Tyler Robert Buchanan, 24, a senior member of the cybercrime group Scattered Spider known online as “Tylerb,” pleaded guilty in the U.S. to wire fraud conspiracy and aggravated identity theft after admitting his role in 2022 SMS‑phishing attacks that helped siphon at least $8 million in virtual currency from investors, the Justice Department says 1.

Buchanan — once listed on an English‑language hacking leaderboard — is now in U.S. custody and faces more than 20 years in prison. Two photos published by the Daily Mail show him as a child and later detained by airport authorities in Spain 1.

Scattered Spider is a prolific English‑speaking criminal group that uses social engineering — impersonating employees or contractors to trick IT help desks — to break into companies and steal data for ransom or fraud. U.K. retailer Marks & Spencer was among organisations linked to the group’s activity last year 1.

As part of his plea, Buchanan admitted conspiring with other members to send tens of thousands of SMS‑phishing messages in 2022 that led to intrusions at companies including Twilio, LastPass, DoorDash and Mailchimp. Stolen account data from those breaches was later used in SIM‑swapping attacks against individual cryptocurrency investors 1.

The Justice Department says Buchanan admitted to stealing at least $8 million in virtual currency from U.S. victims. In a SIM‑swap, attackers move a victim’s mobile number to a device they control and intercept one‑time passcodes and password reset texts to seize accounts and crypto wallets 1.

FBI agents tied Buchanan to the 2022 campaign after finding the same username and email used to register multiple phishing domains. NameCheap records showed the account registering those domains logged in from a U.K. IP less than a month before the attacks; Scottish police said that IP was leased to Buchanan throughout 2022 1.

KrebsOnSecurity previously reported that Buchanan fled the U.K. in February 2023 after a rival gang allegedly attacked his home and family

How this was made. This article was assembled by Startupniti's editorial AI from the source listed in the right rail. The synthesis ran through our 4-model cascade (Gemini Flash Lite → GPT-4o-mini → DeepSeek → Llama 3.3 70B), logged to ops.llm_calls. Every fact traces to a citation. If a fact looks wrong, write to corrections.