Do Son 
Twenty-three-year-old Scottish national Tyler Robert Buchanan, suspected of involvement in the hacker collective known as Scattered Spider, has been extradited from Spain to the United States, where he faces charges of fraud, identity theft, and conspiracy to unlawfully access protected information. He was apprehended in June 2024 at Palma de Mallorca Airport while preparing to board a flight to Italy. His extradition to U.S. authorities was completed in April 2025, as first reported by Bloomberg.
According to the investigation, Buchanan—allegedly known online by the alias “tylerb”—participated in an extensive campaign of SMS phishing and SIM-swapping attacks alongside co-conspirators. These attacks targeted employees of numerous companies, including Twilio, LastPass, DoorDash, and Mailchimp. The attackers created fake websites mimicking Okta’s authentication interface to harvest login credentials, which were then used to infiltrate corporate systems. This campaign was code-named “0ktapus.”
An FBI investigation revealed that the attackers registered several domains via NameCheap less than a month before launching the attacks. The account used to register the domains accessed the internet through an IP address leased by Buchanan in Scotland between January 26 and November 7, 2022. The domains were registered under the same email address and username linked to Buchanan.
A search of Buchanan’s residence led to the seizure of 20 digital devices. One of them contained login credentials for three companies targeted in the phishing campaign. Investigators also discovered a screenshot of a Telegram conversation discussing how to divide proceeds obtained through SIM-swapping attacks—a method that allowed hackers to intercept one-time passcodes by transferring victims’ phone numbers to new SIM cards.
Buchanan was further connected to activity on Discord. The same British IP address had been used to manage a Discord account associated with a cryptocurrency wallet. Public blockchain data shows that approximately 391 bitcoins—valued at more than \$26 million at the time of the investigation—passed through that wallet.
Law enforcement was not the only party interested in Buchanan. In February 2023, a rival criminal group sent individuals to his residence, where they broke in and threatened to burn him with a blowtorch unless he surrendered access to his cryptocurrency wallet. Following the attack, Buchanan fled the United Kingdom and attempted to remain hidden in Europe.
In November 2024, the Los Angeles County District Attorney’s Office charged four additional alleged members of Scattered Spider: Ahmed Elbadawi (23, College Station, Texas), Joel Evans (25, Jacksonville, North Carolina), Evans Osiebo (20, Dallas), and Noah Urban (20, Palm Coast, Florida). A separate report detailed the arrest of a 17-year-old from the United Kingdom in connection with the hacking of MGM Resorts in Las Vegas, an incident also attributed to the group, though Buchanan was not named in that episode.
According to filings from the U.S. District Court for the Central District of California, Buchanan remains in custody without the possibility of bail. He is charged with conspiracy to commit fraud, unauthorized access to information systems for personal financial gain, and aggravated identity theft—the latter carrying a mandatory minimum sentence of two years in prison. A preliminary hearing is scheduled for May 6.
