Scattered Spider cybercrime leader pleads guilty to $8M crypto theft

A British man identified as the leader of the Scattered Spider cybercrime collective has pleaded guilty in U.S. federal court to wire fraud and aggravated identity theft charges. Tyler Robert Buchanan, 24, admitted to participating in a scheme that stole at least $8 million in cryptocurrency by hacking more than a dozen companies between 2021 and 2023. The group targeted organizations across multiple industries including entertainment, telecommunications, technology, and cloud communications. Prosecutors said Buchanan and his accomplices conducted SMS phishing attacks, sending fraudulent text messages that appeared to come from legitimate company sources or IT suppliers. The messages contained links to phishing websites designed to steal login credentials and personal information. The hackers used stolen credentials to perform SIM swap attacks, hijacking victims' phone numbers to gain access to cryptocurrency wallets and transfer funds to accounts they controlled. Buchanan was arrested in Spain in June 2024 and transferred to U.S. custody in April 2025. He faces a maximum sentence of 22 years in prison when sentenced on August 21, 2026. Three other alleged members of the Scattered Spider collective face similar charges and up to 20 years in prison if convicted. A fourth conspirator, Noah Michael Urban, was sentenced to 10 years in prison last year after pleading guilty to wire fraud and conspiracy charges. Scattered Spider, also known by aliases including 0ktapus and Octo Tempest, is a loose-knit group of English-speaking hackers who coordinate attacks through Telegram channels, Discord servers, and online forums. The collective includes members as young as 16 and employs tactics including social engineering, phishing, multi-factor authentication bombing, and SIM swapping. According to the FBI, Scattered Spider has partnered with Russian ransomware gangs including BlackCat/AlphV and has been linked to high-profile breaches at companies including MGM Resorts, Caesars Entertainment, Riot Games, and Twilio. The guilty plea represents a significant development in law enforcement efforts to combat cybercrime collectives that use sophisticated social engineering techniques to bypass security measures. The case highlights ongoing challenges in protecting organizations from determined threat actors who exploit human vulnerabilities rather than technical weaknesses in systems.