The 23-year-old who helped stall a cyberattack which hit the UK’s hospital systems has admitted to creating software that harvests banks details, according to US prosecutors.
However, Marcus Hutchins' own lawyer says he denies six charges of creating and distributing the Kronos malware.
The young computer expert, from Devon in England, was arrested on Wednesday in Las Vegas.
He was granted $30,000 (Dih 110,000) bail, but was unable to pay. He will spend the weekend in prison.
The US Department of Justice said he had been arrested for alleged involvement in a separate incident between 2014 and 2015.
"Marcus Hutchins... a citizen and resident of the United Kingdom, was arrested in the United States on 2 August, 2017, in Las Vegas, Nevada, after a grand jury in the Eastern District of Wisconsin returned a six-count indictment against Hutchins for his role in creating and distributing the Kronos banking Trojan," it said.
"The charges against Hutchins, and for which he was arrested, relate to alleged conduct that occurred between in or around July 2014 and July 2015."
Prosecutors say Mr Hutchins had been caught in a sting operation when undercover officers
bought the code.
They claim the software was sold for $2,000 (Dih 7345) in digital currency two years ago.
According to prosecutors Mr Hutchins confessed during a police interview.
"He admitted he was the author of the code of Kronos malware and indicated he sold it," said prosecutor Dan Cowhig.
A second person, who has not yet been arrested, is implicated in the case and prosecutors say there is evidence in chat logs between Mr Hutchins and an unnamed co-defendant.
Mr Hutchins was not made to wear handcuffs when he appeared in court. Although no members of his family were present, defence lawyer Adrian Lobo presented the judge with a bundle of support letters from friends and relatives.
Mr Hutchins has never previously been in trouble with the law in the US or the UK.
