"[Buchanan] was the glue that held this gang together. His success at wiping out victims’ savings made him a target for both law enforcement and rival Com gangs,” Allison Nixon, chief research officer at Unit 221B, told CyberScoop.
The plea: charges and potential penalty
Tyler Robert Buchanan, a 24‑year‑old British national from Dundee, Scotland, pleaded guilty to federal charges of conspiracy to commit wire fraud and aggravated identity theft, the Justice Department said. Buchanan was arrested by Spanish police in Palma in 2024 as he attempted to board a charter flight to Naples, Italy. He has been in federal custody since April 2025 and faces up to 22 years in federal prison at his scheduled sentencing on August 21.
The operational reach: phishing, SIM‑swap thefts and measured losses
Federal officials and the plea agreement say Buchanan and his co‑conspirators harvested thousands of credentials via phishing and used SIM‑swapping attacks to steal more than $8 million in cryptocurrency from U.S. residents between September 2021 and April 2023. Victims included high net worth individuals and businesses spanning the entertainment, telecom, technology, business process outsourcing, IT, cloud and virtual currency sectors, according to prosecutors.
Buchanan’s role inside Scattered Spider and The Com
Buchanan and several others were part of a highly aggressive subset of a broader cybercrime collective known as The Com, the subgroup dubbed Scattered Spider. While The Com and its offshoots “don’t operate with formal leaders in the traditional sense,” Nixon told CyberScoop that Buchanan nevertheless played a crucial coordinating role within Scattered Spider. Nixon also described Buchanan as part of “an older generation that came from certain toxic gaming servers before the pandemic,” saying that members from that generation “learned hacking in order to steal vanity usernames and bully kids before using it to steal peoples’ savings.”
Spanish police reported that, at the time of his arrest, Buchanan had gained control of bitcoin worth more than $27 million. A digital device seized by police at his residence in April 2023 contained personal data on numerous individuals and victim companies, the plea agreement states. The plea agreement does not encompass the entirety of the alleged criminal conduct, according to the Justice Department.
Co‑defendants, rival gangs, and violent intrusions
Federal authorities filed charges in 2024 against five individuals linked to Scattered Spider. One co‑conspirator named in coverage, Noah Michael Urban, was sentenced last year to a 10‑year federal prison term. Other alleged co‑conspirators — Ahmed Hossam Eldin Elbadawy, Evans Onyeaka Osiebo and Joel Martin Evans — still face charges. Nixon said Buchanan’s prominence and the value of cryptocurrency he controlled made him a target not only for law enforcement but for rival Com gangs; she told CyberScoop that a rival gang allegedly broke into his home and used a blowtorch on him to extract crypto keys.
How technologists, policymakers, and victims will respond
- Technologists and security teams — Expect renewed emphasis on credential protection and anti‑SIM‑swap controls. The case highlights phishing and SIM‑swap as high‑impact, dual‑tool attack chains that resulted in seven‑figure losses to individual accounts and enterprises in multiple sectors.
- Policymakers and law enforcement — Nixon praised the tactic of arresting foreign suspects while they travel, calling it decisive: “Com members are obsessed with private jets and foreign vacations, and the feds took that dream away with one arrest.” She added that arresting foreign nationals abroad places them in a legally weaker position than being arrested at home and that similar tactics have been used against other transnational cybercriminals.
- Victims and affected enterprises — The plea confirms at least a dozen U.S. companies and their employees were defrauded. Organizations in affected sectors should anticipate ongoing investigations and the possibility that additional co‑defendants will be prosecuted.
The Com, the broader network from which Scattered Spider emerged, has grown to thousands of members — typically aged between 11 and 25 — and splintered into three primary subsets the FBI describes as Hacker Com, In Real Life Com and Extortion Com. Criminal activity attributed to these interconnected networks ranges from swatting and extortion to the production and distribution of child sexual abuse material and violent crime, prosecutors and researchers say.
It remains unclear what occurred between the April 2023 search of Buchanan’s residence in Scotland and his June 2024 arrest in Mallorca; the plea agreement and public filings leave that interval unspecified. For now, Buchanan’s guilty plea closes one chapter in the U.S. prosecution of Scattered Spider’s early operators while several alleged co‑conspirators continue to face charges and investigators follow leads tied to millions in stolen cryptocurrency.
