A Canadian man has been extradited to the United States to face federal charges that he and an alleged accomplice hacked into university computers, stole login credentials and used the machines to secretly mine cryptocurrency, the U.S. Justice Department said on Tuesday in a press release.

A federal grand jury in the Western District of New York indicted Ryan James Roach, 35, of Saskatchewan, and Mathiew James Stubbings, 41, of Ontario, on charges of conspiracy to obtain information from and damage a protected computer, obtaining information from a protected computer, and intentionally damaging a protected computer. The term "protected computer" comes from the Computer Fraud and Abuse Act, the federal anti-hacking statute covering computers used in interstate or foreign commerce — in practice, essentially any machine connected to the internet. The charges carry a maximum sentence of 10 years in prison and a $250,000 fine.

The U.S. Attorney's Office for the Western District of New York announced the extradition in a post on X:

Canadian man extradited to the U.S. for his role in computer hacking scheme targeting universities... @FBIBuffalo @USDOJ_Intl
— WDNYnews (@WDNYnews) November 4, 2026

According to the indictment, between June 2016 and December 2019 the two men targeted U.S. educational institutions that operated supercomputers, researching security weaknesses in the institutions' networks before breaking in. Once inside, they allegedly deployed malware, stole login credentials and forced the victims' computers to mine cryptocurrency for their own benefit. Supercomputers concentrate large amounts of processing power in a single system, capacity that can be repurposed for compute-intensive tasks such as cryptocurrency mining.

Victims included institutions in New York, Tennessee, North Carolina and Massachusetts, among them a university located in the Western District of New York, prosecutors said. The pair allegedly used virtual private servers in several countries, registered under false names, to send malware and mining software to the victim computers and to store stolen credentials. They are also accused of routing attacks through computers compromised at other victims in order to conceal their identities.

Roach, who was extradited from Canada on October 28, was arraigned in Rochester, New York, where he was held pending a detention hearing. Extradition proceedings against Stubbings are continuing in Canada.

The case arrives against a backdrop of shifting tactics in the underground economy for stolen computing resources.

From Cryptojacking to LLMjacking

The alleged scheme is a form of cryptojacking, in which attackers use other people's computers to mine cryptocurrency while the victims bear the electricity costs and reduced machine performance. The Justice Department did not say which cryptocurrency the pair allegedly mined. Privacy coin Monero has long been a favorite for schemes of this kind because it can be mined on ordinary hardware. In August, the Dutch national cyber agency warned that attackers were exploiting a flaw in Apple's macOS Screen Sharing feature to plant Monero miners on Macs.

But hackers looking to profit from stolen computing power may be turning their attention elsewhere. In a report published Monday, Google's Threat Intelligence Group said it expects attackers to "increasingly prioritize LLMjacking over traditional resource theft like cryptojacking," hijacking companies' access to AI models and passing the resulting bills on to victims.

Unlike the gradual drain of cryptojacking, LLMjacking can run up huge cloud charges within hours, Google said. In incidents investigated by its Mandiant unit this year, fraudulent charges topped $100,000 in a single day, and some organizations racked up $1 million before access was cut off. Attackers are reselling stolen access through underground services that Google refers to as "LLM Mixers."

Roach's case is pending in the Western District of New York.