In a nutshell: A leading hacker from the Scattered Spider group admitted to conducting extensive SMS phishing attacks and SIM swaps that stole at least 8 million dollars from cryptocurrency investors.
Tyler Robert Buchanan, a senior member of the cybercrime group Scattered Spider, has pleaded guilty to conducting SMS phishing attacks that compromised dozens of technology companies and stole millions of dollars in cryptocurrency from investors. The British national is currently detained in the United States and faces a potential prison sentence of over 200 years.
Tyler Robert Buchanan, known by the nickname “Tylerb,” from Dundee in Scotland, pleaded guilty to conspiracy to commit wire fraud and aggravated identity theft. The U.S. Department of Justice states that Buchanan stole at least 8 million dollars in virtual currencies from individual victims in the United States.
Buchanan was a primary perpetrator of SMS phishing campaigns in 2022. As part of his guilty plea, he admitted to sending tens of thousands of SMS phishing messages in collaboration with other Scattered Spider members. These attacks compromised several technology firms, including Twilio, LastPass, DoorDash, and Mailchimp. The stolen credentials were subsequently exploited for so-called SIM-swap attacks against cryptocurrency investors. In a SIM swap, attackers redirect the victim’s phone number to a device under their control, enabling them to bypass SMS passcodes and two-factor authentication.
The FBI identified Buchanan through technical traces: the same username and email address used to register the phishing domains could be traced back to a British data center. The domain registrar NameCheap determined that this account was accessed from a UK IP address less than one month before the campaign began. Scottish police authorities confirmed to the FBI that this address was rented by Buchanan throughout 2022.
Buchanan fled the United Kingdom in February 2023 after being threatened by a rival cybercrime group. He was arrested by Spanish authorities in June 2024 when attempting to board a flight to Italy. Sentencing is pending.
Source: ainews-dev.lumi-systems.io · Published 17 May 2026
Lumi AI News — AI-assisted curation in accordance with Article 50 EU AI Act. Paraphrasing and classification by Lumi News Pipeline v1.5.2.