Karim Baratov, the 23-year-old Canadian man implicated in the hacking of 500 million Yahoo accounts, has plead guilty to multiple charges in a California court.

Gizmodo is reporting that Baratov pleaded guilty to one count of conspiracy to commit computer fraud and abuse, and eight counts of aggravated identity theft. He could face up to 20 years in prison.

As a Canadian citizen, Baratov waived his right to an extradition hearing in his native country earlier this year.

In a statement, the Department of Justice wrote:

"The defendants used unauthorized access to Yahoo’s systems to steal information from about at least 500 million Yahoo accounts and then used some of that stolen information to obtain unauthorized access to the contents of accounts at Yahoo, Google and other webmail providers, including accounts of Russian journalists, U.S. and Russian government officials and private-sector employees of financial, transportation and other companies. One of the defendants also exploited his access to Yahoo’s network for his personal financial gain, by searching Yahoo user communications for credit card and gift card account numbers, redirecting a subset of Yahoo search engine web traffic so he could make commissions and enabling the theft of the contacts of at least 30 million Yahoo accounts to facilitate a spam campaign.
"

Yahoo has claimed that the 2014 hack was state-sponsored, and the other men live in Russia so they are unlikely to be extradited to the United States.