Short answer: Two Canadians were extradited to the US for hacking university supercomputers to mine cryptocurrency. Universities and their supercomputers were affected. Students should stay aware and use strong passwords.
TL;DR
- Two Canadians indicted for cybercrime in the US.
- Hackers targeted university supercomputers.
- Cryptocurrency mining software used on victims' machines.
- Extradition proceedings ongoing for one suspect.
What happened at Canadian?
This incident involves two Canadians, Ryan Roach and Mathiew Stubbings, who were indicted for hacking into university supercomputers in the US to secretly mine cryptocurrency. They used sophisticated techniques to install malware and mining software on victim machines. This highlights the risk to academic institutions and the importance of robust cybersecurity measures to protect sensitive data and computing resources.
- Malware
- Harmful software made to spy, steal or damage.
- Credentials / secrets
- Passwords, keys and tokens that prove who you are to a system.
Key facts
| Reported by | SecurityWeek |
|---|---|
| Date reported | 04 Nov 2026 |
How it works
The attackers used malware to hijack university supercomputers. The hijacked computers were used to mine cryptocurrency called Electroneum.
Timeline
| Date | Event | Source |
|---|---|---|
| 2026-11-04 | Reported by SecurityWeek | SecurityWeek |
| 2026-11-09 | This Skillmate explainer published | Skillmate |
How to fix it
- If you keep crypto on an exchange, move long-term holdings to a wallet you control and turn on withdrawal address allow-lists.
- Use app-based or hardware-key two-factor authentication on exchange and wallet accounts, not SMS codes.
- Treat unexpected job offers, coding tests or trading apps sent over chat as suspicious; they are a common lure in crypto theft.
- Companies holding crypto: require more than one approver for large transfers and keep signing keys on separate, locked-down devices.
How to detect it
Defenders should look for unusual system crashes, strange login attempts, and unexpected use of resources.
Signs to watch for:
- Withdrawals to new addresses, or at unusual sizes or times.
- New devices, API keys or withdrawal addresses added to exchange or wallet accounts.
- Developer tools, packages or 'trading' apps installed right after a recruiter or job chat.
What is confirmed
- Reported by SecurityWeek
Why it matters
This attack matters because it highlights the risks of supercomputers being targeted for cryptocurrency mining. It also shows the importance of strong network security and regular checks to prevent unauthorized access. Students and companies should be aware of these threats.
Learn the skills behind this story
Want to understand attacks like this and defend against them? Join Skillmate cybersecurity training or practise hands-on in Skillmate Labs.
FAQ
How long did the hack last?
The hack spanned from June 2016 to December 2019, over a period of about four years.
What penalties could Roach and Stubbings face?
If convicted, each count could result in up to 10 years in prison and a $250,000 fine.
Sources
How we wrote this: facts come from the sources above. An on-prem AI model drafted the plain-English parts and every sentence was checked against the sources; unsupported sentences were removed. MITRE mapping is our own judgement.