Scattered Spider Suspect Extradited to US Over $8M Crypto Ransom Demand – Decrypt

An alleged member of Scattered Spider, the prolific hacking crew behind a number of the largest company breaches of the previous few years, has been extradited from Finland to face U.S. expenses over an $8 million cryptocurrency ransom demand.

Peter Stokes, 19, a twin U.S. and Estonian citizen, appeared in Chicago federal courtroom on Tuesday on conspiracy, cyber intrusion, and fraud expenses, in line with a press release by the Justice Division. Finnish police arrested him in April on an Interpol Pink Discover, and he was extradited final week and ordered held pending trial.

The grievance facilities on a Could 2025 breach of an unnamed luxurious jewellery retailer. In accordance with the indictment, Stokes and alleged accomplices talked their well past the corporate’s IT assist desk to reset worker 2FA credentials, then stole knowledge and demanded about $8 million in crypto. Safety workers evicted them and by no means paid, although the retailer nonetheless misplaced a minimum of $2 million to disruption and cleanup.

A widening dragnet

Scattered Spider, also called Octo Tempest, UNC3944, and 0ktapus, is a free collective of hackers that prosecutors say has carried out greater than 100 intrusions and picked up over $100 million in ransoms. Its hallmark is social engineering moderately than malware: members cellphone assist desks, pose as workers, then extort crypto to unlock or suppress stolen knowledge. The ways powered 2023’s assaults on MGM Resorts and Caesars Leisure, the latter of which paid a roughly $15 million ransom.

Stokes joins a lengthening checklist of members in U.S. courts. Alleged ringleader Tyler Buchanan, a 24-year-old Scot, pleaded responsible in April to a phishing spree that stole a minimum of $8 million in crypto, and Florida’s Noah City was sentenced to 10 years after reporting tied him to breaches together with crypto trade Crypto.com. The DOJ charged 5 alleged members in a separate 2024 crypto-phishing case.

Crypto ransoms around the globe

The jeweler’s refusal to pay mirrors a broader shift in responses to crypto ransom calls for. Ransomware crews extorted about $850 million in crypto in 2025, flat from a 12 months earlier, at the same time as sufferer postings on leak websites jumped 44%, in line with TRM Labs. Whereas the menace panorama has expanded resulting from decrease obstacles to entry for criminals, TRM Labs reported that whole ransomware-linked quantity fell to roughly $1.3 billion from $1.9 billion in 2024, as victims “more and more refusing to pay their attackers.”