British Man Tyler Buchanan Pleads Guilty to Hacking 12 Companies, Stealing $8m in Virtual Currency

A British man has pleaded guilty to conspiring to hack the computers of at least a dozen companies and to steal at least $8m (£5.9m) in virtual currency from people in the US. The US Department of Justice (DOJ) said 24-year-old Tyler Buchanan, from Dundee, and his co-conspirators defrauded companies and their employees through SMS phishing attacks. These are messages sent to mobile phones luring people to websites that prompt them to provide confidential personal details, including account names and passwords. Buchanan, who has been in US federal custody since April 2025, is scheduled for sentencing on 21 August, when he will face a maximum sentence of 22 years in prison. Between September 2021 and April 2023, Buchanan and others planned cyber attacks on entertainment, telecommunications, technology, and virtual currency companies, according to the DOJ. The group sent hundreds of phishing messages to employees of those organisation, then used their stolen credentials to access accounts and steal confidential company information. Buchanan admitted in his plea agreement that he and several co-conspirators used the stolen information to steal millions of dollars' worth of virtual currency. A digital device found at Buchanan's home in Scotland showed he possessed the names and addresses of numerous people, including a file that contained cryptocurrency seed phrases and login information for one victim's account. In total, the scheme involved the theft of at least $8m worth of virtual currency assets from individuals throughout the US, the DOJ said. Buchanan pleaded guilty to one count of conspiracy to commit wire fraud and one count of aggravated identity theft. In November 2023, Buchanan was charged by the US along with four American men and boys in their twenties and teens for alleged activity linked to the notorious cyber-criminal collective Scattered Spider. The DOJ named 21-year-old Noah Michael Urban, who pleaded guilty in April 2025 to three fraud-related counts, as a co-conspirator.