Overview
- Tyler Robert Buchanan, 24, pleaded guilty in U.S. federal court to conspiracy to commit wire fraud and aggravated identity theft and now awaits an August 21, 2026 sentencing with a statutory maximum of 22 years.
- Prosecutors say he ran large SMS phishing blasts that drove employees to fake login pages, captured passwords with a phishing kit, and funneled those credentials to a Telegram channel he helped manage.
- Using stolen logins, the crew hijacked phone numbers through SIM swaps to intercept one‑time passcodes, broke into accounts, and stole at least $8 million in cryptocurrency from U.S. victims.
- Investigators say the campaign hit at least a dozen organizations between September 2021 and April 2023, and a 2023 search of his Scotland home turned up victim data, wallet seed phrases, and account logins.
- Spanish police arrested Buchanan in Palma de Mallorca in June 2024, he has been in U.S. custody since April 2025, and related cases include a 10‑year sentence for co‑conspirator Noah Michael Urban with three others still facing charges.