Canadian Man Extradited to U.S. Over University Supercomputer Cryptojacking Plot

A Canadian man has been extradited to face federal charges in the United States regarding a sophisticated scheme to hijack academic computing resources. Authorities identified the suspect as a Canadian man named Ryan James Roach, 35, of Saskatchewan, who is accused alongside 41-year-old Mathiew James Stubbings of Ontario of orchestrating a long-term cryptojacking operation targeting various educational institutions.

According to the U.S. Department of Justice, a federal grand jury in the Western District of New York indicted both men on multiple counts, including conspiracy to obtain information from and damage a protected computer. If convicted, the charges carry a potential maximum sentence of 10 years in prison and a fine of up to $250,000. Roach was extradited from Canada on October 28 and has since been arraigned in Rochester, New York. Extradition proceedings for Stubbings remain ongoing in Canada.

The Scope of the Operation

The indictment alleges that between June 2016 and December 2019, the pair systematically targeted U.S. universities by first identifying security vulnerabilities within their network infrastructure. Once they gained unauthorized access, they reportedly deployed malware to steal login credentials and commandeered the institutions' powerful supercomputers. This allowed the attackers to mine cryptocurrency for their own financial gain while the universities bore the resulting costs of electricity and diminished system performance.

Prosecutors stated that the victims included institutions across New York, Tennessee, North Carolina, and Massachusetts. To obscure their activities, the defendants allegedly utilized virtual private servers registered under false names and routed their traffic through other compromised computers to hide their true identities. While the specific cryptocurrency mined was not disclosed by officials, the practice is a known form of cryptojacking.

Two men face federal charges for allegedly hacking university supercomputers to secretly mine cryptocurrency for profit.

While cryptojacking has been a common threat, cybersecurity experts are observing shifts in how attackers monetize stolen computing power. Google’s Threat Intelligence Group recently warned that bad actors are increasingly pivoting toward "LLMJacking," which involves hijacking access to artificial intelligence models. Unlike the gradual resource drain of traditional cryptojacking, LLMJacking can result in massive cloud service bills for organizations in a matter of hours, with some incidents resulting in costs exceeding $1 million.

Why it matters

This case highlights the persistent vulnerability of academic networks to cyberattacks that exploit high-performance computing resources. For universities, such breaches not only compromise sensitive login credentials but also impose significant operational and financial burdens.

As organizations globally integrate more advanced computing and AI tools, the threat of unauthorized resource theft continues to evolve. While this specific incident involved traditional cryptojacking, the shift toward hijacking AI models indicates that businesses and educational institutions must remain vigilant against diverse methods of unauthorized cloud and hardware exploitation.