Cryptocurrency theft case: Malone Lam admits to $245M Bitcoin heist

14 hours ago 18

A 22-year-old school dropout from Singapore has admitted to running one of the largest cryptocurrency theft operations ever prosecuted in the United States, a case that shows just how easily social engineering can drain a crypto wallet worth hundreds of millions of dollars. Malone Lam, who left school in the eighth grade before eventually settling in Miami, pleaded guilty to a racketeering conspiracy charge tied to the theft and laundering of more than $245 million in digital assets. The cryptocurrency theft case against him is now considered a major milestone in a much larger federal investigation into an international crypto-theft network.

Key takeaways

Malone Lam, 22, pleaded guilty to a RICO conspiracy charge tied to the theft and laundering of more than $245 million in digital assets.
Lam and his associates stole over 4,100 Bitcoin from a Washington, DC victim by impersonating Google and Gemini executives, in a theft valued at more than $230 million in August 2024.
At least 18 defendants have been charged in the wider enterprise, which authorities say operated from October 2023 through May 2025.
Stolen funds financed over 30 exotic cars, a $2 million watch, mansions, private jets and a single $569,000 night out at a Los Angeles nightclub.
Lam faces up to 20 years in prison on the RICO charge, with his next status hearing scheduled for December 8, 2026.

Malone Lam Pleads Guilty in a $245 Million Cryptocurrency Theft Case

Lam entered his guilty plea on September 8, 2026, in US District Court in Washington, DC, admitting to a single count of participating in a RICO conspiracy. According to the US Department of Justice, he led an international cybercrime ring that relied on social engineering tactics to steal and launder digital assets exceeding $245 million in value.

Prosecutors say the enterprise operated from at least October 2023 through May 2025, drawing in participants across several US states and abroad. Using online aliases such as “Anne Hathaway,” “$$$” and “King Greavy,” Lam — a Singapore citizen who later relocated to Miami — is accused of helping run the group’s social engineering schemes by pinpointing victims and assigning roles among network members. Among the 18 individuals charged in this broader case, he became the 11th to plead guilty, a development investigators view as a major turning point despite being one of many defendants. He faces a maximum sentence of 20 years on the RICO conspiracy charge, and his next status hearing is scheduled for December 8, 2026.

How a Bitcoin Social Engineering Scam Drained One Victim’s Wallet

Posing as Google and Gemini staff

On August 18, 2024, Lam and his alleged accomplices carried out the case’s biggest single theft, targeting a cryptocurrency investor based in Washington, DC. Rather than hacking directly into the victim’s wallet, members of the group relied on a Bitcoin social engineering scam: two conspirators posed as representatives of Google and the Gemini cryptocurrency exchange, convincing the victim his accounts were compromised. That manipulation led him to hand over access to his Google Drive and reveal security codes, giving the group everything it needed to move his funds.

More than $230 million taken in one theft

Using that access, the conspirators siphoned off more than 4,100 Bitcoin. The original federal indictment valued the stolen Bitcoin at more than $230 million at the time of the theft in August 2024. The Justice Department’s broader case describes the full enterprise as having stolen and laundered cryptocurrency worth over $245 million, indicating the Washington theft was not an isolated event. The expanded indictment also references a separate theft of more than $14 million in cryptocurrency from another victim in July 2024.

This is where the case matters beyond the courtroom: it underscores how vulnerable even sophisticated crypto holders remain to impersonation tactics that require no technical hacking at all, only a convincing phone call and a moment of trust.

An International Network Built From Gaming Friendships

Prosecutors describe a criminal enterprise with clearly divided labor — database hackers, target identifiers, callers, organizers, money launderers, and even people allegedly tied to residential burglaries targeting cryptocurrency hardware wallets. At least 18 defendants have been charged in connection with the wider operation, which authorities say grew out of friendships formed on online gaming platforms before evolving into an organized scheme targeting wealthy cryptocurrency holders across the country.

Ferraris, Mansions and a $569,000 Night: Where the Stolen Bitcoin Went

An extravagant, short-lived lifestyle

Once the Bitcoin was converted into cash, Lam and other members of the operation poured the money into an extravagant lifestyle. According to the Associated Press, Lam purchased more than 30 exotic cars, including custom Porsches, Lamborghinis and Ferraris, and bought a watch worth roughly $2 million. He and his associates rented mansions in Miami and used the stolen funds to cover private jets, security personnel and luxury clothing. One of the most eye-catching figures in the case came from a single evening at a Los Angeles nightclub, where Lam reportedly spent about $569,000. The Justice Department says members of the wider conspiracy sometimes spent as much as $500,000 per night on nightclub services and bought vehicles ranging from $100,000 to $3.8 million.

Shell companies, private jets and stuffed toys

Beyond the spending, investigators uncovered unusual methods allegedly used to disguise the origin of the funds. Members of the enterprise reportedly relied on luxury rental properties, private aircraft and shell companies to obscure asset ownership. The expanded indictment also alleges that some members offered unlicensed crypto-to-cash services and that bulk cash was shipped through the US postal system hidden inside Squishmallow stuffed toys — a detail that illustrates just how far the laundering operation extended beyond the digital realm. These allegations apply to the broader case and remain subject to the legal process for defendants who have not yet entered guilty pleas.

Arrest in Miami and What Happens Next in the Case

Lam managed to keep up his extravagant spending for about a month before authorities caught up with him, arresting him in Miami in September 2024 after digital evidence tied him to the theft — a case reportedly helped along when an off-duty law enforcement officer allegedly tipped him off that investigators were closing in. Around the same period, alleged co-conspirator Jeandiel Serrano was also taken into custody, after cryptocurrency-related activity led investigators to a high-end property in California.

As the probe grew, prosecutors ultimately charged 18 defendants, with three co-conspirators sentenced before Lam even entered his plea, while others remain in various stages of pleading guilty or awaiting trial. Recordings made during the investigation reportedly captured Lam speaking from behind bars, admitting that he and his associates had once joked about what getting arrested might look like but never imagined the situation would escalate this far. During an earlier court appearance, after hearing prosecutors outline the extent of his spending, US Magistrate Judge Alicia Valle remarked that the case resembled “Ferris Bueller gone bad” — a nod to the mischievous protagonist of the 1986 film, even though Lam’s alleged crimes spanned hundreds of millions of dollars rather than a single day of playing hooky.

Lam’s admission of guilt is far from the final chapter in this RICO crypto conspiracy. No sentencing date has been fixed beyond a status hearing scheduled for December 8, 2026, and legal proceedings against the remaining defendants are still unfolding. Nevertheless, the case makes clear how a group of friends who met through online gaming ended up orchestrating one of the biggest cryptocurrency theft operations in American history — serving as a stark warning to anyone tempted to trust an unexpected call claiming to be from “Google” or a crypto exchange.

FAQ

How did Malone Lam and his associates steal over 4,100 Bitcoin?

They used social engineering by impersonating Google and Gemini executives to trick the victim into providing access and security codes.

What luxury items were purchased with the stolen cryptocurrency?

The stolen funds financed over 30 exotic cars, a $2 million watch, mansions, private jets, and lavish nightclub spending including a $569,000 night in Los Angeles.