bitcoin theft

A 22-year-old Singapore citizen has admitted to leading an international theft ring that stole and laundered over $245 million in cryptocurrency, highlighting the persistent vulnerability of high-net-worth crypto holders to social engineering attacks. The case underscores how attackers can drain large holdings without exploiting blockchain technology itself, instead targeting the human operators who control access to private keys.

• Malone Lam pleaded guilty to RICO conspiracy for organizing a network that stole more than 4,100 Bitcoin from a single victim in August 2024.
• The enterprise operated from October 2023 through May 2025 with participants across California, Connecticut, New York, Florida and overseas locations.
• Stolen proceeds financed luxury purchases including private jets, homes in Los Angeles the Hamptons and Miami, and exotic cars valued up to $3.8 million.

• $245M Total cryptocurrency stolen and laundered by the enterprise across all victims
• 4,100 BTC Bitcoin taken from single Washington D.C. victim in August 2024 theft
• $230M Value of the 4,100 Bitcoin when stolen on August 18, 2024
• Oct 2023-May 2025 Operating period for the international theft and money laundering network

Malone Lam, a 22-year-old Singapore citizen, entered a guilty plea on Tuesday in Washington D.C. to leading a racketeering conspiracy that prosecutors say orchestrated the theft and laundering of more than $245 million in cryptocurrency. Lam admitted to organizing an international network that targeted crypto holders through social engineering tactics and, in some cases, in-person break-ins to extract sensitive wallet access information. The plea represents a major development in a case that originated with one of the largest known cryptocurrency thefts from an individual holder.

The arrest of Lam in September 2025 at a rented home in Miami marked the culmination of a multi-month investigation into one of the cryptocurrency industry’s most brazen and sophisticated theft operations. The case has drawn widespread attention from law enforcement, blockchain security researchers, and institutional investors who have grown increasingly concerned about the targeting of high-net-worth cryptocurrency holders by organized criminal groups.

Social Engineering as the Attack Vector, Not Blockchain Weakness

Rather than exploiting vulnerabilities in Bitcoin or other blockchain protocols, Lam’s network focused on compromising the people who controlled access to digital wallets. Prosecutors described conspirators impersonating Google and Gemini support representatives to gain victims’ trust, then obtaining remote access to computers that exposed the private keys controlling cryptocurrency holdings. Once obtained, the group could transfer the funds to accounts under their control.

The approach proved devastatingly effective, demonstrating a persistent gap between the security of blockchain technology itself and the operational security practices of individual holders. Security experts have long warned that while blockchain networks remain resistant to direct attack, the endpoints where users manage their private keys represent a critical vulnerability. Social engineering exploits this weakness by targeting human psychology rather than technical defenses.

A single Washington D.C. victim lost more than 4,100 Bitcoin on August 18, 2024, when the coins were worth more than $230 million. This theft accounted for most of the value in the broader case, though prosecutors’ latest $245 million figure encompasses cryptocurrency stolen across the entire enterprise’s operations. The scale of the loss from a single victim underscores the concentration risk that large crypto holders face and the potential impact when security measures fail.

Lam Coordinated Roles Across a Geographically Dispersed Operation

Lam, who used online aliases including “Anne Hathaway,” “$$$” and “King Greavy,” selected targets and assigned roles to network members operating across California, Connecticut, New York, Florida and internationally. The organization grew from relationships initially formed on online gaming platforms before expanding into a sophisticated operation built around stealing and laundering digital assets. The enterprise operated continuously from at least October 2023 through May 2025.

The network’s structure reflected modern organized crime tactics adapted for cryptocurrency theft. Members were assigned specific roles including identifying and vetting targets, conducting social engineering attacks, managing cryptocurrency transfers through multiple intermediaries, and converting stolen digital assets into physical goods and real estate. This division of labor made the operation more resilient to disruption from law enforcement and harder to trace through traditional investigative techniques.

Lam’s ability to recruit and coordinate operatives across multiple countries and jurisdictions suggests he possessed either significant existing criminal connections or charisma and technical credibility within online communities. The involvement of individuals from multiple US states and overseas locations demonstrates how cryptocurrency theft networks can operate with minimal geographic constraints compared to traditional organized crime enterprises.

After acquiring stolen cryptocurrency, the network routed funds through exchanges, mixing services, peel chains and pass-through wallets while using virtual private networks to obscure participants’ identities. The laundered money was then converted into a portfolio of luxury goods and experiences that became the operation’s signature. Members spent as much as $500,000 during single nightclub evenings, purchased watches valued between $100,000 and over $500,000, and acquired exotic cars worth as much as $3.8 million.

The network also financed private-jet rentals and purchased residential properties in Los Angeles, the Hamptons and Miami, while maintaining private security teams for Lam and other members.

The lavish spending patterns, while providing operational advantages like maintaining appearances of legitimacy and securing accommodations, ultimately created investigative leads for law enforcement. Financial intelligence units at cryptocurrency exchanges and property transfer records helped authorities identify participants and trace the flow of stolen funds through the financial system.

Sentencing Timeline Remains Open as Investigation Continues

Authorities arrested Lam in September 2025 at a rented home in Miami. His guilty plea to the single RICO conspiracy count converts the broader allegations surrounding the organization into a criminal admission, while prosecution of other alleged participants in the enterprise continues.

Under the Racketeer Influenced and Corrupt Organizations Act, prosecutors can now seek enhanced penalties based on Lam’s leadership role in organizing the enterprise. RICO convictions typically result in substantial prison sentences, particularly when they involve sophisticated criminal operations and significant financial losses. The statute allows prosecutors to demonstrate a pattern of racketeering activity through multiple predicate offenses, strengthening their case against other network participants.

US District Judge Colleen Kollar-Kotelly scheduled Lam’s next status hearing for December 8, though this proceeding is not a sentencing hearing, leaving both the timeline and severity of punishment for his conviction unresolved.

The case also implicates Jeandiel Serrano, who prosecutors previously accused of participating in the theft of the 4,100 Bitcoin from the Washington D.C. victim, though the status of charges against Serrano and other network participants remains unclear pending the December 8 hearing and ongoing investigations.