US Department of Justice extradites member of Scattered Spider hacker group, involved in cryptocurrency ransomware attack exceeding $100 million

BlockBeats News, on July 2, the U.S. Department of Justice announced that it has extradited 19-year-old U.S. and Estonian dual national Peter Stokes from Finland, who is accused of being a member of the hacking group Scattered Spider (also known as Octo Tempest, UNC3944, 0ktapus). Prosecutors allege that the group was behind more than 100 network intrusions, netting over $100 million in cryptocurrency ransom, and causing losses of millions of dollars through business disruption, evidence collection, and system recovery.

According to the indictment, Peter Stokes was arrested in Finland in April 2026 based on an Interpol Red Notice, was extradited to the United States last week, and made his first appearance in federal court in Chicago on July 1. He currently faces multiple charges, including conspiracy, unlawful intrusion into computer systems, and fraud.

Prosecutors further allege that in May 2025, Peter Stokes took part in an attack on a luxury jewelry retailer, stealing corporate data and demanding approximately $8 million in cryptocurrency ransom. The victim company did not pay the ransom, but still suffered losses exceeding $2 million due to business disruption and system repair.

The U.S. Department of Justice said the case is part of the FBI’s “Operation Riptide” crackdown on cybercrime, reflecting law enforcement’s ongoing efforts to strengthen international cooperation in targeting ransomware and cybercrime activities involving cryptocurrencies.