A 35-year-old Canadian man has been extradited to the United States
A 35-year-old Canadian man has been extradited to the United States to face federal criminal charges in connection with a multi-year cyber-intrusion and illegal cryptomining campaign targeting higher-education networks and academic supercomputing infrastructure across four U.S. states.
Ryan James Roach, 35, who has lived in Saskatoon and Regina, Saskatchewan, was extradited from Canada on October 28, 2026, and arraigned in federal court in Rochester, New York, before U.S. Magistrate Judge Mark W. Pedersen. He remains in federal custody after his scheduled detention hearing on November 3 was postponed upon request. Roach has pleaded not guilty to all charges.
Co-defendant Mathiew James Stubbings, 41, of Ontario, remains in Canada as formal surrender and extradition proceedings continue through Canadian courts.
Infrastructure Hijacking and High-Performance Computer Targeting
According to federal court records unsealed in the U.S. District Court for the Western District of New York, the intrusion campaign ran continuously from June 2016 through December 2019.
To execute their intrusions while evading attribution, the pair established command-and-control (C2) infrastructure on Virtual Private Servers (VPS) across several European countries using false identities and alias registration accounts. These servers were used to transmit scanning tools, store keyloggers and rootkits, host custom exploit payloads, and store compromised administrative credentials.
Once inside a target university network, the threat actors deployed specialized privilege escalation techniques to expand their access laterally into high-performance computing (HPC) nodes. Prosecutors note that the pair routinely repurposed previously breached servers from other victims as intermediate proxy pivot points to mask their physical origin.
Cryptomining Exploitation & Electroneum Theft
Court records and Canadian extradition filings reveal that after establishing administrative control, the pair installed cryptomining software designed to mine Electroneum,a privacy-centric altcoin launched in late 2017.
By offloading the heavy computational workload onto university supercomputers, the actors siphoned power and processing capacity without incurring hardware or utility expenses. Over a single 12-month period, the indictment notes that at least 10 high-performance servers were directly hijacked and damaged, resulting in an estimated $337,000 USD in structural remediation and recovery costs for affected institutions.
Digital forensics conducted during the multi-year investigation linked Roach to server lease payments under his real name, email addresses matching operational handles (such as an account under the alias "John Vega"), and web search histories detailing specific supercomputer exploit vectors, rootkits, and mining parameters.
Legal Proceedings and Extradition Status
The investigation was coordinated by the FBI Buffalo Field Office under Special Agent-in-Charge Allen D. Davis, II, along with the Department of Justice’s Computer Crime and Intellectual Property Section (CCIPS). The U.S. Department of Justice’s Office of International Affairs (OIA) worked alongside Canadian law enforcement and diplomatic officials to execute the extradition under the U.S.-Canada Extradition Treaty.
Both Roach and Stubbings face a grand jury indictment alleging:
- Conspiracy to obtain information from a protected computer and to cause intentional damage
- Unauthorized access to obtain information from a protected computer
- Intentional damage to a protected computer
Each individual charge carries a statutory maximum penalty of 10 years in U.S. federal prison and fines up to $250,000 USD per count.
An indictment is strictly an allegation, and all defendants are presumed innocent until proven guilty in a court of law.
The Memory-Bound Advantage of CryptoNight
During the 2016 - 2019 window of the indicted conspiracy, Electroneum relied on variations of the CryptoNight proof-of-work algorithm. CryptoNight was explicitly designed to be memory-bound, requiring a dedicated block of system RAM (a "scratchpad") for every hash calculation, heavily utilizing native AES encryption instructions and large CPU caches.
Because ASICs could not easily bypass these memory-latency constraints without becoming economically unviable, regular multi-core processors excelled at the math. Academic supercomputers, boasting immense multi-gigabyte cache sizes and massive parallel CPU arrays, offered the ideal infrastructure to maximize mining yields for CryptoNight-based altcoins while remaining undetected beneath standard academic workloads.
