The US Department of Justice, following an FBI investigation, charged 19-year-old Peter Stokes with conspiracy, computer intrusion, and fraud over his alleged role in the Scattered Spider hacking group. Finnish authorities arrested the dual US-Estonian citizen in April and extradited him last week.

Stokes appeared in federal court in Chicago on Tuesday, and a judge ordered him to remain in custody. FBI Chicago Special Agent-in-Charge Douglas S. DePodesta announced the extradition alongside federal prosecutors.

Scattered Spider Built a $100 Million Extortion Machine

According to the DOJ complaint, Scattered Spider, also known as 0ktapus, Octo Tempest, and UNC3944, has executed over 100 network intrusions. Federal investigators estimate the syndicate collected more than $100 million in ransom payments.

The group relies on deception rather than sophisticated code. Members trick employees into surrendering account credentials, encrypt or steal corporate data, and then demand cryptocurrency. Victims pay to regain control of their data or to stop public leaks. Similar social engineering fuels the WhatsApp username scam risk that Changpeng Zhao recently exposed.

Meanwhile, Chainalysis found that on-chain ransomware payments declined for a second consecutive year in 2025. Attackers, therefore, appear to compensate with more frequent intrusions.

An $8 Million Ransom Demand That Backfired

The complaint alleges that Stokes and his co-conspirators breached a luxury jewelry retailer in May 2025. They copied company data and demanded roughly $8 million in cryptocurrency.

However, the retailer’s security team evicted the intruders, and the company paid nothing. It still lost at least $2 million through business disruption, investigation, and threat mitigation.

“Scattered Spider has repeatedly targeted U.S. companies, extorting employees, inflicting millions of dollars in losses, and disrupting essential operations,” FBI Cyber Division Assistant Director Brett Leatherman described the group’s impact.

The Justice Department’s Office of International Affairs and Finland’s National Bureau of Investigation coordinated the extradition.

Washington Widens Its Crypto Crime Dragnet

The case falls under Operation Riptide, the FBI’s sustained campaign against cybercrime and fraud networks. Americans reported over $20 billion in cybercrime losses last year, a 26% single-year jump. The DOJ’s computer crime section has convicted over 180 cyber criminals since 2020. Courts ordered the return of over $350 million in victim funds.

Moreover, enforcement now stretches across the whole industry. This week, Tether froze sanctioned TRON wallets tied to ISIS-K, and in June a judge sentenced a crypto influencer impersonator to 15 months in prison.

At the same time, the bureau faces scrutiny of its own after Kash Patel’s stock disclosure revealed a late-reported MicroStrategy purchase.

A complaint remains an allegation, and Stokes awaits trial in Chicago. The coming months will show whether prosecutors can turn one arrest into a broader takedown of the syndicate.

Source: BeInCrypto