The UK’s National Crime Agency (NCA) and City of London Police have secured prison sentences for two men they say were involved with the “Scattered Spider” hacking group, a cybercrime crew prosecutors link to ransomware and cryptocurrency extortion schemes across the UK and the United States.
According to an NCA press release, the men pleaded guilty at Woolwich Crown Court on June 22 and were sentenced to five years and six months on Thursday. Authorities say the case is part of broader efforts to dismantle financially motivated cyberattacks in which cryptocurrency often plays a central role.
Key takeaways
- Two men connected to Scattered Spider received five years and six months in prison after guilty pleas at Woolwich Crown Court.
- UK investigators linked the group to intrusion activity targeting London’s public transport network in September 2024.
- US prosecutors have associated Scattered Spider with collecting at least $115 million in crypto ransom payments from dozens of US companies.
- Prosecutors say earlier attacks included a Caesars Entertainment breach and a subsequent Bitcoin ransom payment.
- The US Department of Justice previously reported an FBI seizure of about $36 million tied to wallets linked to the group.
UK sentencing follows a high-profile transport network breach
The NCA and City of London Police stated that the two defendants were associated with Scattered Spider. Investigators have previously linked the group to an intrusion into London’s public transport network in September 2024, an incident reported to have produced losses and recovery costs totaling 29 million British pounds (about $38.9 million).
That alleged breach underscores why cybercrime attributed to Scattered Spider has drawn attention beyond typical corporate fraud: public-sector and critical services are often targeted because operational disruption can be immediate and expensive, even when organizations ultimately recover their systems.
US prosecutors tie the group to crypto extortion at scale
The UK case comes as US authorities describe Scattered Spider’s wider footprint. A September press release from the Department of Justice (DOJ) said US prosecutors linked the group to collecting $115 million in cryptocurrency ransom payments from at least 47 US companies.
In the same DOJ release, prosecutors also characterized the attacks as disruptive to a broad range of targets—including critical infrastructure and the federal court system—suggesting that Scattered Spider’s activity was not limited to isolated enterprises but extended to organizations with heightened operational and regulatory importance.
That pattern matters for crypto investors and exchange and compliance stakeholders as well, because extortion campaigns can drive recurring demand for laundering services and complicate efforts to trace stolen funds once ransoms are paid.
Earlier allegations include Caesars Entertainment ransom in Bitcoin
The DOJ press release also accused Scattered Spider of breaching Caesars Entertainment and stealing a large customer database in September 2023. In connection with that incident, prosecutors said Caesars paid a $15 million ransom in Bitcoin (BTC).
For readers tracking the intersection of ransomware and cryptocurrency payments, this detail reflects a recurring dynamic in extortion cases: victims may seek to move quickly to stop ongoing damage, while attackers often demand digital assets that are typically easier to move than traditional payment rails.
FBI action targeting Scattered Spider-linked crypto wallets
The DOJ’s September release further reported that, in July 2024, the FBI seized approximately $36 million worth of cryptocurrency from wallets said to be linked to Scattered Spider.
According to the DOJ, investigators tied the group to at least 120 computer network intrusions. The agency said it traced and seized digital assets connected to wallets allegedly controlled by group members as part of its investigation.
While the UK sentencing is focused on two individual defendants, the seizure case highlights how law enforcement actions often span multiple stages—identifying suspected actors, attributing intrusions, and then attempting to disrupt the money movement that fuels ransomware and related extortion.
Looking ahead, the key uncertainty is how these cases will translate into sustained disruption of Scattered Spider’s operational capabilities. Readers should watch for further announcements on additional arrests, more wallet-related seizures, and any follow-up reporting that clarifies the extent of responsibility for the reported London transport breach and other high-profile targets.
