Pyotr Levashov was held in Barcelona and has been remanded in custody.
Spanish coppers claim Levashov controlled a botnet called Kelihos, hacking information and installing malicious software in hundreds of thousands of computers.
The arrest was part of a “complex inquiry carried out in collaboration with the FBI”, police said.
Levashov is subject to a US international arrest warrant and a Spanish court will hear whether he can be extradited.
Much of his activity involved ransomware – blocking a computer’s access to certain information and demanding a ransom for its release.
Levashov’s wife Maria told Russian broadcaster RT that the arrest had been made in connection with allegations that Russians had hacked the US presidential election.
She claimed that Spanish coppers had told her that it was all about a “a virus which appears to have been created by my husband and is linked to [Donald] Trump’s victory”.
Agence France-Presse quoted a source close to the matter in Washington as saying that Levashov’s detention was “not tied to anything involving allegations of Russian interference with the US election”.
Several cybersecurity experts, including Brian Krebs, have also linked Levashov to a Russian spam kingpin, who uses the alias Peter Severa.