Skip to main content
Sign in

Peter Stokes (Scattered Spider)

avoid.net/peter-stokes-scattered-spider→3/100·75% conf.
[AI-DRAFTED · AWAITING VERIFICATION]

Summary

Peter Stokes, 19, a dual U.S.-Estonian national, was arrested in Finland in April 2026 on an Interpol Red Notice and extradited to the United States on July 1, 2026 to face federal charges in the Northern District of Illinois for alleged membership in the Scattered Spider cybercrime collective. Prosecutors allege Stokes participated in a May 2025 social-engineering breach of an unnamed luxury jewelry retailer in which attackers reset an employee's two-factor authentication credentials via the company help desk, stole data, and demanded roughly $8 million in cryptocurrency. All allegations against Stokes are pending trial and unproven in court; Scattered Spider as a network has been linked by U.S. authorities to more than 100 corporate intrusions and over $100 million in crypto-denominated ransom and extortion payments.

Connected Entities

1 entities · 10 linked investigations
Organizations
□Peter Stokes (Scattered Spider)
Relationships
    Also appears in
    edgeX Exchange·28Saga EVM Blockchain·32Mach-O Man Malware Campaign (Lazarus / Chollima)·0Trenton Richard Johnston·2Q2 2026 DeFi Record Hack Wave·0Bunni Protocol·28BitGrail·2Shunda Park Scam Compound·0Axiom DEX Insider Trading (Broox Bauer)·14Chen Zhi / Prince Group·2
    Have evidence about Peter Stokes (Scattered Spider)?

    Timeline(6 events)

    2025-05-01

    Alleged breach of an unnamed luxury jewelry retailer via help-desk social engineering; attackers allegedly demand roughly $8 million in cryptocurrency ransom (exact date within May 2025 as reported).

    Decrypt

    2026-04-01

    Peter Stokes allegedly arrested by Finnish authorities on an Interpol Red Notice, reportedly while attempting to board a flight to Japan (exact date within April 2026 as reported).

    Cryptobriefing

    2026-04-20

    Tyler Robert Buchanan ("Tylerb"), a separately charged alleged Scattered Spider member, pleads guilty to wire fraud conspiracy and aggravated identity theft.

    The Register / Krebs on Security

    2026-06-30

    Peter Stokes makes initial appearance in Chicago federal court and is ordered held pending trial.

    Decrypt

    2026-07-01

    DOJ announces Stokes' extradition from Finland to the United States and unseals charges of conspiracy, computer intrusion, and fraud.

    WTTW Chicago News / crypto.news

    2026-07-16

    Owen Flowers and Thalha Jubair, alleged Scattered Spider members, sentenced to 5.5 years each at Woolwich Crown Court for the £29 million Transport for London hack.

    The Hacker News
    Provenance & Audit Trail

    Decision Log

    • #1publish⛓ pending7/22/2026, 2:07:54 AM
      hash: Bs8i57zkcnTfYHjvPThhUuw1kPBFaVvNtakvwNkqfnYB

    This investigation is cryptographically anchored to the Solana blockchain and source URLs are archived via the Internet Archive.

    full audit log →version history →

    model: claude-code-investigator

    generated: 7/22/2026, 2:07:28 AM

    last updated: 7/22/2026, 2:07:54 AM

    avoid.net — verified advice for a post-truth world