British Hacker Admits Role in Scattered Spider Attacks
A 24-year-old British national identified as a senior member of the notorious cybercrime collective Scattered Spider has entered a guilty plea in a U.S. federal court. Tyler Robert Buchanan, who operated under the hacker alias Tylerb, admitted to charges of wire fraud conspiracy and aggravated identity theft. Originally from Dundee, Scotland, Buchanan now sits in U.S. federal custody awaiting a sentencing hearing scheduled for August 21, 2026, at which point he could face a statutory maximum of 22 years in federal prison.
As part of his guilty plea, Buchanan acknowledged his involvement in a broad campaign of SMS-based phishing attacks carried out during the summer of 2022. Those attacks enabled Scattered Spider to breach at least a dozen major technology companies and ultimately steal tens of millions of dollars worth of cryptocurrency from individual investors. The U.S. Justice Department confirmed that Buchanan personally admitted to stealing at least $8 million in virtual currency from victims across the United States.
What Is Scattered Spider?
Scattered Spider is a prolific, English-speaking cybercrime group with a well-documented preference for social engineering. Rather than relying solely on technical exploits, the group is known for impersonating employees or contractors to manipulate IT help desk staff into handing over system access. Once inside a target organization, members steal sensitive data and frequently use it as leverage for ransom demands or to facilitate further financial theft.
The group is also associated with what researchers and investigators call "The Com" — a sprawling online criminal community that operates across Telegram and Discord. Members from various hacking cliques within The Com regularly boast publicly about high-profile intrusions, nearly all of which begin with social engineering: deceiving individuals via phone calls, email, or SMS messages into surrendering credentials that unlock access to corporate networks.
The 2022 Phishing Campaign
Buchanan admitted to conspiring with fellow Scattered Spider members to send tens of thousands of SMS phishing messages in 2022. Those messages led to successful intrusions at a number of well-known technology companies, including Twilio, LastPass, DoorDash, and Mailchimp. Data harvested from those breaches was then weaponized to conduct SIM-swapping attacks against individual cryptocurrency holders.
In a SIM-swap attack, criminals arrange for a victim's phone number to be transferred to a device under their control. Once that transfer is complete, they can intercept SMS messages intended for the victim — including one-time passcodes used for multi-factor authentication and password-reset links — effectively bypassing account security measures to drain cryptocurrency wallets.
How Investigators Connected Buchanan to the Attacks
FBI investigators traced Buchanan's involvement by identifying a consistent username and email address used to register multiple phishing domains linked to the 2022 campaign. Domain registrar NameCheap records revealed that, less than a month before the phishing spree began, the account responsible for registering those domains had logged in from an IP address located in the United Kingdom. Scottish police confirmed to FBI investigators that the address in question had been leased to Buchanan throughout 2022.
Further evidence was uncovered when UK investigators searched a device found at Buchanan's Scottish residence. That device contained data stolen from SMS phishing victims as well as seed phrases — the cryptographic keys used to access cryptocurrency wallets — belonging to theft victims.
Arrest, Extradition, and Time in Custody
Buchanan's path to a U.S. courtroom was anything but straightforward. As first reported by KrebsOnSecurity, he fled the United Kingdom in February 2023 after a rival cybercrime gang dispatched individuals to break into his home. Those intruders assaulted his mother and threatened to burn Buchanan himself with a blowtorch unless he surrendered the keys to his cryptocurrency holdings.
After fleeing, Buchanan was eventually apprehended by Spanish authorities in June 2024 while attempting to board a flight to Italy. He was subsequently extradited to the United States and has been held in federal custody since April 2025.
Sentencing Outlook
While Buchanan faces a statutory maximum of 22 years in federal prison, legal analysts note that any sentence handed down is likely to be moderated by several mitigating factors outlined in the U.S. Sentencing Guidelines. These include the defendant's age, his criminal history, the amount of time he has already served in U.S. custody, and the extent to which he cooperated with federal investigators.
Other Scattered Spider Members Facing Justice
Buchanan is the second known Scattered Spider member to enter a guilty plea. Noah Michael Urban, 21, of Palm Coast, Florida — who used the alias Sosa — was sentenced to 10 years in federal prison and ordered to pay $13 million in restitution. Three additional alleged co-conspirators remain under indictment:
- Ahmed Hossam Eldin Elbadawy, 24, also known as AD, of College Station, Texas
- Evans Onyeaka Osiebo, 21, of Dallas, Texas
- Joel Martin Evans, 26, also known as joeleoli, of Jacksonville, North Carolina
Two additional suspects are set to face justice in the United Kingdom. Owen Flowers, 18, and Thalha Jubair, 20, have been charged in connection with the hacking and extortion of several major UK retailers, the London transit system, and healthcare providers in the United States. Both have pleaded not guilty, and their trial is scheduled to begin in June.
Tylerb's Place in the Hacker Underground
Within criminal circles, Buchanan had built a notable reputation. His alias Tylerb appeared at position 65 out of 100 on a leaderboard maintained on a popular Telegram SIM-swapping channel — a ranking system that tracks the most prolific cryptocurrency thieves by their alleged hauls. His Scattered Spider associate Urban's alias Sosa ranked higher, coming in at position 24 on the same leaderboard. That underground credibility has since given way to a federal plea agreement, a detention cell, and a looming prison sentence that will likely define the next chapter of Buchanan's life.
Source: Krebs on Security