Marcus Hutchins, who was praised for stalling the WannaCry attack, is now accused of creating malware.
British cyber-security researcher Marcus Hutchins will appear in court in Las Vegas later charged in a US cyber-crime case.
The 23-year-old has been accused of involvement with Kronos – a piece of malware used to steal banking logins from victims’ computers.
Mr Hutchins, from Ilfracombe in Devon, came to prominence after he stalled the WannaCry cyber-attack which hit the NHS in May.
The FBI arrested him on Wednesday.
The UK’s National Cyber Security Centre has said it was aware of the situation with fellow cyber-security researchers expressing surprise at the indictment.
WannaCry spread rapidly through computer systems around the world, in an unprecedented outbreak that began on 12 May.
Shortly afterwards, Mr Hutchins was thrust into the limelight after he found a way to stop it from spreading.
He had been in Las Vegas attending the Black Hat and Def Con cyber-security conferences, but activity on his Twitter feed – usually highly active – ceased two days ago.
“Marcus Hutchins… a citizen and resident of the United Kingdom, was arrested in the United States on 2 August, 2017, in Las Vegas, Nevada, after a grand jury in the Eastern District of Wisconsin returned a six-count indictment against Hutchins for his role in creating and distributing the Kronos banking Trojan,” the US Department of Justice (DoJ) said in a statement.
“The charges against Hutchins, and for which he was arrested, relate to alleged conduct that occurred between in or around July 2014 and July 2015.”
It is not known where Mr Hutchins is being held in custody.
Kronos is malware that is designed to steal banking login and other financial data from infected computers.
The DoJ’s indictment is dated 12 July, before Mr Hutchins arrived in the US.
It alleges that he created and sold Kronos on internet forums, including the AlphaBay dark web market, which was recently shut down after an international law enforcement operation.
His mother, Janet Hutchins, said it was “hugely unlikely” that her son was involved, saying he had spent “enormous amounts of time and even his free time” stopping attacks like these.
A second defendant is also included in the indictment, but their name has not been made public.
Mr Hutchins tweeted about Kronos shortly after it was reported in the press: “Anyone got a Kronos sample?” he wrote.