U.S. charges teen Scattered Spider suspect in crypto ransom scheme

Peter Stokes, a 19-year-old dual U.S.-Estonian national, has been extradited to the United States over charges tied to Scattered Spider, a hacking group linked to crypto ransom demands

Summary

• Stokes faces U.S. charges over a jewelry retailer breach and failed $8M crypto ransom demand.
• The DOJ says Scattered Spider has caused over $100M in ransom payments through corporate intrusions.
• The case shows phishing, help-desk impersonation, and crypto extortion remain key risks for companies.

The U.S. Department of Justice said in a July 1 statement that Finnish authorities arrested Stokes in April under an Interpol Red Notice.

Stokes appeared in federal court in Chicago after his extradition last week. Prosecutors charged him with conspiracy, cyber intrusion, fraud, and related offenses. The DOJ said the charges remain allegations, and Stokes is presumed innocent unless proven guilty in court.

Jewelry retailer resisted ransom demand

The complaint centers on a May 2025 intrusion at a luxury jewelry retailer. Prosecutors allege Stokes and others used phishing calls to the company’s technology help desk while pretending to be employees who needed password resets. The attackers allegedly compromised employee accounts, including accounts with higher access rights.

The DOJ said the group stole company data and demanded about $8 million in cryptocurrency. The retailer removed the intruders from its network and did not pay, but prosecutors said the company still suffered at least $2 million in losses from business disruption, investigation, and response work.

Scattered Spider tied to wider crypto theft cases

Scattered Spider is also known as Octo Tempest, UNC3944, and 0ktapus. The DOJ said the group has been linked to “over 100 network intrusions” and more than $100 million in ransom payments. Prosecutors say the group uses social engineering, account takeovers, data theft, and crypto extortion against corporate victims.

As previously reported, U.S. prosecutors in 2024 charged five people linked to Scattered Spider in a separate case involving alleged phishing, SIM swapping, and at least $11 million in stolen cryptocurrency. That earlier case involved victims at companies and a crypto exchange, showing how the group’s methods crossed from corporate data theft into direct digital asset theft.

Crypto ransom cases remain under pressure

The Stokes case arrives as ransomware groups keep using crypto for payments, even as more victims refuse to pay. Chainalysis found that ransomware cashouts fell 35% in 2024 as law enforcement actions, sanctions, and stronger recovery plans disrupted criminal networks.

Chainalysis later said in its 2026 ransomware report that ransomware actors received more than $820 million in on-chain payments in 2025, down about 8% from 2024, while claimed attacks rose 50%. That mix shows fewer payments but continued pressure from cyber extortion groups targeting companies.

Law enforcement focuses on tracing funds

The case also shows why blockchain tracing remains central to cybercrime probes. As previously reported, blockchain forensics can help authorities track crypto transactions by linking wallets, exchange records, and transaction flows to real-world activity. Those methods do not stop every ransom demand, but they can help build cases after an attack.

Recent enforcement actions have also targeted laundering networks used by cybercriminals. As crypto.news reported, U.S. prosecutors charged alleged operators of AudiA6, a crypto laundering network accused of processing more than $389 million in transactions

The DOJ said the Stokes case is part of Operation Riptide, an FBI effort targeting cybercrime actors, infrastructure, and financial networks. Prosecutors say foreign-based suspects can still face U.S. charges when attacks hit American businesses or their customers. That stance may shape future cybercrime cases.