A British national in his mid-twenties and prominent figure within the Scattered Spider criminal network has entered a guilty plea to wire fraud conspiracy and identity theft charges. Tyler Robert Buchanan confessed to participating in text-message-based phishing campaigns during summer 2022 that breached at least a dozen significant technology enterprises and resulted in the theft of tens of millions of dollars in cryptocurrency from investors.

Operating under the alias "Tylerb," Buchanan once ranked among the most prolific cyber criminals tracked on underground leaderboards within English-language hacking circles. The Dundee resident now sits in U.S. federal custody pending sentencing and faces potential imprisonment exceeding two decades.

Scattered Spider represents a highly active English-speaking criminal organization that relies on social engineering methods to infiltrate corporate systems and extract sensitive information for extortion purposes. The group typically assumes false identities as employees or service providers to manipulate IT support staff into granting system access.

Through his guilty plea, Buchanan acknowledged coordinating with fellow Scattered Spider operatives to execute tens of thousands of SMS phishing attacks during 2022. These campaigns successfully penetrated technology firms including Twilio, LastPass, DoorDash, and Mailchimp.

SIM-Swapping and Cryptocurrency Theft

Following successful breaches, the organization leveraged stolen credentials to execute SIM-swapping schemes targeting individual cryptocurrency holders. This technique involves reassigning a victim's phone number to a device controlled by the attackers, enabling them to intercept authentication codes and account recovery messages transmitted via text. According to the U.S. Justice Department, Buchanan personally stole no less than $8 million in virtual currency from American victims through these operations.

Investigation and Arrest

Federal Bureau of Investigation agents connected Buchanan to the 2022 SMS phishing operations by identifying matching usernames and email addresses across multiple phishing domain registrations. The domain registrar NameCheap documented that the account establishing these domains accessed the system from a United Kingdom internet address approximately one month prior to the phishing campaign. Scottish law enforcement confirmed the address belonged to Buchanan during 2022.

Buchanan departed the United Kingdom in February 2023 following a violent home invasion orchestrated by competing cybercriminals who assaulted his mother and threatened him with a blowtorch to obtain his cryptocurrency wallet credentials. During a 2023 search of his Scottish residence, investigators recovered devices containing data from SMS phishing targets and cryptocurrency wallet recovery phrases.

Spanish law enforcement apprehended Buchanan in June 2024 as he prepared to board a flight bound for Italy. Following extradition proceedings, he has remained in U.S. federal custody beginning in April 2025.

Other Scattered Spider Cases

Buchanan represents the second Scattered Spider member to enter a guilty plea. Noah Michael Urban, age 21 from Palm Coast, Florida, received a 10-year federal prison sentence last year and was ordered to pay $13 million in restitution. Three additional alleged conspirators remain under criminal indictment: Ahmed Hossam Eldin Elbadawy, 24, known as "AD," from College Station, Texas; Evans Onyeaka Osiebo, 21, from Dallas, Texas; and Joel Martin Evans, 26, operating under the alias "joeleoli," from Jacksonville, North Carolina.

Two other suspected Scattered Spider operatives face prosecution in United Kingdom courts. Owen Flowers, 18, and Thalha Jubair, 20, are charged in connection with hacking and extortion targeting major U.K. retailers, London's transit infrastructure, and American healthcare organizations. Both have entered not guilty pleas, with trial proceedings scheduled to commence in June.

The Broader Criminal Community

Law enforcement officials characterize the Scattered Spider suspects as participants within a larger cybercriminal ecosystem designated "The Com," where hackers from various groups publicize their exploits across Telegram and Discord messaging platforms. These operations typically originate through social engineering tactics—manipulating individuals via telephone, electronic mail, or text messaging to divulge credentials enabling unauthorized network access.

A prominent Telegram channel dedicated to SIM-swapping maintains a competitive ranking of the most successful practitioners, ordered by their cryptocurrency theft achievements. The leaderboard previously positioned Buchanan's alias "Tylerb" at rank 65 out of 100 operators, while Urban's handle "Sosa" appeared at position 24.

Sentencing Outlook

Buchanan's sentencing proceeding is scheduled for August 21, 2026. The Justice Department indicates he faces a maximum statutory penalty of 22 years in federal prison. Nevertheless, the judge may substantially reduce any imposed sentence based on mitigating circumstances outlined in federal sentencing guidelines, including Buchanan's age, absence of prior convictions, duration of pretrial detention, and extent of cooperation with federal investigators.

Source: Krebs on Security