A man from Dundee has admitted his involvement in a sophisticated cybercrime conspiracy that defrauded victims across the United States of at least $8 million (£5.9 million) in virtual currency. Tyler Buchanan, 24, pleaded guilty in a US federal court to one count of conspiracy to commit wire fraud and one count of aggravated identity theft.
According to the US Department of Justice (DOJ), Buchanan was part of a group that employed text message (SMS) phishing attacks to trick employees of various companies into revealing their login credentials. This illicit access then allowed the conspirators to infiltrate computer systems and steal virtual currency.
Buchanan’s plea agreement details that between September 2021 and April 2023, the criminal enterprise targeted at least a dozen companies, including telecommunications firms, IT suppliers, cloud communications providers, and virtual currency companies, as well as individuals. Court documents indicate the group also targeted at least 45 companies in the United States, Canada, India, and the United Kingdom.
The operation involved sending hundreds of fraudulent messages designed to appear as if they originated from the victim companies or their contracted suppliers. These messages led employees to deceptive websites created to capture their login details.
The DOJ stated: “The conspirators created a phishing kit that captured login credentials entered into the fraudulent phishing websites by a victim company’s employees.”
It further added: “The stolen credentials were then transmitted to an online Telegram channel administered by Buchanan and another co-conspirator.”
Investigators seized a device from Buchanan’s home in Scotland, which contained names and addresses of multiple victims, along with a text file listing cryptocurrency seed phrases and login credentials for a victim’s account.
Buchanan has been in US federal custody since April 2025, following his arrest and extradition. He is scheduled for sentencing on August 21 and faces a maximum sentence of 22 years in federal prison.
The wider investigation, which saw assistance from Police Scotland alongside the FBI, also involves three other US defendants who are still facing criminal charges. Another co-conspirator, Noah Michael Urban, 21, of Palm Coast, Florida, pleaded guilty in April 2025 to three fraud-related charges. Urban is currently serving a 10-year prison sentence and was ordered to pay $13 million (£9.6 million) in restitution.
