Canadian extradited to US in alleged university cryptomining scheme

Those virtual private servers were spread across multiple countries and registered under false names, according to the indictment as described by the Justice Department. They distributed malware and mining software as well as storing stolen credentials.

Prosecutors also allege that the defendants researched security weaknesses, used a server and compromised computers belonging to another victim to conceal their identities, and explored networks to expand their access after entering them. The announcement identifies campuses with supercomputers as targets; it does not specify the type of each computer allegedly damaged.

Canadian court filings identified the cryptocurrency as Electroneum, according to a report citing those filings. The Justice Department’s announcement does not name the currency or disclose mining proceeds.

DOJ alleges these minimums for a one-year period; they are not totals for the alleged 2016–2019 scheme. Source: US Department of Justice.

What the loss figures establish

The Justice Department alleges that the defendants damaged 10 or more protected computers during a one-year period and caused a loss of at least $5,000. Both figures are minimums for that period, rather than a count of all compromised machines or a full damage estimate for the alleged 2016–2019 scheme.

The announcement does not quantify the computing capacity diverted, the duration of mining on individual systems or any interruption to research. It therefore provides no basis for calculating mining revenue, a cost per affected machine or the relationship between the defendants’ alleged gains and institutional losses.

US prosecution and Canadian extradition proceedings

A federal grand jury charged both men with conspiracy to obtain information from and damage protected computers, obtaining information from a protected computer, and intentional damage to a protected computer. The Justice Department says the offenses carry a maximum penalty of 10 years in prison and a $250,000 fine. These are potential penalties, not sentences imposed.

Roach was extradited on October 28 and arraigned before a US magistrate judge. The November 3 announcement said he was held pending a detention hearing scheduled for 1 p.m. that day; it did not state the hearing’s outcome. The FBI investigated the case, and the Justice Department’s Office of International Affairs assisted with his arrest and extradition.

Roach now faces the US criminal process, while Stubbings’ extradition remains unresolved. Both defendants are presumed innocent unless proven guilty. Further court evidence is needed to establish their responsibility for the alleged intrusions and to determine the extent of the computing resources taken and damage caused.