Scottish Hacker Pleads Guilty to Leading Scattered Spider Cybercrime Ring Linked to $8M Crypto Thefts

Tyler Robert Buchanan, a 24-year-old from Dundee, Scotland, pleaded guilty to federal charges on Friday, admitting his leadership role in the cybercrime subset Scattered Spider, which operated under the larger hacking collective The Com.

Buchanan was charged with conspiracy to commit wire fraud and aggravated identity theft, the U.S. Justice Department announced. He was arrested by Spanish police in Palma in 2024 while attempting to board a charter flight to Naples, Italy, and has remained in federal custody since April 2025.

Cybercrime Spree and Financial Impact

From September 2021 to April 2023, Buchanan and his co-conspirators executed a series of high-profile phishing attacks and SIM-swapping schemes, stealing over $8 million in cryptocurrency from U.S. residents. Their victims included:

• High net worth individuals
• Businesses in the entertainment, telecom, technology, business process outsourcing, IT, cloud, and virtual currency sectors

The group harvested thousands of credentials via phishing, enabling them to access and drain victims’ digital assets.

Co-Conspirators and Legal Consequences

Buchanan’s alleged co-conspirators—Noah Michael Urban, Ahmed Hossam Eldin Elbadawy, Evans Onyeaka Osiebo, and Joel Martin Evans—also face charges. Urban was sentenced to a 10-year federal prison term in 2024. Federal authorities filed charges against five individuals linked to Scattered Spider in 2024.

Expert Insights on Scattered Spider’s Operations

“[Buchanan] was the glue that held this gang together. His success at wiping out victims’ savings made him a target for both law enforcement and rival Com gangs.”

— Allison Nixon, Chief Research Officer at Unit 221B

Nixon noted that Buchanan represents an older generation of hackers who initially exploited gaming servers before transitioning to financial cybercrime:

“People from this generation learned hacking in order to steal vanity usernames and bully kids before using it to steal peoples’ savings.”

Law Enforcement Tactics and Future Implications

Nixon praised law enforcement for capitalizing on Buchanan’s international travel to secure his arrest, a strategy also used against Russian cybercriminals:

“Com members are obsessed with private jets and foreign vacations, and the feds took that dream away with one arrest.”

She emphasized the legal vulnerabilities faced by foreign cybercriminals:

“As a foreigner, he was caught in a weaker legal position than if he was arrested at home, and cases following this tactic tend to have very long sentences.”

Nixon added a warning to Scattered Spider members:

“The takeaway for Com members watching this case is that criminal foreigners associated with violence are the lowest class in every country. And that’s what Com members are when they travel.”

The Justice Department confirmed that Buchanan and his co-conspirators defrauded at least a dozen U.S. companies and their employees. Investigators recovered digital evidence at the time of his arrest.