A 22-year-old man has pleaded guilty to helping lead an international cybercrime operation responsible for stealing roughly $245 million in Bitcoin from a single victim — a theft described as one of the largest cryptocurrency heists in US history.

Malone Lam, a Singapore native who lived in Miami, admitted to a federal racketeering conspiracy charge. Prosecutors say Lam and his associates used social engineering, stolen personal data and carefully coordinated impersonation schemes to gain access to victims’ cryptocurrency.

But the size of the theft was only part of what caught investigators’ attention. After obtaining the stolen Bitcoin, members of the group allegedly spent millions on supercars, private jets, luxury homes, designer bags, expensive watches and nightclub parties costing hundreds of thousands of dollars.

Malone Lam Pleads Guilty

Lam pleaded guilty in federal court in Washington, DC, to participating in a racketeering conspiracy tied to a sprawling cryptocurrency theft and money-laundering operation.

The 22-year-old was accused of being one of the organizers of a group prosecutors called the “Social Engineering Enterprise.”

The criminal network operated from approximately October 2023 through at least May 2025 and included members across the United States and overseas.

According to prosecutors, many of the people involved were young men who originally met through online gaming communities before moving into cryptocurrency-related crime.

Lam now faces a maximum sentence of 20 years in federal prison.

 

How the Group Stole More Than 4,100 Bitcoin

The group’s most spectacular theft targeted a cryptocurrency holder in Washington, DC, in August 2024.

Rather than hacking the Bitcoin blockchain itself, the attackers targeted the person controlling the assets.

Members of the group allegedly impersonated representatives from Google and cryptocurrency exchange Gemini. Using social engineering techniques, they convinced the victim to provide information that allowed them to gain access to accounts containing sensitive cryptocurrency data.

The attackers eventually obtained access to more than 4,100 Bitcoin.

At the time of the theft, the cryptocurrency was worth approximately $245 million.

The enormous haul made the incident one of the largest cryptocurrency thefts involving a single victim in US history.

The Operation Was More Organized Than a Typical Online Scam

Federal investigators say the group operated with specialized roles.

Some members allegedly hacked databases to identify wealthy cryptocurrency owners.

Others researched potential victims and collected personal information.

Another group acted as “callers,” impersonating customer support or security representatives to persuade victims to hand over account credentials, authentication codes or other sensitive information.

Once cryptocurrency was stolen, other members helped move and launder the assets.

In some cases, prosecutors say the operation went beyond online deception.

Members allegedly carried out physical burglaries targeting people believed to own large cryptocurrency holdings.

During one incident in New Mexico, a co-defendant allegedly entered a victim’s home and stole a hardware cryptocurrency wallet while Lam monitored the victim’s location through a compromised iCloud account.

A $245 Million Theft Turned Into a Luxury Spending Spree

After obtaining the cryptocurrency, prosecutors say Lam and his associates began spending extraordinary amounts of money.

The stolen assets were converted, transferred and laundered to finance a lifestyle filled with luxury purchases.

Members of the group allegedly spent money on:

• Exotic and luxury cars
• Private jet flights
• High-end rental homes
• Designer clothing and handbags
• Watches worth hundreds of thousands of dollars
• Private security
• Expensive nightclub parties

The group reportedly accumulated a fleet of more than 30 luxury and exotic vehicles.

Some individual cars were worth millions of dollars.

Lam also reportedly purchased expensive watches, including one valued at around $2 million.

More Than $500,000 Spent in a Single Night

The group’s nightclub spending was particularly extravagant.

Prosecutors say members could spend hundreds of thousands of dollars during a single night.

In one instance, Lam allegedly spent approximately $569,000 at a Los Angeles nightclub.

Members of the network also reportedly purchased Hermès Birkin bags worth tens of thousands of dollars and gave them away during parties.

Luxury properties were rented in locations including Miami, Los Angeles and the Hamptons.

The spending provided a striking contrast with how the money had allegedly been obtained: through targeted manipulation of cryptocurrency owners and the theft of their digital assets.

The Group Met Through Online Gaming

One of the more unusual details of the case is how members of the alleged criminal network initially connected.

According to prosecutors, many of them met through online gaming platforms.

Lam reportedly became involved in online gaming communities at a young age before becoming interested in cryptocurrency.

Those online relationships eventually developed into a network capable of identifying wealthy targets, stealing credentials, moving cryptocurrency and laundering enormous amounts of money.

The defendants were also unusually young for an operation involving hundreds of millions of dollars.

Many members were reportedly in their late teens or early twenties.

Investigators Eventually Closed In

The extravagant lifestyle did not last.

Federal investigators began tracing cryptocurrency transactions and examining the network surrounding the stolen assets.

Lam was arrested in September 2024 at a luxury rental property in Miami.

According to court documents, an off-duty law enforcement officer allegedly warned him that authorities were approaching.

Lam reportedly attempted to dispose of evidence by throwing his phone into Biscayne Bay.

Investigators recovered the device.

Another alleged participant, Jeandiel Serrano, was arrested around the same time at Los Angeles International Airport.

The arrests became the beginning of a much broader federal case.

18 People Have Been Charged

The investigation eventually expanded to include 18 defendants.

Federal prosecutors accused members of participating in a racketeering conspiracy involving cryptocurrency theft, fraud, money laundering and other criminal activity.

Lam is the 11th defendant to plead guilty in the broader investigation.

Other participants have also admitted to helping move or launder stolen cryptocurrency.

The use of racketeering charges reflects prosecutors’ argument that the crimes were not isolated scams committed independently by different individuals.

Instead, authorities describe the group as an organized criminal enterprise in which members performed different jobs toward a shared goal.

Social Engineering Was the Real Weapon

Despite the enormous amount of cryptocurrency involved, the case highlights a basic cybersecurity weakness that has existed long before Bitcoin: people can be manipulated.

The attackers did not need to break Bitcoin’s cryptography.

Instead, they allegedly convinced victims to provide access to the accounts and information protecting their assets.

That is the core principle behind social engineering.

An attacker may pretend to be a representative from an exchange, bank, technology company or security department and create a sense of urgency.

Once the victim provides authentication information, recovery credentials or private data, attackers can potentially bypass security systems without technically “hacking” them.

For cryptocurrency owners, the consequences can be especially severe because blockchain transactions are generally irreversible.

Lam Could Face Up to 20 Years in Prison

Lam has not yet been sentenced.

His racketeering conspiracy conviction carries a maximum penalty of 20 years in federal prison.

The guilty plea represents one of the most significant developments in the government’s investigation into the network.

Other defendants still face criminal proceedings as authorities continue unraveling the wider operation and tracing assets connected to the thefts.

For investigators, the case demonstrates that even cryptocurrency moved across multiple wallets and converted through complicated transactions can leave trails.

For crypto holders, it offers a different lesson.

The biggest vulnerability may not always be the blockchain, an exchange or a hardware wallet. Sometimes, attackers simply need to convince the person holding the keys to open the door.