Malone Lam to appear in court over alleged $230M Bitcoin theft

Malone Lam, the 22-year-old alleged ringleader of a criminal enterprise accused of swiping more than 4,100 Bitcoin from one person, is scheduled to appear in a Washington, D.C. federal court on Tuesday for a plea agreement hearing. The stolen haul was valued at over $230 million at the time of the theft.

The theft itself happened on or around August 18, 2024. Lam and his co-defendants allegedly posed as representatives from Google and Gemini, the cryptocurrency exchange, using social engineering to trick the victim into granting remote access to their accounts.

The criminal enterprise reportedly operated between October 2023 and March 2025, racking up total thefts exceeding $263 million across multiple incidents. Beyond the headline-grabbing Bitcoin heist, the group allegedly engaged in home burglaries and other crimes.

The FBI arrested Lam on September 18, 2024, roughly a month after the primary theft. According to the case filings, he allegedly threw his phone into Biscayne Bay after learning about his impending arrest.

First-ever Bitcoin RICO case

Federal prosecutors have charged Lam and 17 co-defendants under the Racketeer Influenced and Corrupt Organizations Act, better known as RICO. This marks the first time RICO has been applied to a Bitcoin-related criminal enterprise. The charges include racketeering conspiracy, wire fraud, money laundering, and several other offenses. For Lam, each count carries a potential sentence of up to 20 years in federal prison.

As of mid-2026, nine of Lam’s co-defendants have already pleaded guilty. Evan Tangeman received a 70-month sentence, while Marlon Ferro got 78 months.

Recovery efforts and what’s still missing

Law enforcement has managed to freeze or recover approximately $70 million tied to the scheme. Roughly $193 million remains unaccounted for, as tracing stolen cryptocurrency through layered transactions remains one of the most persistent challenges in digital asset forensics.

The Lam case highlights a vulnerability that no amount of blockchain technology can fix: the human element. Gemini and Google were impersonated in this scheme, not compromised. The platforms themselves weren’t breached; instead, the attackers weaponized their brand credibility to manipulate the victim.

The sentencing outcomes for Lam’s co-defendants, ranging from 70 to 78 months so far, suggest that federal judges are treating crypto theft with the same seriousness as traditional financial crimes. If Lam’s plea deal falls through and he goes to trial, he faces exposure of up to 20 years per count.

Disclosure: This article was edited by Editorial Team. For more information on how we create and review content, see our Editorial Policy.