-
Six alleged cybercriminals now face charges in the US after the FBI’s Operation Riptide.
-
The 60-day campaign led to over 200 arrests and $23 million in frozen or seized funds.
-
One extradited suspect, a 19-year-old, is accused of belonging to the Scattered Spider hacking group.
The FBI has sent six alleged cybercriminals to the United States to face charges. Officials say the move is part of Operation Riptide, a campaign against online crime and fraud. FBI Director Kash Patel shared the news in a recent video statement.
Extradition means one country sends a suspect to another country to face charges. Patel said cybercriminals cannot use technology or long distances to hide from American law enforcement.
Operation Riptide Ends After 60 Days With 200+ Arrests
The FBI launched Operation Riptide on June 9. It described the effort as a steady campaign against criminals, their tools, their networks, and their money. The FBI says the plan follows Executive Order 14390 and the White House’s Cyber Strategy for America.
Officials explained why the campaign began. According to FBI leaders Heith Janke and Brett Leatherman, Americans filed more than one million complaints last year. Those reports listed over $20 billion in losses to online crime and fraud. That figure rose 26% in a single year.
In the weeks before the launch, agents served search warrants, secured indictments, and arrested suspects. They also dismantled criminal systems and seized millions in crypto. Leatherman said the goal was constant pressure on cyber criminals. He explained that the FBI wanted to raise their risks, cut their income, and weaken their skills. Janke said online schemes drain family savings. Janke added that these gangs often work across borders to dodge police.
The FBI’s own review of the campaign lists the results. The broader crackdown is detailed in our story FBI announces nationwide cybercrime crackdown under “Operation Riptide”, which covers the FBI’s nationwide effort to target cybercrime networks and online fraud.
Agents ran 13 coordinated operations with U.S. and international partners. Those efforts led to more than 200 arrests. Authorities froze or seized over $23 million in illegal crypto and other funds. The FBI also began returning another $31 million in digital assets. It says North Korean cybercriminals stole that money.
The operation also hit the systems criminals rely on. Partners carried out six takedowns of technical infrastructure. They completed more than 150 interviews and searches. They also seized 170 domains and servers linked to criminal activity.
Scattered Spider Suspect Peter Stokes Appears in Chicago Court
One extradition case is now public. Peter Stokes, 19, holds both U.S. and Estonian citizenship. Finnish authorities arrested him in April under an Interpol Red Notice, which is a global alert. He reached the United States in June 2026, according to the Justice Department. Reuters also reported the extradition.
Stokes made his first appearance in a federal court in Chicago. The court ordered him to stay in law enforcement custody. Prosecutors charged him with conspiracy, computer intrusion, and fraud. They say he belongs to Scattered Spider. The Justice Department stressed that a complaint is only an allegation. Stokes is presumed innocent until proven guilty in court.
Prosecutors link Scattered Spider to more than 100 network break-ins. Those attacks led to over $100 million in ransom payments. Victims also lost millions more in damages. According to Assistant Attorney General A. Tysen Duva, the charges follow years of teamwork. The Criminal Division, Illinois prosecutors, and the FBI shared that work. Duva added that the partners will keep working so cybercriminals cannot escape the reach of the United States.
The complaint explains how the group works. It says members trick workers into giving access to company accounts. Then they lock the company’s data or copy it to faraway servers. Finally, they demand crypto to unlock the data or keep it private. The group also goes by Octo Tempest, UNC3944, and 0ktapus.
The complaint names one victim, a luxury jewelry seller. It says Stokes and others broke into the company’s computer system and copied data. They demanded about $8 million in crypto in May 2025. The company’s security team pushed the intruders out, so nobody paid the ransom. Still, the seller lost at least $2 million to business disruption, investigation, and cleanup.
U.S. Attorney Andrew Boutros said Scattered Spider attacks disrupted businesses and groups across the country. He added that prosecutors will keep pace with tech-savvy criminals, including those living abroad. Leatherman said the group has repeatedly hit U.S. companies and pressured their workers. He said the FBI will keep tracking cybercriminals wherever they live.
Prosecutors from the Computer Crime and Intellectual Property Section and the Northern District of Illinois handle the case. That section says it has won over 180 convictions of cyber and intellectual property criminals since 2020. It has also secured court orders returning more than $350 million to victims.
The FBI Chicago Field Office investigated the case. The FBI’s Copenhagen office helped. The Justice Department’s Office of International Affairs worked with Finnish authorities on the extradition. Finland’s National Bureau of Investigation also assisted.
FBI Says the Fight Against Cybercrime Continues
The FBI says Operation Riptide has ended. Patel said the agency is nowhere close to done. According to Patel, the FBI will keep using its partnerships and holding criminals accountable. He also promised to keep targeting their financial systems. He said FBI staff will not rest while criminals target Americans and their businesses.
The FBI’s summary says its work to disrupt cyber threats and support victims goes on every day. Janke said the campaign involved all 56 FBI field offices and the agency’s law enforcement offices abroad. Victims of online fraud can contact a local field office. They can also file a complaint at ic3.gov, according to the FBI announcement.
