A 24-year-old British nationwide and senior member of the cybercrime group \u201cScattered Spider<\/strong>\u201d has pleaded responsible to wire fraud conspiracy and aggravated identification theft. Tyler Robert Buchanan <\/strong>admitted his function in a sequence of text-message phishing assaults in the summertime of 2022 that allowed the group to hack into not less than a dozen main know-how firms and steal tens of thousands and thousands of {dollars} value of cryptocurrency from traders.<\/p>\n Buchanan\u2019s hacker deal with \u201cTylerb<\/strong>\u201d as soon as graced a leaderboard within the English-language felony hacking scene that tracked probably the most completed cyber thieves. Now in U.S. custody and awaiting sentencing, the Dundee, Scotland native is dealing with the opportunity of greater than 20 years in jail.<\/p>\n Two images revealed in a Day by day Mail story dated Might 3, 2025 present Buchanan as a toddler (left) and as an grownup being detained by airport authorities in Spain. \u201cM&S\u201d on this screenshot refers to Marks & Spencer, a significant U.Ok. retail chain that suffered a ransomware assault final yr by the hands of Scattered Spider.<\/p>\n<\/div>\n Scattered Spider is the identify given to a prolific English-speaking cybercrime group recognized for utilizing social engineering ways to interrupt into firms and steal knowledge for ransom, usually impersonating workers or contractors to deceive IT assist desks into granting entry.<\/p>\n As a part of his responsible plea, Buchanan admitted conspiring with different Scattered Spider members to launch tens of hundreds of SMS-based phishing assaults in 2022 that led to intrusions at a lot of know-how firms, together with Twilio, LastPass, DoorDash, and Mailchimp.<\/p>\n The group then used knowledge stolen in these breaches to hold out\u00a0SIM-swapping assaults<\/a> that siphoned funds from particular person cryptocurrency traders. In an unauthorized SIM-swap, crooks switch the goal\u2019s telephone quantity to a tool they management and intercept any textual content messages or telephone calls to the sufferer\u2019s gadget \u2014 equivalent to one-time passcodes for authentication and password reset hyperlinks despatched by way of SMS. The U.S. Justice Division stated<\/a> Buchanan admitted to stealing not less than $8 million in digital forex from particular person victims all through the US.<\/p>\n FBI investigators tied Buchanan to the 2022 SMS phishing assaults after discovering the identical username and e-mail deal with was used to register quite a few phishing domains seen within the marketing campaign. The area registrar NameCheap<\/strong> discovered that lower than a month earlier than the phishing spree, the account that registered these domains logged in from an Web deal with within the U.Ok. FBI investigators stated the Scottish police instructed them the deal with was leased to Buchanan all through 2022.<\/p>\n As\u00a0first reported<\/a> by KrebsOnSecurity, Buchanan fled the UK in February 2023, after a rival cybercrime gang employed thugs to invade his house, assault his mom, and threaten to burn him with a blowtorch except he gave up the keys to his cryptocurrency pockets. That very same yr, U.Ok. investigators discovered a tool at Buchanan\u2019s Scotland residence that included knowledge stolen from SMS phishing victims and seed phrases from cryptocurrency theft victims.<\/p>\n Buchanan was arrested by Spanish authorities in June 2024<\/a> whereas attempting to board a flight to Italy. He was extradited to the US and has remained in U.S. federal custody since April 2025.<\/p>\n Buchanan is the second recognized Scattered Spider member to plead responsible. Noah Michael City<\/strong>, 21, of Palm Coast, Fla., was sentenced to 10 years in federal jail final yr<\/a> and ordered to pay $13 million in restitution. Three different alleged co-conspirators \u2014 Ahmed Hossam Eldin Elbadawy<\/strong>, 24, a.okay.a. \u201cAD,\u201d of Faculty Station, Texas; Evans Onyeaka Osiebo<\/strong>, 21, of Dallas, Texas; and Joel Martin Evans<\/strong>, 26, a.okay.a. \u201cjoeleoli,\u201d of Jacksonville, North Carolina \u2013 nonetheless face felony prices.<\/p>\n Two different alleged Scattered Spider members will quickly be tried in the UK. Owen Flowers<\/strong>, 18, and Thalha Jubair<\/strong>, 20, are dealing with prices<\/a> associated to the hacking and extortion of a number of giant U.Ok. retailers, the London transit system, and healthcare suppliers in the US. Each have pleaded not responsible, and their trial is slated to start in June.<\/p>\n![\"A](\"https:\/\/krebsonsecurity.com\/wp-content\/uploads\/2026\/04\/dailymail-tylerb.png\")
<\/p>\n