Teen Scattered Spider suspect extradited to US over $8M ransom
Peter Stokes, 19, a dual US-Estonian national and alleged Scattered Spider member, was extradited from Finland to the United States last week to face federal charges tied to an unsuccessful $8 million cryptocurrency ransom demand against a luxury jewelry retailer. The teen scattered spider suspect made his initial appearance in a Chicago federal court on Tuesday. He was arrested in Finland in April on an Interpol Red Notice before US authorities brought him into custody.
Key Takeaways
- Stokes, 19, was extradited from Finland and charged over an alleged $8 million crypto ransom plot that prosecutors say failed.
- Prosecutors say Scattered Spider has carried out more than 100 intrusions and collected over $100 million in ransom payments.
- The unnamed jewelry retailer repelled the hackers and refused to pay, but still reported about $2 million in disruption damages.
- Stokes faces six counts including hacking, cyber extortion, fraud, and conspiracy.
- Ransomware payments topped $820 million globally last year even as total payments fell 8% year over year.
Who Is the Teen Scattered Spider Suspect?
Peter Stokes is a 19-year-old dual US-Estonian national whom US authorities have linked to Scattered Spider, a hacking collective also known as Octo Tempest, UNC3944, and 0ktapus. The US Justice Department said on Wednesday that Finnish police arrested him in April and extradited him to the United States last week.
According to a criminal complaint unsealed in court, Stokes uses the online nicknames Bouquet and Jordan. Prosecutors described him as a Scattered Spider member who has engaged in numerous intrusions or assisted in them against multiple unnamed companies.
What Did the Alleged $8M Crypto Ransom Scheme Involve?
The complaint centers on a May 2025 breach of a luxury jewelry retailer. Stokes and alleged co-conspirators are accused of phishing the company technology help desk, posing as employees to reset login credentials.
Authorities say the group compromised three employee accounts within about two hours, including two belonging to IT administrators with higher-privilege access. After several days, they allegedly sent a ransom note from a compromised company email threatening to publish credit card and payment data unless the retailer paid.
The company repelled the intrusion and never paid the $8 million crypto demand, though the complaint says it still suffered roughly $2 million in disruption damages. Investigators alleged a storage device linked to Stokes contained downloads from a virtual private server Microsoft had tied to corporate intrusions, plus exfiltrated records from multiple victim companies.
Why Does the Scattered Spider Arrest Matter for Crypto?
Stokes is one of the few arrests US authorities have publicly tied to Scattered Spider, a group prosecutors say has been involved in more than 100 network intrusions resulting in more than $100 million in ransom payments and millions more in damages. The case underscores how ransomware crews continue to demand cryptocurrency even as overall payment volumes shift.
Industry data cited in reporting shows ransomware actors received more than $820 million in payments last year, an 8% decline from 2024, even as attacks rose by about 50%. For more on how digital extortion intersects with markets and regulation, see our Fintech & Crypto Alerts coverage.
The Justice Department announcement, reported by Cointelegraph, also noted FBI evidence from Stokes Snapchat account, including an image of him wearing a Hack the Planet necklace and posts boasting about international travel, wealth, and apprehended Scattered Spider members. Stokes was ordered held pending trial on six federal counts.