A U.S. federal court has sentenced a California man to 78 months in prison for participating in a social engineering and theft conspiracy that authorities say stole more than $250 million in cryptocurrency. In addition to the prison term, the defendant was ordered to serve three years of supervised release and pay $2.5 million in restitution.
The defendant, Marlon Ferro, a 20-year-old from Santa Ana, California, was identified in court records as using the online alias “GothFerrari.” He previously pleaded guilty in October to conspiracy to participate in a racketeering-influenced and corrupt organization, or RICO. Prosecutors described the broader operation as a coordinated criminal enterprise that targeted cryptocurrency holders across the United States and involved participants in several foreign countries.
A Criminal Network That Moved Beyond Online Fraud
According to prosecutors, the group operated from late 2023 to early 2025 and relied on specialized roles inside the conspiracy. Some members focused on database hacking, others handled money laundering, and others carried out residential burglaries. The structure of the operation illustrates how crypto-related crime can evolve from purely digital deception into physical-world offenses aimed at recovering hardware wallets and private-key access by force.
U.S. Attorney Jeanine Ferris Pirro described Ferro as the “instrument of last resort” for the organization. In practical terms, that meant Ferro was allegedly used when co-conspirators failed to trick victims into surrendering account credentials or could not directly penetrate digital accounts. At that point, investigators say, the group escalated to home break-ins and the theft of hardware wallets.
Two Burglaries Highlight the Tactics
Federal investigators outlined Ferro’s role in two major theft incidents. In February 2024, he broke into a home in Winnsboro, Texas, and stole a hardware wallet containing 100 bitcoin. Court records said the holdings were worth more than $5 million at the time.
In a separate incident in July 2024, Ferro traveled to New Mexico. Investigators said co-conspirators had already compromised a victim’s iCloud account, allowing them to track the victim’s location. Ferro then allegedly used a hidden cellphone to monitor the victim’s movements before smashing a window with a brick and entering the residence in search of hardware wallets. Authorities said the break-in was captured by the home’s surveillance system, giving investigators a direct evidentiary link to the operation.
Money Laundering and Spending of Stolen Funds
Prosecutors said Ferro’s involvement was not limited to burglary. He also allegedly acted as a primary money launderer for the network. Investigators said he used fraudulent identity documents to open digital payment accounts, enabling the group to spend stolen crypto-derived funds at retail stores and nightclubs. That detail underscores a recurring challenge in crypto crime enforcement: the conversion and movement of illicit digital assets into more conventional consumer spending channels.
Court filings further alleged that the conspiracy used stolen funds to support an extravagant lifestyle. Authorities cited spending that included $500,000 nights at nightclubs, private jet travel, exotic cars valued at up to $3.8 million, and luxury handbags distributed as party favors. Prosecutors also said Ferro used illicit proceeds to help pay legal fees for the organization’s leader after an arrest in September 2024.
Arrest and Federal Investigation
Ferro was arrested on May 13, 2025. At the time of his arrest, authorities said he was carrying two firearms and forged identification documents. The case was investigated by the Federal Bureau of Investigation (FBI) and the IRS Criminal Investigation division (IRS-CI) in Washington, with additional support from field offices in Los Angeles and Miami.
The sentencing marks another example of U.S. authorities using racketeering statutes and coordinated federal investigations to pursue complex crypto-related crime. Rather than treating each theft or fraud event as a standalone incident, prosecutors framed the conduct as part of a structured criminal enterprise with distinct operational roles and cross-border reach.
What the Case Signals for Crypto Holders
The case also highlights a growing security concern for cryptocurrency users, especially those who store assets in hardware wallets. While self-custody is often promoted as a defense against exchange failures and online hacks, this prosecution shows that physical possession of a wallet can itself become a risk factor if attackers identify the holder and location. In this case, authorities described a chain that began with digital compromise and ended with real-world burglary.
For law enforcement, the matter appears to remain part of a broader effort to monitor global criminal networks, recover stolen assets, and enforce restitution. For crypto users, it serves as a reminder that operational security now extends beyond passwords and seed phrases to include personal privacy, device protection, and residential security. The theft methods described by prosecutors suggest that, in some cases, attackers are no longer stopping at phishing or account compromise—they are willing to move from screens to streets when large sums are at stake.