Two Canadians charged with hacking US universities to mine crypto

A federal grand jury has indicted two Canadians, accused of breaking into US universities and using their computers to mine cryptocurrency. Prosecutors say the activity ran from June 2016 to December 2019. One of the two men is already in US custody. The other is still waiting to be extradited.

What is alleged

The men are Ryan James Roach, 35, and Mathiew James Stubbings, 41. Prosecutors say they targeted schools in New York, Tennessee, North Carolina and Massachusetts. The Department of Justice has not named the schools. The charges include conspiracy to obtain information from a protected computer and to damage one, plus the act of obtaining information and the act of damaging a protected computer.

How the scheme allegedly worked

Court documents say the pair rented virtual private servers in several countries, registered under fake names. Those servers sent malware and mining software to victim computers and stored stolen login credentials. Mining means using a computer's power to earn cryptocurrency. The schools paid for that power and the electricity, not the hackers.

Prosecutors say the men chose schools with supercomputers, which are extremely powerful machines used for research. They allegedly stole data and passwords, installed mining malware and, in some cases, used the hacked systems to look for more security weaknesses. They also allegedly hid behind a server and computers taken from another victim.

• At least 10 computers were damaged over one year.
• Prosecutors cite losses of at least $5,000.
• Each man faces up to 10 years in prison and a $250,000 fine if found guilty.

Where the case stands

Roach was extradited from Canada on October 28. He was arraigned before a detention hearing on November 3. Stubbings will be arraigned after his own extradition from Canada. The charges are allegations, and neither man has been found guilty.

The report also notes that Harvard, Princeton and the University of Pennsylvania disclosed data breaches in November 2025, with donor information among the data accessed. Nothing in the material links those incidents to this case.

What to do

The case shows that intruders can stay hidden for years. Stolen passwords were part of the alleged method, so strong, unique passwords matter. Turn on two-step login for school and work accounts, so a stolen password alone is not enough to get in.