That is right. The thief got $1 million they wouldn’t have had otherwise.

You could try reading the article. It’s the very first sentence.

Federal prosecutors indicted a Nebraska man on charges he perpetrated a cryptojacking scheme that defrauded two cloud providers—one based in Seattle and the other in Redmond, Washington—out of $3.5 million.