Scattered Spider teen lands in Chicago court over $8M crypto ransom demand 🕷️

An alleged member of the Scattered Spider hacking collective has been extradited from Finland to face U.S. charges tied to an $8 million cryptocurrency ransom demand, the Justice Department said. Peter Stokes, 19, a dual U.S. and Estonian citizen, appeared Tuesday in Chicago federal court on conspiracy, cyber intrusion, and fraud charges. Finnish police arrested him in April on an Interpol Red Notice, and he was ordered held pending trial following his extradition last week.

The complaint stems from a May 2025 breach of an unnamed luxury jewelry retailer. Prosecutors allege Stokes and accomplices used social engineering to convince the company's IT help desk to reset employee two-factor authentication credentials, then stole data and demanded roughly $8 million in crypto. Security staff evicted the intruders and no ransom was paid, though the retailer suffered at least $2 million in disruption and remediation costs.

Scattered Spider, also tracked as Octo Tempest, UNC3944, and 0ktapus, is a loose collective that prosecutors say has carried out more than 100 intrusions and collected over $100 million in ransoms. The group's hallmark is phone-based social engineering rather than malware, with members posing as employees to obtain credentials before extorting cryptocurrency to suppress or unlock stolen data. The tactics powered 2023's breaches of MGM Resorts and Caesars Entertainment, with Caesars reportedly paying approximately $15 million, and have since been linked to a previously unreported intrusion at Crypto.com that blockchain security firm Slowmist CISO Shān Zhang described as "a small, internally controllable issue" that "was properly resolved a long time ago."

Stokes joins several alleged members now facing U.S. proceedings. Alleged ringleader Tyler Buchanan, a 24-year-old Scot, pleaded guilty in April to a phishing spree that stole at least $8 million in crypto, and Florida's Noah Urban was sentenced to 10 years after reporting tied him to breaches including Crypto.com. The DOJ charged five alleged members in a separate 2024 crypto-phishing case.

The jeweler's refusal to pay aligns with a broader shift in victim response to crypto ransom demands. Ransomware crews extorted about $850 million in crypto in 2025, roughly flat year-over-year, even as victim postings on leak sites jumped 44%, according to TRM Labs, which reported that total ransomware-linked volume fell even as the threat landscape expanded due to lower barriers to entry for criminals.