The US Attorney's Office for the Western District of New York has confirmed that Ryan James Roach, a 35-year-old man from Saskatchewan, Canada, has been surrendered to US authorities to face charges that he broke into American university networks and turned their supercomputers into cryptocurrency miners.

Roach was handed over to American officials on October 28, closing one chapter of a prosecution that began with a sealed grand jury indictment as far back as April 2022. His alleged partner, however, remains in Canada and is still fighting to prevent his removal to the United States.

From a Saskatchewan courtroom to Rochester federal court

Roach, who has lived in both Saskatoon and Regina, appeared in federal court in Rochester, New York, on Tuesday, November 3. His detention hearing did not proceed, as Roach reportedly told the court he was not ready and asked for a later date that has yet to be set. Under US federal court practice, a detention hearing is where a judge decides whether a defendant stays in custody or is released while the case proceeds. According to the US Attorney's Office, he has entered a not guilty plea.

A judge on the Saskatchewan Court of King's Bench cleared the path for his transfer in May, finding that the evidence presented by the United States met Canada's legal bar for extradition. That ruling is the judicial stage of the treaty-based process that governs transfers between Canada and the United States, in which Canada's Minister of Justice makes the final decision on surrender.

Roach is charged alongside Mathiew James Stubbings, a 41-year-old from Ontario, Canada. Stubbings has not been removed to the US; the Attorney General's office says extradition proceedings against him are still running in Canada. The outcome of those proceedings will determine whether Stubbings eventually joins Roach in a US courtroom to answer the same indictment.

What the defendants allegedly did

Prosecutors said Roach and Stubbings were indicted over conduct they carried out together between June 2016 and December 2019. During that window, the pair allegedly hunted for universities operating supercomputers, studied weak points in their networks, and forced their way in.

Once inside, they are said to have planted malware in the systems, enabling them to lift login credentials and redirect the machines' computing power to mine cryptocurrency for themselves. The scheme is a form of cryptojacking, in which attackers covertly hijack computing hardware to generate digital currency for their own benefit. Mining cryptocurrency is a compute-intensive activity, and supercomputers supply exactly the kind of sustained processing power such operations need. To cover their tracks, the defendants rented virtual private servers under fake names in several countries, including the United States.

According to the Justice Department, the institutions that fell victim to the attacks were spread across New York, Tennessee, North Carolina, and Massachusetts, with one based in the Western District of New York. Over the course of the scheme, the defendants damaged at least 10 protected computers, with losses running above $5,000.

Each man is charged with conspiracy, obtaining information from a protected computer, and intentionally damaging a protected computer. The counts carry up to 10 years in prison and a $250,000 fine.

The Electroneum trail and a $337,000 cleanup

Court filings reportedly show that in one specific case, the defendants broke into at least one New York State educational institution in 2017. They took more than 1,900 sets of login credentials and ran the school's supercomputer to mine Electroneum, a cryptocurrency. The breach reportedly cost the institution around $337,000 in damages, including the cost of shutting systems down, running forensics, and rebuilding compromised infrastructure. The figure shows how, in cases of this kind, losses can accumulate through the work of containment and rebuilding rather than through funds taken directly.

FBI investigators were able to connect the breach to Roach by working through IP addresses, server logs, email accounts, and hosting records, the filings say.

The tactics allegedly employed by Roach and his partner occurred before the proliferation of advanced AI in hacking. Google has warned that attackers are now taking the same cue and moving from classic cryptojacking toward stealing access to AI models, a tactic it calls LLMjacking.

Roach's next hearing date has not been scheduled, and he remains presumed innocent unless and until he is convicted.