A 19-year-old dual U.S.-Estonian national, Peter Stokes, has been extradited to the United States and charged in connection with Scattered Spider, a hacking group long tied to high-profile crypto ransom schemes and help-desk social engineering attacks. Key facts - Defendant: Peter Stokes, 19, dual U.S.-Estonian citizen. Arrested in Finland in April under an Interpol Red Notice; extradited to the U.S.; appeared in federal court in Chicago. - Charges: Conspiracy, cyber intrusion, fraud and related offenses; DOJ says charges are allegations and Stokes is presumed innocent until proven guilty. - Incident: Alleged May 2025 breach of a luxury jewelry retailer; attackers demanded roughly $8 million in cryptocurrency. The company did not pay but reported at least $2 million in losses from disruption, investigation and remediation. - Group: Scattered Spider (aliases: Octo Tempest, UNC3944, 0ktapus), linked by DOJ to 100+ network intrusions and more than $100 million in ransom payments. - Context: Case is part of the FBI’s Operation Riptide targeting cybercriminal infrastructure and financial networks; highlights continued reliance on crypto for ransom and the role of blockchain tracing in investigations. What prosecutors allege According to a July 1 DOJ statement, the complaint centers on a May 2025 intrusion at a luxury jewelry retailer. Prosecutors say Stokes and co-conspirators used voice phishing (vishing) to call the company’s IT help desk, impersonating locked-out employees and coercing password resets.