Supercomputers at 4 U.S. universities were secretly used for crypto mining by the same group for three and a half years
The U.S. Department of Justice announced this week that 35-year-old Canadian Ryan James Roach has been extradited to the United States to face trial 🖥️
🧭 群里聊方向
He and his 41-year-old accomplice, Mathiew James Stubbings, are accused of hacking supercomputers at universities in New York, Tennessee, North Carolina, and Massachusetts between June 2016 and December 2019
According to the indictment, the two first studied weaknesses in the universities’ networks, then broke in
Once inside, they deployed malware and stole login credentials, making victims’ machines mine crypto for them ⛏️
To hide their identities, they used virtual private servers registered in multiple countries and signed up using fake names
They also routed attack traffic through other victims’ computers, layering one connection on top of another
They kept the coins they mined, while the universities were left with the electricity bills and wear and tear on their machines
Roach was extradited from Canada on October 28 and arraigned in Rochester, New York. He is currently being held pending a hearing
Stubbings’ extradition proceedings are still underway in Canada
The three charges carry a maximum sentence of 10 years in prison and a $250,000 fine 🦖
But what’s really worth paying attention to here isn’t how many years they might get
It’s how the target of computational-resource theft has changed
For the past decade, hackers have focused on electricity costs, slowly mining Monero using other people’s CPUs and graphics cards
Monero remains the go-to choice in these cases because it can be mined with ordinary hardware
In August this year, the Dutch National Cyber Security Centre also warned that someone was exploiting a vulnerability in Apple macOS Screen Sharing to install Monero miners on Macs
Now Google’s Threat Intelligence team is pointing to a new trend: hackers are beginning to hijack companies’ access to AI models
The technique is called LLMjacking, and what’s being resold is someone else’s cloud computing allowance 🤖
Unlike the slow and steady process of mining, this kind of theft can rack up enormous cloud bills within hours
In cases investigated this year by Mandiant, a Google subsidiary, fraudulent bills exceeded $100,000 in a single day
Some organizations had accumulated charges of $1 million before their access was cut off 💸
Underground markets have even seen services dedicated to reselling this access, which Google calls “LLM Mixers”
Put simply, the target of attacks has shifted from machines to access privileges, and from electricity bills to API bills
The former hurts data centers; the latter hurts finance and risk-control teams
For ordinary crypto holders, this news has no direct impact on prices. Bitcoin remains above $80,000
But it illustrates one thing: the more valuable computing power becomes, the greater the incentive to steal it
Miners are worrying about electricity prices, businesses are worrying about AI bills, and the security budget in between is often the easiest thing to cut ⚠️
What do you think the next target will be: the computing resources of crypto exchanges, or AI companies’ model access?
Let’s talk in the comments
Every day, we bring you the latest in crypto security—not just what’s happening, but also the logic and opportunities behind it 👀🚀
The U.S. Department of Justice announced this week that 35-year-old Canadian Ryan James Roach has been extradited to the United States to face trial 🖥️
🧭 群里聊方向
He and his 41-year-old accomplice, Mathiew James Stubbings, are accused of hacking supercomputers at universities in New York, Tennessee, North Carolina, and Massachusetts between June 2016 and December 2019
According to the indictment, the two first studied weaknesses in the universities’ networks, then broke in
Once inside, they deployed malware and stole login credentials, making victims’ machines mine crypto for them ⛏️
To hide their identities, they used virtual private servers registered in multiple countries and signed up using fake names
They also routed attack traffic through other victims’ computers, layering one connection on top of another
They kept the coins they mined, while the universities were left with the electricity bills and wear and tear on their machines
Roach was extradited from Canada on October 28 and arraigned in Rochester, New York. He is currently being held pending a hearing
Stubbings’ extradition proceedings are still underway in Canada
The three charges carry a maximum sentence of 10 years in prison and a $250,000 fine 🦖
But what’s really worth paying attention to here isn’t how many years they might get
It’s how the target of computational-resource theft has changed
For the past decade, hackers have focused on electricity costs, slowly mining Monero using other people’s CPUs and graphics cards
Monero remains the go-to choice in these cases because it can be mined with ordinary hardware
In August this year, the Dutch National Cyber Security Centre also warned that someone was exploiting a vulnerability in Apple macOS Screen Sharing to install Monero miners on Macs
Now Google’s Threat Intelligence team is pointing to a new trend: hackers are beginning to hijack companies’ access to AI models
The technique is called LLMjacking, and what’s being resold is someone else’s cloud computing allowance 🤖
Unlike the slow and steady process of mining, this kind of theft can rack up enormous cloud bills within hours
In cases investigated this year by Mandiant, a Google subsidiary, fraudulent bills exceeded $100,000 in a single day
Some organizations had accumulated charges of $1 million before their access was cut off 💸
Underground markets have even seen services dedicated to reselling this access, which Google calls “LLM Mixers”
Put simply, the target of attacks has shifted from machines to access privileges, and from electricity bills to API bills
The former hurts data centers; the latter hurts finance and risk-control teams
For ordinary crypto holders, this news has no direct impact on prices. Bitcoin remains above $80,000
But it illustrates one thing: the more valuable computing power becomes, the greater the incentive to steal it
Miners are worrying about electricity prices, businesses are worrying about AI bills, and the security budget in between is often the easiest thing to cut ⚠️
What do you think the next target will be: the computing resources of crypto exchanges, or AI companies’ model access?
Let’s talk in the comments
Every day, we bring you the latest in crypto security—not just what’s happening, but also the logic and opportunities behind it 👀🚀
