A 19-year-old has been brought to the US to face charges over a failed $8 million crypto ransom. Peter Stokes, a dual US-Estonian national, was arrested in Finland in April and extradited last week. He appeared in a Chicago federal court on Tuesday.
According to the DOJ, Stokes and others breached a luxury jewelry retailer’s systems in May 2025. They stole data and demanded $8 million in crypto. The company kicked them off the network and didn’t pay — but still suffered $2 million in disruption costs.
The hack started with phishing calls to the help desk. Stokes and his crew posed as employees asking for password resets. Within two hours, they compromised three accounts — two belonging to IT admins. That gave them the keys to the kingdom.
A few days later, they sent a ransom note from a compromised company email. The threat: pay up or we publish credit card data. The company refused.
Stokes goes by “Bouquet” and “Jordan” online. Authorities say he’s been involved in multiple intrusions. A search of his storage device found exfiltrated records from several victim companies. His Snapchat account showed “substantial wealth for a person his age,” plus boasts about international travel.
Scattered Spider — also known as Octo Tempest, UNC3944, and 0ktapus — has been linked to over 100 network intrusions. Total ransom payments exceed $100 million. The group’s signature move? Crypto ransom demands.
Stokes faces six counts: hacking, cyber extortion, fraud, and conspiracy. Ransomware actors collected over $820 million in payments last year. That’s an 8% drop from 2024 — but only because attacks actually rose by 50%.
