Tyler Robert Buchanan, a 24-year-old British national, pleaded guilty to wire fraud conspiracy and aggravated identity theft. He admitted his role in a series of 2022 text-message phishing attacks. These attacks allowed the cybercrime group "Scattered Spider" to hack at least a dozen major technology companies and steal tens of millions in cryptocurrency.
Buchanan's hacker handle, "Tylerb," once appeared on a leaderboard tracking accomplished cyber thieves in the English-language criminal hacking scene. Now in U.S. custody, the Dundee, Scotland native faces over 20 years in prison. A Daily Mail story from May 3, 2025, published photos of Buchanan as a child and as an adult being detained by airport authorities in Spain.
Scattered Spider is a prolific English-speaking cybercrime group. They use social engineering to break into companies, often impersonating employees or contractors. This deception tricks IT help desks into granting access, allowing them to steal data for ransom.
Buchanan admitted to conspiring with other Scattered Spider members. In 2022, they launched tens of thousands of SMS-based phishing attacks. These led to intrusions at several technology companies, including Twilio, LastPass, DoorDash, and Mailchimp. The group then used stolen data for SIM-swapping attacks, siphoning funds from individual cryptocurrency investors.
An unauthorized SIM-swap transfers a target's phone number to a device controlled by the attackers. They intercept text messages and phone calls, including one-time passcodes and password reset links. The U.S. Justice Department states Buchanan admitted stealing at least $8 million in virtual currency from victims across the United States.
FBI investigators linked Buchanan to the 2022 SMS phishing attacks. They found the same username and email address used to register numerous phishing domains in the campaign. Less than a month before the phishing spree, the domain registrar NameCheap showed the account logged in from a UK Internet address. Scottish police told investigators this address was leased to Buchanan throughout 2022.
Buchanan fled the United Kingdom in February 2023. A rival cybercrime gang had hired thugs to invade his home, assault his mother, and threaten him with a blowtorch for his cryptocurrency wallet keys. That same year, UK investigators found a device at Buchanan's Scotland residence. It contained data stolen from SMS phishing victims and seed phrases from cryptocurrency theft victims.
Spanish authorities arrested Buchanan in June 2024 as he tried to board a flight to Italy. He was extradited to the United States and has remained in U.S. federal custody since April 2025.
Buchanan is the second known Scattered Spider member to plead guilty. Noah Michael Urban, 21, of Palm Coast, Florida, received a 10-year federal prison sentence last year. He was also ordered to pay $13 million in restitution.
Three other alleged co-conspirators still face criminal charges. These include Ahmed Hossam Eldin Elbadawy, 24, from College Station, Texas; Evans Onyeaka Osiebo, 21, from Dallas, Texas; and Joel Martin Evans, 26, from Jacksonville, North Carolina.
Two other alleged Scattered Spider members will soon face trial in the United Kingdom. Owen Flowers, 18, and Thalha Jubair, 20, face charges related to hacking and extortion. Their targets included several large UK retailers, the London transit system, and US healthcare providers. Both have pleaded not guilty. Their trial is set to begin in June.
Investigators say the Scattered Spider suspects belong to "The Com," a sprawling online cybercriminal community. Hackers from different cliques boast publicly on Telegram and Discord about high-profile cyber thefts. These thefts almost always begin with social engineering. They trick people via phone, email, or SMS into giving away credentials for remote access to corporate networks.
A popular SIM-swapping channel on Telegram maintains a leaderboard of the most rapacious SIM-swappers. It indexes their conquests in stealing cryptocurrency. Buchanan's alias, "Tylerb," previously ranked #65. Urban's moniker, "Sosa," was #24.
Buchanan's sentencing hearing is scheduled for August 21, 2026. The Justice Department states he faces a statutory maximum sentence of 22 years in federal prison.