Suspected Scattered Spider Hacker Extradited to U.S. in $8M Crypto Ransom Case
Federal prosecutors have their hands on another alleged member of Scattered Spider, one of the most notorious hacking crews of the past few years, after his extradition from Finland to face charges over an $8 million crypto ransom demand.
Peter Stokes, 19, holding dual U.S. and Estonian citizenship, appeared before a Chicago federal court this week on charges of conspiracy, cyber intrusion, and fraud. Finnish authorities picked him up in April on an Interpol Red Notice, and he was handed over to U.S. custody last week, where he’s now being held pending trial.
At the center of the case is a May 2025 breach targeting an unnamed luxury jewelry retailer. According to the indictment, Stokes and his alleged accomplices used social engineering tactics, talking their way past the company’s IT help desk to reset employee two-factor authentication credentials. From there, they allegedly stole sensitive data and issued the crypto ransom demand. Security teams caught on and evicted the intruders before any payment was made, though the retailer reportedly still absorbed at least $2 million in cleanup and disruption costs.
This latest arrest highlights just how far the Scattered Spider crypto ransom campaign has spread. Also known by aliases like Octo Tempest, UNC3944, and 0ktapus, the group is a loosely organized hacking collective that prosecutors say has carried out over 100 intrusions worldwide, collectively demanding more than $100 million in crypto ransoms. Unlike traditional malware-driven attacks, Scattered Spider relies heavily on social engineering, phone calls, impersonation, and help-desk manipulation, to gain access before extorting victims.
The group’s fingerprints are on some of the industry’s biggest incidents, including the 2023 attacks on MGM Resorts and Caesars Entertainment, the latter of which reportedly paid out close to $15 million to resolve the breach.
Stokes now joins a growing roster of Scattered Spider suspects facing U.S. justice. Alleged ringleader Tyler Buchanan, a 24-year-old from Scotland, pleaded guilty in April to a phishing operation that siphoned off at least $8 million in crypto. Meanwhile, Florida-based hacker Noah Urban was sentenced to 10 years in prison after being connected to several breaches, including one at crypto exchange Crypto.com. Back in 2024, the DOJ separately charged five alleged members in a related crypto-phishing case.
The jeweler’s decision not to pay reflects a broader trend across the ransomware landscape. According to TRM Labs, ransomware gangs extorted roughly $850 million in crypto throughout 2025, flat compared to the year before, even as leak-site victim postings surged by 44%. Total ransomware-linked volume actually dropped to about $1.3 billion from $1.9 billion in 2024, as more organizations refuse to give in to attacker demands.
