Scattered Spider member Tyler Buchanan pleads guilty to major crypto theft


Scattered Spider member Tyler Buchanan pleads guilty to major crypto theft

Pierluigi Paganini
April 20, 2026

Tyler Buchanan, linked to Scattered Spider, pleaded guilty in the US to hacking companies and stealing millions in cryptocurrency.

Tyler Buchanan, a 24-year-old from Scotland linked to the Scattered Spider group, admitted in a US court that he hacked dozens of companies, committed fraud, and stole millions in cryptocurrency. Spanish police arrested the British national who was suspected of being a key member of the cybercrime group Scattered Spider (also known as UNC39440ktapus). The man was arrested in Palma de Mallorca while attempting to fly to Italy. During the arrest, police confiscated a laptop and a mobile phone. The arrest resulted from a joint operation conducted by the U.S. Federal Bureau of Investigation (FBI) and the Spanish Police.

Spanish police tracked the suspect to Mallorca after he entered Spain via Barcelona in late May 2024.

“A United Kingdom man pleaded guilty today to conspiring with others to hack into the computer systems of at least a dozen companies via text message phishing attacks and to steal at least $8 million in virtual currency from individual victims throughout the United States.” reads the press release published by DoJ. “Tyler Robert Buchanan, 24, of Dundee, Scotland, pleaded guilty to one count of conspiracy to commit wire fraud and one count of aggravated identity theft. “

Buchanan has stayed in U.S. custody since April 2025. Between 2021 and 2023, he and his group targeted companies and individuals across several sectors. They sent large SMS phishing campaigns that mimicked trusted services and tricked employees into sharing credentials and personal data. Using this access, they broke into corporate systems and stole sensitive information, including intellectual property and user data.

“The conspirators created a phishing kit that captured login credentials entered into the fraudulent phishing websites by a victim company’s employees.” continues the press release. “The stolen credentials were then transmitted to an online Telegram channel administered by Buchanan and another co-conspirator.”

Buchanan admitted he kept files linked to many victim companies at his home in Scotland. He and his accomplices used stolen data from corporate breaches to target individuals and access their cryptocurrency accounts and wallets, stealing millions. To do this, they broke into online accounts and carried out SIM swap attacks, taking control of victims’ phone numbers and intercepting two-factor authentication codes sent via SMS or calls. This let them bypass security protections and fully access accounts. Investigators also found sensitive data on his devices, including names, addresses, login credentials, and even cryptocurrency seed phrases tied to victims’ wallets, showing how the group combined corporate intrusions and personal targeting to maximize profits.

“Buchanan admitted in his plea agreement that the scheme involved the theft of at least $8 million worth of virtual currency assets from individual victims located throughout the United States.” concludes the press release. “United States District Judge John W. Holcomb scheduled an August 21 sentencing hearing, at which time Buchanan will face a statutory maximum sentence of 22 years in federal prison.”

Noah Michael Urban, also known as “Sosa” and “Elijah,” received a 10-year prison sentence and must pay $13 million in restitution after pleading guilty to fraud charges. Meanwhile, Ahmed Hossam Eldin Elbadawy, Evans Onyeaka Osiebo, and Joel Martin Evans have been charged in the same case and still face ongoing legal proceedings.

The cybercrime group Scattered Spider is suspected of hacking into hundreds of organizations over the past two years, including TwilioLastPassDoorDash, and Mailchimp.

Scattered Spider members are part of a broader cybercriminal community called “The Com,” where hackers brag about high-profile cyber thefts, typically initiated through social engineering tactics like phone, email, or SMS scams to gain access to corporate networks.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, cybercrime)







Source link

Leave a Reply

Subscribe to Our Newsletter

Get our latest articles delivered straight to your inbox. No spam, we promise.

Recent Reviews


Vibe coding has taken the development world by storm—and it truly is a modern marvel to behold. The problem is, the vibe coding rush is going to leave a lot of apps broken in its wake once people move on to the next craze. At the end of the day, many of us are going to be left with apps that are broken with no fixes in sight.

A lot of vibe “coders” are really just prompt typers

And they’ve never touched a line of code

An AI robot using a computer with a prompt field on the screen. Credit: Lucas Gouveia / How-To Geek

Vibe coding made development available to the masses like never before. You can simply take an AI tool, type a prompt into a text box, and out pops an app. It probably needs some refinement, but, typically, version one is still functional whenever you’re vibe coding.

The problem comes from “developers” who have never written a line of code. They’re just using vibe coding because it’s cool or they think they can make a quick buck, but they really have no knowledge of development—or any desire to learn proper development.

Think of those types of vibe coders as people who realize they can use a calculator and online tools to solve math problems for them, so they try to build a rocket. They might be able to make something work in some way, but they’ll never reach the moon, even though they think they can.

Anyone can vibe code a prototype

But you really need to know what you’re doing to build for the long haul

For those who don’t know what they’re doing, vibe coding is a fantastic way to build a prototype. I’ve vibe coded several projects so far, and out of everything I’ve done, I’ve realized one thing—vibe coding is only as good as the person behind the keyboard. I have spent more time debugging the fruits of my vibe coding than I have actually vibe coding.

Each project that I’ve built with vibe coding could have easily been “viable” within an hour or two, sometimes even less time than that. But, to make something of actual quality, it has always taken many, many hours.

Vibe coding is definitely faster than traditional coding if you’re a one-man team, but it’s not something that is fast by any means if you’re after a quality product. The same goes for continued updates.

I’ve spent the better part of three months building a weather app for iPhone. It’s a simple app, but it also has quite a lot of complex things going on in the background.

It recently got released in the App Store—no small feat at all. But, I still get a few crash reports a week, and I’m constantly squashing bugs and working on new features for the app. This is because I’m planning on supporting the app for a long time, not just the weekend I released it, and that takes a lot more work.

Vibe coders often jump from app to app without thinking of longevity

The app was a weekend project, after all

A relaxed man lounging on an orange beanbag watches as a friendly yellow robot works on a laptop for him, while multiple red exclamation-mark warning icons float around them. Credit: Lucas Gouveia/How-To Geek | ViDI Studio/Shutterstock

I’ve seen it far too often, a vibe coder touting that they built this “complex app” in 48 hours, as if that is something to be celebrated. Sure, it’s cool that a working version of an app was up and running in two days, but how well does it work? How many bugs are still in it? Are there race conditions that cause a random crash?

My weather app has a weird race condition right now I’m tracking down. It crashes, on occasion, when opened from Spotlight on an iPhone. Not every time does that cause a crash, just sometimes.

If a vibe coder’s only goal is to build apps in short amounts of time so they can brag about how fast they built the app, they likely aren’t going to take the time to fix little things like that.

I don’t vibe code my apps that way, and I know many other vibe coders that aren’t that way—but we all started with actual coding, not typing a prompt.


Anyone can be a vibe coder, but not all vibe coders are developers

“And when everyone’s super… no one will be.” – Syndrome, The Incredibles. It might be from a kids’ movie, but it rings true in the era of vibe coding. When everyone thinks they can build an app in a weekend, everyone thinks they’re a developer.

By contrast, not every vibe coder is actually a developer, and that’s the problem. It’s hard to know if the app you’re using was built by someone who has plans to support the app long-term or not—and that’s why there’s going to be a lot of broken apps in the future.

I can see it now, the apps that people built in a weekend as a challenge will simply go without updates. While the app might work for the first few weeks or months just fine, an API update comes along and breaks the app’s compatibility. It’s at that point we’ll see who was vibe coding to build an app versus who was vibe coding just for online clout—and the sad part is, consumers will lose out more often than not with broken apps.



Source link