Teen hacker from notorious Scattered Spider ring sentenced to 10 years in federal prison

In a nutshell: A Palm Coast, Florida, man linked to a notorious hacking crew will spend the next decade in federal prison after admitting to a multimillion-dollar cybercrime spree that relied on SIM-swapping attacks to steal cryptocurrency. The sentencing closes a two-year investigation that exposed one of the largest fraud schemes tied to a group known as Scattered Spider.

Noah Urban, also known by aliases including “King Bob” and “Gustavo Fring,” was sentenced Tuesday to 10 years behind bars and ordered to pay $13 million in restitution, according to WJXT. Starting in his teens, Urban conspired with fellow Scattered Spider members to hijack victims’ phone numbers, bypass security controls, and drain digital wallets in a coordinated campaign that stretched across multiple states.

The Justice Department noted the now 20-year-old’s crimes netted between $9.5 million and $25 million, with at least 30 confirmed victims. In one Florida case, investigators found that five individuals lost nearly $800,000 in cryptocurrency. When the FBI raided his Palm Coast home in March 2023, they seized about $2.9 million in digital coins stored on his computer, assets that had risen in value to roughly $3.7 million by last year.

As part of his plea agreement, Urban agreed to forfeit the seized cryptocurrency and pay restitution. The restitution order was broader than typical, covering not only those directly named in the federal case but also additional victims uncovered during the investigation. Prosecutors said the unusual scope reflected their intent to recover as much stolen money as possible, even if the victims may ultimately receive only a portion of their losses back.

The FBI and Cybersecurity and Infrastructure Security Agency describe Scattered Spider as one of the most brazen hacking collectives in recent years. The group uses social engineering – including push bombing and SIM swap attacks – to steal credentials, install remote access tools, and bypass multi-factor authentication. Members have impersonated IT and helpdesk staff via phone or SMS to access employee accounts and networks. Its operations have targeted both individual cryptocurrency holders and major corporations, cementing the crew’s reputation as a serious cybersecurity threat.

Urban pleaded guilty in April to wire fraud, conspiracy, and aggravated identity theft. The plea resolved federal cases in both Florida and California, where investigators had tracked attacks tied to the same group. His sentencing on August 20 formally closed those cases, though officials noted the broader investigation into Scattered Spider and its associates remains ongoing.

The punishment aligns with penalties sought in other major cybercrime cases. On the same day as Urban’s sentencing, federal prosecutors announced the arrest of Ethan Foltz, accused of running one of the world’s largest DDoS-for-hire networks. Foltz, like Urban, faces up to 10 years in prison if convicted. The cases, though unrelated, show how authorities are intensifying efforts against both financial fraud rings and disruptive online attack services.