In short
- A 19-year-old alleged member of Scattered Spider, Peter Stokes, has been extradited from Finland to the US to face charges of conspiracy, cyber-trespassing, and fraud.
- Prosecutors say they helped hack a jewelry retailer in May 2025 and demanded about $8 million in cryptocurrency, although the company refused to pay.
- The group is tied to more than 100 intrusions and $100 million in cryptocurrencies.
A man suspected of being a member of Scattered Spider, a notorious hacking group that has committed numerous crimes over the past few years, has been extradited from Finland to face US charges in an $8 million ransom demand.
Peter Stokes, 19, a dual citizen of the U.S. and Estonia, appeared in federal court in Chicago on Tuesday on charges of conspiracy, wiretapping, and fraud, according to the words and the Department of Justice. Finnish police arrested him in April on an Interpol Red Notice, and he was released last week and ordered held pending trial.
The complaint centers on a May 2025 violation of an unnamed jewelry retailer. According to a caseStokes and his friends allegedly talked their way through the company’s IT support desk to return the employee’s 2FA request, then stole the data and demanded $8 million in crypto. Security officials chased them away and never paid, although the retailer still lost at least $2 million to the mess and cleanup.
Expanding network
Scattered Spider, also known as Octo Tempest, UNC3944, and 0ktapus, is a criminal syndicate that prosecutors say has carried out more than 100 transactions and collected more than $100 million. Its hallmark is social engineering rather than malware: mobile support members, acting as employees, then expropriate crypto to unlock or suppress stolen data. Managed processes Attacks of 2023 at MGM Resorts and Caesars Entertainment, the latter of which paid about $15 million.
Stokes joins a long list of members of the US judiciary. Tyler Buchanan, 24 years old from Scotland, pleaded guilty in April to a scam that stole at least $8 million, and Florida’s Noah Urban was he was sentenced to 10 years after reporting he was arrested for violations including crypto exchange Crypto.com. The DOJ has charged five members who are suspected of a separate 2024 crypto-phishing case.
Crypto exchange around the world
The jeweler’s refusal to pay the mirror marks a major shift in the response to crypto redemptions. Ransomware operators have stolen an estimated $850 million in crypto in 2025, up from the previous year, although the data posted on the leaked website jumped 44%, according to TRM Labs. Despite the growing threat due to barriers to entry for criminals, TRM Labs reported that the amount of money associated with ransom will drop to approximately $1.3 billion from $1.9 billion in 2024, as victims “refuse to retaliate against their attackers.”
Daily Debrief A letter
Start each day with top stories right here, including originals, podcasts, videos and more.
