Scottish Hacker at the Center of Scattered Spider Admits Guilt
The U.S. Department of Justice announced on Friday that Tyler Robert Buchanan, a 24-year-old British national from Dundee, Scotland, has pleaded guilty to federal charges stemming from his role in a sprawling cybercrime campaign. Buchanan entered guilty pleas on counts of conspiracy to commit wire fraud and aggravated identity theft — offenses tied to a series of high-profile phishing attacks and cryptocurrency thefts carried out between September 2021 and April 2023.
Buchanan has been held in federal custody since April 2025 and is scheduled to be sentenced on August 21. He faces a maximum of 22 years in federal prison.
Arrest on a Spanish Island After a Years-Long Chase
Spanish authorities arrested Buchanan in Palma, Mallorca, in June 2024 as he attempted to board a charter flight to Naples, Italy. Following his arrest, Spanish police disclosed that Buchanan had gained control of bitcoin valued at more than $27 million at the time. His eventual extradition to the United States placed him in federal custody earlier this year.
It remains unclear precisely what transpired between a search of his Scottish residence in April 2023 — during which police recovered a digital device containing personal data on numerous individuals and victim companies — and his arrest at the Mallorcan resort city more than a year later. Notably, his plea agreement does not encompass the full scope of his alleged criminal activity.
Phishing, SIM-Swapping, and Millions Stolen
Buchanan and his co-conspirators harvested thousands of credentials through targeted phishing campaigns, then exploited those credentials alongside SIM-swapping attacks to steal more than $8 million in cryptocurrency from residents across the United States. Victims ranged from high-net-worth individuals to businesses operating in the entertainment, telecom, technology, business process outsourcing, IT, cloud, and virtual currency sectors.
Federal authorities allege that the group defrauded at least a dozen companies and their employees throughout the country.
The Scattered Spider Connection
Buchanan was a core figure within Scattered Spider, an aggressive subset of the loosely organized cybercriminal ecosystem known as The Com. The Justice Department filed charges against five individuals linked to Scattered Spider in 2024. One of Buchanan's alleged co-conspirators, Noah Michael Urban, was sentenced to a 10-year federal prison term last year. Three others — Ahmed Hossam Eldin Elbadawy, Evans Onyeaka Osiebo, and Joel Martin Evans — still face pending charges.
Allison Nixon, chief research officer at Unit 221B, offered a candid assessment of Buchanan's influence within the group.
"[Buchanan] was the glue that held this gang together. His success at wiping out victims' savings made him a target for both law enforcement and rival Com gangs,"Nixon told CyberScoop. She elaborated on his background:
"[Buchanan] is part of an older generation that came from certain toxic gaming servers before the pandemic. People from this generation learned hacking in order to steal vanity usernames and bully kids before using it to steal peoples' savings."
A Blowtorch, Rival Gangs, and a Culture of Excess
Buchanan's notoriety extended beyond law enforcement. According to Nixon, a rival Com gang allegedly broke into his home and used a blowtorch on him in an effort to extract cryptocurrency keys he had in his possession — a stark illustration of the violent undercurrents running through The Com's culture.
Nixon also highlighted how authorities exploited Buchanan's own lifestyle choices against him, praising law enforcement for acting decisively during a narrow window while he traveled internationally.
"Com members are obsessed with private jets and foreign vacations, and the feds took that dream away with one arrest,"she said.
Nixon explained that the tactic of apprehending cybercriminals abroad — one also employed against Russian threat actors — is effective because most countries are willing to support the arrest of foreign criminals rather than harbor them.
"As a foreigner, he was caught in a weaker legal position than if he was arrested at home, and cases following this tactic tend to have very long sentences. The takeaway for Com members watching this case is that criminal foreigners associated with violence are the lowest class in every country. And that's what Com members are when they travel."
The Com's Expanding Criminal Footprint
While early Scattered Spider leaders have been arrested or sentenced, others have stepped in to fill vacated roles — often with even greater operational impact. The Com has grown to thousands of members, predominantly between the ages of 11 and 25, and has fractured into three primary subsets that the FBI characterizes as Hacker Com, In Real Life Com, and Extortion Com.
The criminal activities attributed to these interconnected networks span a disturbing range, including:
- Swatting
- Extortion and sextortion of minors
- Production and distribution of child sexual abuse material
- Violent crime
- Various other forms of cybercrime
What Comes Next
With Buchanan's sentencing set for August 21 and three co-defendants still awaiting trial, the Scattered Spider prosecutions are far from over. Law enforcement agencies appear committed to dismantling the broader Com ecosystem, using international cooperation and the travel habits of its members as leverage. For Buchanan, the charter flight to Naples proved to be the last journey of his criminal career.
Source: CyberScoop