A key member of the Scattered Spider cybercrime group has pleaded guilty in the United States to charges linked to a wide-ranging hacking and fraud scheme that netted millions of dollars in stolen cryptocurrency.
Tyler Buchanan, a 24-year-old from Dundee, Scotland, admitted to one count of conspiracy to commit wire fraud and one count of aggravated identity theft, according to the US Department of Justice. Prosecutors say Buchanan and his co-conspirators targeted at least a dozen companies and stole at least $8 million from victims across the United States.
The group carried out a series of SMS phishing (“smishing”) attacks between September 2021 and April 2023 using deceptive text messages to trick recipients into clicking malicious links and entering sensitive information such as login credentials. Once inside corporate systems, the attackers accessed confidential data and exploited it to steal digital assets.
Authorities said Buchanan played a key role in orchestrating the attacks, which focused on companies in the entertainment, telecommunications, technology, and cryptocurrency sectors. Evidence recovered from a device at his home in Scotland included personal data of numerous victims, as well as cryptocurrency seed phrases and account login details.
Buchanan has been in US federal custody since April 2025 and is scheduled to be sentenced on August 21. He faces a maximum penalty of 22 years in prison.
Buchanan was initially charged in November 2023 alongside several alleged accomplices, including Noah Michael Urban. The 21-year-old American was sentenced in August 2025 for wire fraud and identity theft. He was also ordered to pay $13 million in restitution.