I may be totally off base here but IIRC, before he ran MalwareTech and was a whitehat, he participated (and was an op) in fairly "shady" IRC channels, with his oldest nick I can recall being `Ntoskrnl`, dedicated to malware and malware development which even had a person (Edit3: As pointed out in this thread, that person was `BetaMonkey/TouchMe`) who was selling a variant of a botnet drone client builder. Edit2: From one of the comments below in this thread, the network on which he was present (and was an IRC operator of) was `irc.voidptr.cz` or a variation of that, I could not recall the name of the network at first but when someone mentioned it, I instantly recognized it.

If he's who I think he is, I doubt his early background is that clean, despite him being a whitehat now. It is very much possible he is being held because of something related to that and not because of anything related to WannaCry. This was all before he even started running the MalwareTech blog, it's very much possible the FBI decided to look into his background or were already familiar with it prior to him arriving in or leaving the US.

That being said, it's possible that I'm mistaking him for someone else in which case I do apologize. I edited the post a bit, to clarify, the first paragraph to the best of my knowledge is certainly true, second one is based on my own speculation so take it with a grain of salt.