Wallace now faces the possibility of more than 40 years in jail in addition to a fine of $2 million US.
A judge banned him from using social networking sites in 2009, but authorities say he has violated that ban.
The indictment filed in San Jose federal court said Wallace compromised about 500,000 Facebook accounts by sending "phishing" messages that tricked users of the social networking site into providing their passwords.