AFAIK, they arrested him because of the creation and sale/distribution of the Kronos and "UPAS Kit" malware [1].

[1]: https://www.justice.gov/usao-edwi/pr/marcus-hutchins-pleads-...