British man pleads guilty to conspiring to steal $8m in virtual currency

A 24-year-old Brit has confessed to orchestrating cyberattacks that targeted over a dozen firms and siphoned at least $8 million in digital assets from US residents. The US Department of Justice (DOJ) revealed that Tyler Buchanan, based in Dundee, and his accomplices exploited SMS-based phishing tactics to infiltrate accounts and extract sensitive data.

Phishing schemes and stolen information

According to the DOJ, Buchanan and his team conducted text-based phishing schemes between September 2021 and April 2023. These attacks involved sending deceptive messages to mobile devices, prompting victims to share login details and passwords. A digital device uncovered at Buchanan’s Scottish residence provided evidence of his access to cryptocurrency seed phrases and personal data of multiple individuals.

“The group’s actions allowed them to breach company systems and steal confidential information,” stated the DOJ in its filing.

Buchanan, who has been in US federal custody since April 2025, is set for sentencing on 21 August. At that time, he may receive up to 22 years in prison for conspiracy to commit wire fraud and aggravated identity theft. The scheme allegedly drained millions of dollars in virtual currency from US citizens, with the DOJ confirming the total value stolen exceeded $8 million.

In November 2023, Buchanan was indicted alongside four American suspects, including 21-year-old Noah Michael Urban. Urban, a co-conspirator, admitted guilt in April 2025 for three fraud-related charges and is currently serving a 10-year federal sentence while paying $13 million in restitution. The FBI continues to probe the case, with three other defendants—each in their 20s—still facing charges.