Malone Lam, a 22-year-old Singaporean national, pleaded guilty on Sept. 8 in federal district court in Washington, D.C., admitting to one count of RICO conspiracy. Under a sentencing agreement reached by prosecutors and defense lawyers, the advisory guidelines call for a minimum sentence of 14 years, while the statutory maximum is 20 years in prison. The U.S. Attorney’s Office for the District of Columbia announced the plea on its official X account.
The case stems from a social engineering attack on Aug. 18, 2024. According to the report, the victim was a Washington, D.C. resident who had held Bitcoin since 2012 and had not moved the assets for years. The victim received a phone call spoofed to appear as Google support. The caller claimed there had been an unauthorized login attempt on the account, then transferred the call to people posing as customer service staff from Gemini. They persuaded the victim to reset two-factor authentication and move assets from a Gemini account into wallets controlled by the attackers.
The final step involved convincing the victim to share the screen through remote desktop software AnyDesk under the pretext of checking for risk. Prosecutors said the attackers used that access to obtain the private key for the victim’s Bitcoin Core wallet. They then emptied the wallet, which had been dormant for 12 years, stealing all 4,100 BTC. The report said the Bitcoin was worth about $245 million to $263 million at the time of the theft and more than $320 million at current value.
On-chain tracing began the next day
On Aug. 19, 2024, one day after the theft, on-chain investigator ZachXBT received alerts about unusual Bitcoin transfers while preparing to board a flight. A $600,000 transfer hit a little-known exchange, followed by transfers of $1 million and $2 million. Using only his phone before takeoff, he traced the transactions back to a wallet that had been inactive for 12 years and concluded that a theft worth hundreds of millions of dollars was underway.
After in-flight Wi-Fi became available, ZachXBT continued tracking the funds. The report said the attackers rapidly split the 4,100 BTC across more than 10 exchanges, instant swap services and cross-chain bridges, while trying to break the trail with mixers. At the same time, a recording circulated in hacker circles showing members of the group celebrating the theft. In that clip, one participant reportedly spoke the real name of Veer Chetal aloud, while a shared screen also exposed a full name, creating a critical OSINT lead.
ZachXBT followed that lead to personal social media accounts and identified Lam, who had entered the United States on a short-term visa, along with Jeandiel Serrano, known online as Box, and Veer Chetal, known as Wiz. The report said Lam rented a mansion in Miami for tens of thousands of dollars per month and acquired more than 30 supercars. Citing the Associated Press and other outlets, the report added that he once spent as much as $569,000 on champagne at a Los Angeles nightclub in a single night and handed out designer handbags worth tens of thousands of dollars to women in the crowd.
FBI made the arrest within a month
ZachXBT passed along wallet flow charts and suspect identities to law enforcement. On Sept. 18, 2024, exactly one month after the theft, the FBI raided Lam’s Miami mansion and arrested him. The luxury cars in the driveway and high-end goods inside the property later became part of the evidence in the case.
At first, the public saw the matter as a typical case of young hackers using social engineering to drain a crypto whale. The original indictment filed in September 2024 against Lam and Serrano included two more standard charges: conspiracy to commit wire fraud and conspiracy to commit money laundering.
That changed in May 2025, when the U.S. Department of Justice unsealed a superseding indictment that expanded the case from two defendants to 18. It also invoked the Racketeer Influenced and Corrupt Organizations Act, or RICO Act, a law more commonly associated with organized crime and drug trafficking cases. Prosecutors described the defendants as part of a transnational criminal enterprise operating across California, Connecticut, New York, Florida and locations overseas.
Prosecutors said 18 defendants formed a wider criminal network
According to the report, the 18 charged defendants collectively stole and laundered more than $245 million to $263 million in crypto assets through fake customer support schemes, stolen data purchased on the dark web and home invasions. It also said group members carried firearms during at least one home invasion in 2024. As of September 2026, Lam was the 11th defendant among the 18 to plead guilty.
Justice Department filings, as cited in the report, show that the group first connected through gaming forums and later developed into a criminal operation with defined roles. Some members bought breached databases on the dark web and searched for victims with large crypto holdings. Others handled spoofed phone lines and call fraud. Another set of members turned stolen funds into cash through luxury cars, jewelry and other purchases.
The report, citing an Associated Press dispatch and a South China Morning Post account, said Veer Chetal pleaded guilty in November 2024 and agreed to cooperate, a development that weakened Lam’s position. Official Justice Department announcements also show that Marlon Ferro, 20, known as GothFerrari and described as handling home invasion thefts and money laundering, pleaded guilty in October 2025 and was sentenced to 78 months in prison in May 2026. Evan Tangeman, identified in the report as involved in the money-laundering side, pleaded guilty to RICO conspiracy in December 2025 and received a 70-month sentence in April 2026.
Faced with blockchain evidence and statements from cooperating defendants, Lam gave up his defense and signed a plea agreement before a federal judge. As part of that agreement, he agreed to surrender multiple vehicles, including Ferrari, Rolls-Royce, Lamborghini and Mercedes cars, to compensate the victim.
The U.S. Attorney’s Office for the District of Columbia attached photos of the vehicles parked in a private garage and in the driveway of a mansion to the same social media post announcing the plea. The report also noted that Judge Colleen Kollar-Kotelly had already rejected the argument that youth should justify a lighter sentence in proceedings involving other defendants in the case, saying that youth is not a reason for a sentencing reduction. That position is expected to matter in Lam’s case as well.
Recovery has been slow and some assets may be out of reach
Asset recovery has moved slowly over the past two years. According to the report, FBI searches in September 2024 recovered about $37 million in crypto assets from Veer Chetal’s residence and about $20 million from Jeandiel Serrano. Agents also found $500,000 in cash hidden inside a washing machine at the home of another suspect’s parents. Together with more than 30 luxury cars and several watches subject to forfeiture, those assets make up the publicly known recovery list.
In May 2026, Marlon Ferro was ordered to pay $2.5 million in restitution. But prosecutor Christopher Howland said at Lam’s plea hearing that a substantial portion of the funds had already been moved to overseas locations or corners of the blockchain that were beyond the reach of current jurisdiction and could not be traced.
Lam’s status hearing ahead of sentencing is scheduled for Dec. 8, 2026. The case, described in the report as the largest theft involving a single victim in crypto history by amount at issue, has now entered another key phase in federal court. The record laid out in the case points to a simple fact: no smart contract was broken and no cryptographic system failed. The attackers broke the human layer.
