Scattered Spider teen hops the pond in cuffs, faces $8M crypto ransom rap in Chicago 🕷️

Peter Stokes, a 19-year-old dual U.S. and Estonian citizen and alleged member of the Scattered Spider hacking collective, was extradited from Finland and appeared Tuesday in federal court in Chicago to face conspiracy, cyber intrusion, and fraud charges tied to an $8 million cryptocurrency ransom demand. Finnish authorities arrested Stokes in April on an Interpol Red Notice; he was extradited last week and ordered held pending trial, the Justice Department said.

According to the DOJ complaint, Stokes and alleged accomplices breached an unnamed luxury jewelry retailer in May 2025 by posing as employees to reset two-factor authentication credentials through the company's IT help desk. The group then exfiltrated data and demanded roughly $8 million in crypto. The retailer's security team evicted the intruders, and no ransom was paid, though the company lost at least $2 million to disruption, investigation, and remediation.

Scattered Spider, tracked by investigators also as Octo Tempest, UNC3944, and 0ktapus, has executed more than 100 intrusions and collected over $100 million in ransoms, prosecutors said. The group relies on voice-based social engineering rather than malware, calling help desks to impersonate staff before encrypting systems or stealing data and demanding cryptocurrency. The same tactics powered 2023 attacks on MGM Resorts and Caesars Entertainment, the latter of which paid a roughly $15 million ransom, and intrusions reported against Crypto.com. "Scattered Spider has repeatedly targeted U.S. companies, extorting employees, inflicting millions of dollars in losses, and disrupting essential operations," FBI Cyber Division Assistant Director Brett Leatherman said.

Stokes joins other alleged members now in U.S. custody. Alleged ringleader Tyler Buchanan, a 24-year-old Scot, pleaded guilty in April to a phishing spree that stole at least $8 million in crypto, while Florida's Noah Urban was sentenced to 10 years after reporting tied him to breaches including the Crypto.com intrusion. The DOJ charged five alleged members in a separate 2024 crypto-phishing case, and this week's extradition was coordinated by the DOJ's Office of International Affairs and Finland's National Bureau of Investigation under the FBI's Operation Riptide, a campaign officials said has yielded more than 180 cyber-criminal convictions and over $350 million in returned victim funds since 2020.

Broader data point to a shifting ransomware economy. Victims reported about $850 million in crypto extorted in 2025, roughly flat year-on-year, even as leak-site postings rose 44%, according to TRM Labs. Chainalysis recorded a second straight annual decline in on-chain ransomware payments for 2025, while the FBI noted Americans reported more than $20 billion in cybercrime losses last year, a 26% single-year increase.