Scattered Spider Suspect Tyler Buchanan Pleads Guilty in Crypto Theft Case
Summary
Tyler Robert Buchanan, described as an alleged Scattered Spider leader, pleaded guilty to wire fraud and aggravated identity theft. Prosecutors say the group stole at least $8 million in cryptocurrency using SMS phishing and SIM swaps; sentencing was scheduled for Aug.
Key points
- Prosecutors accused Buchanan and four others of a campaign from September 2021 to April 2023 that targeted at least a dozen companies and individuals and stole at least $8 million in cryptocurrency.
- The SMS phishing messages impersonated victim companies or their IT and BPO suppliers and linked to fake websites designed to steal personal information and account credentials.
- Court documents say the stolen information was used to hijack email accounts through SIM-swap attacks, take control of phone numbers and cryptocurrency wallets, and transfer funds to wallets controlled by the group.
- Buchanan pleaded guilty to wire fraud and aggravated identity theft. He was arrested in Spain in June 2024 and has been in U.S. federal custody since April 2025.
- His sentencing was scheduled for August 21, 2026; the article says he faces a statutory maximum of 22 years in prison.
- Three alleged accomplices were charged in November 2024; another co-conspirator, Noah Michael Urban, had previously been sentenced to 10 years after pleading guilty.
Article Details
- Event Type
- Guilty plea in a U.S. cybercrime case involving cryptocurrency theft.
- Impact
- Prosecutors said the scheme stole at least $8 million in cryptocurrency from victims at a dozen or more companies between September 2021 and April 2023. SMS phishing was used to harvest personal information and credentials, followed by SIM swaps that enabled access to email accounts, phone numbers, and virtual currency wallets. The article reports that Tyler Robert Buchanan pleaded guilty and is scheduled for sentencing on August 21, 2026.
MITRE ATT&CK
T1078 · Valid AccountsThe article says stolen credentials were used to hijack victims' email accounts.T1566.002 · Spearphishing LinkThe group sent SMS phishing messages containing links to websites designed to harvest personal information and account credentials.T1621 · Multi-Factor Authentication Request GenerationThe article says the group used targeted MFA bombing, also described as MFA fatigue.
Threat Actors
0ktapusThe article identifies 0ktapus as another name for Scattered Spider, which it links to phishing, SIM swapping, and cryptocurrency theft.Ahmed Hossam Eldin ElbadawyThe article reports that Elbadawy was charged in November 2024 as an alleged co-conspirator in the wire fraud and identity theft scheme.Evans Onyeaka OsieboThe article reports that Osiebo was charged in November 2024 as an alleged co-conspirator in the wire fraud and identity theft scheme.Joel Martin EvansThe article reports that Evans was charged in November 2024 as an alleged co-conspirator in the wire fraud and identity theft scheme.Noah Michael UrbanThe article describes Urban as a key Scattered Spider member and a conspirator; it reports that he pleaded guilty to wire fraud and conspiracy charges and was sentenced to 10 years in prison.Scatter SwineThe article lists Scatter Swine as a tracking name for Scattered Spider, the collective it links to corporate intrusions and cryptocurrency theft.Scattered SpiderThe article identifies this cybercrime collective as responsible for SMS phishing, SIM swapping, and other tactics used to compromise corporate accounts and steal cryptocurrency; Tyler Robert Buchanan pleaded guilty in the related case.StarfraudThe article lists Starfraud as a tracking name for Scattered Spider, the collective it links to corporate intrusions and cryptocurrency theft.Tyler Robert BuchananThe article identifies Buchanan as the alleged leader of Scattered Spider and reports that he pleaded guilty to wire fraud and aggravated identity theft in the cryptocurrency theft case.UNC3944The article identifies UNC3944 as another name for Scattered Spider, which it links to phishing, SIM swapping, and cryptocurrency theft.
Products
DiscordScattered Spider (also known as 0ktapus/UNC3944) operates via Telegram and Discord, uses MFA bombing and social engineering, and has been linked to breaches at MGM, Caesars, Riot Games, and others.TelegramScattered Spider (also known as 0ktapus/UNC3944) operates via Telegram and Discord, uses MFA bombing and social engineering, and has been linked to breaches at MGM, Caesars, Riot Games, and others.
Countries
Industries
business process outsourcingfrom a wide range of industries, such as entertainment, telecommunications, technology, business process outsourcing (BPO), and information technology (IT) suppliers, as well as cloud communications providers,Cloud communicationsbusiness process outsourcing (BPO), and information technology (IT) suppliers, as well as cloud communications providers, virtual currency providers, and individuals.EntertainmentThe list of breached organizations includes companies from a wide range of industries, such as entertainment, telecommunications, technology, business process outsourcing (BPO), and information technology (IT)Information Technologysuch as entertainment, telecommunications, technology, business process outsourcing (BPO), and information technology (IT) suppliers, as well as cloud communications providers, virtual currency providers, andTechnologyincludes companies from a wide range of industries, such as entertainment, telecommunications, technology, business process outsourcing (BPO), and information technology (IT) suppliers, as well as cloudTelecommunicationsbreached organizations includes companies from a wide range of industries, such as entertainment, telecommunications, technology, business process outsourcing (BPO), and information technology (IT) suppliers, as wellVirtual currency(BPO), and information technology (IT) suppliers, as well as cloud communications providers, virtual currency providers, and individuals.