Tyler Robert Buchanan admitted to wire fraud and aggravated identity theft
A British man accused of leading a prolific cybercrime network has pleaded guilty in the United States to charges linked to an $8 million cryptocurrency theft campaign.
Prosecutors say 24-year-old Tyler Robert Buchanan was a central figure in the loosely organised hacking collective known as Scattered Spider, which targeted companies across multiple sectors using sophisticated social engineering techniques.
Buchanan admitted to wire fraud and aggravated identity theft, according to the US Department of Justice.
He faces a maximum sentence of 22 years in prison when he is sentenced in August 2026.
US authorities allege Buchanan and his co-conspirators hacked at least a dozen organisations between September 2021 and April 2023. Victims spanned industries including telecommunications, entertainment, IT services, cryptocurrency platforms and outsourcing firms.
The group relied heavily on SMS phishing, sending hundreds of deceptive text messages to employees. These messages appeared to come from trusted sources, such as internal IT teams or external contractors. Recipients were directed to fake websites designed to closely mimic legitimate company login pages.
Once credentials were entered, the attackers captured usernames, passwords and other sensitive data.
SIM swapping and crypto theft
Court documents reveal the group escalated attacks using SIM-swapping techniques, a method that allows criminals to take control of a victim’s phone number.
By transferring numbers to SIM cards under their control, hackers could intercept two-factor authentication codes and gain access to email accounts and cryptocurrency wallets.
This enabled the group to siphon millions of dollars in digital assets.
Stolen login details were reportedly funnelled into private messaging channels, including those hosted on Telegram, where they could be used or shared among co-conspirators.
Buchanan was arrested in June 2024 in Palma de Mallorca, Spain, and later transferred to US custody.
One co-conspirator, 21-year-old Noah Michael Urban from Florida, has already been sentenced to 10 years in prison after pleading guilty to fraud-related offences. He was also ordered to pay $13 million in restitution.
Three others – Evans Onyeaka Osiebo, Ahmed Hossam Eldin Elbadawy and Joel Martin Evans – have been charged and could face lengthy prison terms if convicted.
US District Judge John W. Holcomb has set sentencing for 21st August.
Decentralised hacking collective
Scattered Spider, also known by several aliases including 0ktapus and UNC3944, is described by the FBI as a loose network of primarily English-speaking hackers, some reportedly as young as 16.
The group has been linked to high-profile breaches affecting major companies such as MGM Resorts, Caesars, Riot Games, Twilio and Reddit.
Officials say members coordinate via online platforms including Telegram and Discord, and employ a mix of phishing, impersonation and multi-factor authentication “bombing” tactics.
Last year, the FBI warned that the group was expanding its operations, including targeting the aviation sector and collaborating with ransomware gangs.
Some individuals linked to Scattered Spider are also thought to have connections to “the Com”, a separate online collective associated with both cyberattacks and real-world violence.
