macOS screen‑sharing exploit.

Broader security implications

The case arrives as Google’s Threat Intelligence Group warned that attackers are shifting from traditional cryptojacking to “LLMjacking,” hijacking access to large language models to generate massive cloud‑service bills. Google’s Mandiant unit observed incidents where fraudulent charges exceeded $100,000 in a single day, with some victims incurring up to $1 million before the abuse was stopped. The agency notes that underground services, dubbed “LLM Mixers,” are already reselling stolen AI‑model access.

What to watch next

Extradition proceedings for Mathiew James Stubbings remain pending in Canada, and his eventual appearance in US court will clarify the full scope of the operation. Law‑enforcement agencies are expected to issue further guidance on protecting high‑performance computing resources, especially as the line between cryptojacking and AI‑model hijacking blurs. Stakeholders should monitor updates from Google’s Threat Intelligence reports and any related policy actions from the US Department of Justice.