Tyler Buchanan, a 24-year-old from Dundee, Scotland, faces up to 22 years in prison after pleading guilty to conspiracy to commit wire fraud and aggravated identity theft. He admitted attempting to steal at least £5.9 million in virtual currency from victims across the United States.
The Phishing Scheme
US officials reveal that Buchanan and his accomplices used text message phishing, known as smishing, to deceive company employees into revealing login credentials. They sent hundreds of fraudulent messages posing as companies or suppliers, targeting telecommunications firms, IT providers, cloud services, cryptocurrency businesses, and individuals from September 2021 to April 2023.
A device seized from Buchanan’s home contained victim names, addresses, cryptocurrency seed phrases, and login details for one account. The group developed a phishing kit that captured credentials from fake websites and relayed them to a Telegram channel managed by Buchanan and a co-conspirator. Officials state: ‘The conspirators created a phishing kit that captured login credentials entered into the fraudulent phishing websites by a victim company’s employees.’
Links to Major Cyber Attacks
Buchanan connects to the notorious Scattered Spider hacking group, comprised mainly of young British and American individuals, responsible for crippling attacks on UK supermarkets M&S and Co-op in spring and summer 2025. These incidents emptied shelves for weeks and halted M&S online orders and payments.
The National Crime Agency identified Scattered Spider as a primary focus in May 2025. The group typically demands large ransoms after breaching systems.
Prosecutors also tie Buchanan to 2023 hacks on Las Vegas casino operators Caesars Entertainment and MGM Resorts International, involving a £9 million cryptocurrency fraud through similar phishing tactics.
Arrest and Co-Conspirators
Authorities arrested Buchanan in Spain last year en route to Italy. He has remained in US federal custody since April 2025, with sentencing set for August 21.
Co-conspirator Noah Michael Urban pleaded guilty in April 2025 to three fraud charges, receiving a 10-year sentence and ordered to pay £5.9 million in restitution. Three other US-based defendants face ongoing charges. Police Scotland assisted the FBI in the investigation.
