Scottish SIM swapper pleads guilty to $8M crypto theft in US court

A Scottish man has become the second member of the notorious Scattered Spider cybercrime group to plead guilty in US federal court, admitting his role in a sophisticated phishing and SIM-swapping operation that stole at least $8 million in cryptocurrency from victims across the United States.

Tyler Robert Buchanan, 24, pleaded guilty in California to one count of conspiracy to commit wire fraud and one count of aggravated identity theft. The charges carry a statutory maximum prison sentence of 22 years. Buchanan, originally from Dundee, was arrested at Palma airport in June 2024 and has been held in US custody since April 2025.

The case marks a significant development in the ongoing US crackdown on Scattered Spider, a cybercrime collective that has gained international notoriety for its sophisticated social engineering attacks targeting major corporations and high-net-worth individuals.

The Cybercrime Operation

According to court documents, Buchanan was part of a criminal group that operated between September 2021 and April 2023, defrauding at least a dozen US companies, their employees, and numerous individual victims. While the Department of Justice did not explicitly name the group as Scattered Spider, multiple reports confirm Buchanan's membership during this period.

Buchanan operated under multiple aliases including "Dread Pirate Roberts," "Evefan," and "tylerb." His guilty plea encompasses his involvement in thefts totaling at least $8 million in virtual currency, with the broader criminal enterprise accused of stealing at least $11 million through various cybercrimes during the 18-month period.

How the Scheme Worked

The group's methodology combined several sophisticated techniques:

• Phishing campaigns: Victims received deceptive messages warning about expiring VPNs or directing them to fake websites where credentials were harvested
• SIM swapping: Attackers gained control of victims' mobile phone numbers to bypass two-factor authentication
• Infrastructure development: Buchanan and co-conspirators created and managed domain names and copycat websites to support phishing attacks
• Account compromise: Stolen corporate data was used to identify and access individual victims' cryptocurrency wallets

"Buchanan further admitted that he and several co-conspirators used the information stolen from company intrusions to identify and gain access to virtual currency accounts and wallets belonging to individual victims to steal millions of dollars' worth of virtual currency," the Department of Justice stated in its announcement.

Evidence and Investigation

During a search of Buchanan's residence in Scotland in April 2023, investigators discovered:

• Names and addresses of individuals
• A text file containing wallet seed phrases
• Login details for one victim's account

The investigation revealed that Buchanan and his co-conspirators conducted SIM swaps of victims' mobile telephone numbers to devices they controlled, allowing them to bypass security measures and access cryptocurrency wallets.

Connection to Scattered Spider

While Buchanan's activities occurred before some of Scattered Spider's most high-profile attacks, his guilty plea provides additional evidence of the group's extensive operations. Scattered Spider has been linked to major cyberattacks including:

• The MGM Resorts and Caesars Entertainment ransomware attacks in Las Vegas during 2023
• Transport for London security breaches
• Multiple UK retail attacks in summer 2025

Noah Michael Urban, described as a Scattered Spider leader, was the first member to plead guilty in the US. He received a 10-year prison sentence in August 2025. Three other senior figures—Ahmed Hossam Eldin Elbadawy (24), Evans Onyeaka Osiebo (21), and Joel Martin Evans (26)—still face criminal charges.

Sentencing and Impact

Buchanan is scheduled to be sentenced on August 21, 2026. The case highlights the growing threat of cryptocurrency-related cybercrime and the international nature of modern cybercriminal operations.

The guilty plea represents a significant victory for US law enforcement in their efforts to dismantle Scattered Spider, which has been described by cybersecurity experts as one of the most sophisticated and prolific cybercrime groups operating today. The group's ability to combine social engineering, technical expertise, and international coordination has made them particularly challenging to combat.

The case also underscores the vulnerabilities in cryptocurrency security systems, particularly the risks associated with SIM-based authentication and the importance of robust security measures for digital asset holders.