Tyler Robert Buchanan, a 24-year-old British national and senior member of the notorious cybercrime organization Scattered Spider, has entered a guilty plea to charges of wire fraud conspiracy and aggravated identity theft. The Dundee, Scotland resident, who operated under the alias "Tylerb," played a central role in sophisticated SMS phishing campaigns that compromised multiple major technology companies during the summer of 2022, ultimately facilitating the theft of tens of millions of dollars in cryptocurrency.
Buchanan's criminal activities positioned him prominently within the English-speaking cybercriminal community, where his hacker alias previously appeared on leaderboards tracking the most successful cyber thieves. Now in U.S. federal custody and awaiting sentencing, he faces the possibility of more than 20 years in federal prison.
Scattered Spider represents one of the most prolific English-speaking cybercrime groups operating today, distinguished by their sophisticated use of social engineering tactics to infiltrate corporate networks. The organization specializes in impersonating employees or contractors to manipulate IT help desk personnel into granting unauthorized access to sensitive systems, subsequently stealing data for ransom purposes.
According to court documents, Buchanan collaborated with fellow Scattered Spider members to execute tens of thousands of SMS-based phishing attacks throughout 2022. These coordinated campaigns successfully breached numerous prominent technology companies, including Twilio, LastPass, DoorDash, and Mailchimp.
The cybercriminals leveraged data obtained from these corporate breaches to conduct SIM-swapping attacks against individual cryptocurrency investors. SIM-swapping involves illegally transferring a victim's phone number to a device controlled by attackers, allowing them to intercept text messages and phone calls, including one-time authentication codes and password reset links sent via SMS. The Department of Justice confirmed that Buchanan admitted to stealing at least $8 million in virtual currency from victims across the United States through these methods.
FBI investigators successfully traced Buchanan's involvement in the 2022 SMS phishing operations by identifying consistent use of the same username and email address across multiple phishing domains. Domain registrar NameCheap provided crucial evidence, revealing that the account responsible for registering these malicious domains had accessed their services from a U.K. IP address less than a month before the phishing campaign commenced. Scottish police confirmed that this internet address was leased to Buchanan throughout 2022.
In February 2023, Buchanan fled the United Kingdom following a violent home invasion orchestrated by a rival cybercrime group. The attackers assaulted his mother and threatened to torture him with a blowtorch unless he surrendered his cryptocurrency wallet credentials. U.K. investigators subsequently discovered digital evidence at Buchanan's Scottish residence, including data stolen from SMS phishing victims and cryptocurrency seed phrases from theft victims.
Spanish authorities apprehended Buchanan in June 2024 as he attempted to board a flight to Italy. Following his extradition to the United States, he has remained in federal custody since April 2025.
Buchanan represents the second confirmed Scattered Spider member to enter a guilty plea. Noah Michael Urban, a 21-year-old from Palm Coast, Florida, received a 10-year federal prison sentence and was ordered to pay $13 million in restitution. Three additional alleged co-conspirators face pending criminal charges: Ahmed Hossam Eldin Elbadawy (24) of College Station, Texas; Evans Onyeaka Osiebo (21) of Dallas, Texas; and Joel Martin Evans (26) of Jacksonville, North Carolina.
Two other suspected Scattered Spider members, Owen Flowers (18) and Thalha Jubair (20), await trial in the United Kingdom on charges related to hacking and extortion targeting major U.K. retailers, the London transit system, and U.S. healthcare providers. Both have entered not guilty pleas, with their trial scheduled to commence in June.
According to investigators, the Scattered Spider suspects operate within a broader cybercriminal ecosystem known as "The Com," where hackers from various groups publicly boast about high-profile cyber thefts on platforms like Telegram and Discord. These operations typically begin with social engineering techniques designed to trick individuals into divulging credentials that provide remote access to corporate networks.
A popular SIM-swapping channel on Telegram maintains a leaderboard ranking the most successful cryptocurrency thieves by their purported stolen amounts. This leaderboard previously ranked Buchanan's alias "Tylerb" at position 65 out of 100 hackers, while Urban's moniker "Sosa" held the 24th position.
Buchanan's sentencing hearing is scheduled for August 21, 2026. The Department of Justice reports he faces a statutory maximum sentence of 22 years in federal prison. However, the final sentence may be influenced by various mitigating factors outlined in the U.S. Sentencing Guidelines, including the defendant's age, criminal history, time served in U.S. custody, and level of cooperation with federal authorities.
Share this story