Alleged $240 million Bitcoin theft ringleader Malone Lam set for guilty plea

At the center of the case is 22-year-old Malone Lam, whom US prosecutors describe as an alleged ringleader. Lam, an eighth-grade dropout from Singapore, is scheduled for a plea agreement hearing Tuesday. Prosecutors say he and associates used social engineering to gain access to the victim’s accounts and drain more than 4,100 bitcoin.

The case has also become a window into a wider cybercrime problem. FBI complaints involving cryptocurrency investment fraud increased by nearly 50% in 2025, according to the story, as young offenders continue to exploit digital assets and the anonymity they can provide.

How the crypto scammer network targeted a wealthy investor

The operation began on Aug. 18, 2024, when a man identified in court filings as “Victim 7” was at his home in Washington. He received a call from someone claiming to represent Google and asking about attempted breaches of his account.

A second caller, allegedly posing as an employee of the Gemini cryptocurrency exchange, warned him about malware affecting his crypto wallet. Prosecutors say the callers manipulated him into providing access to his Google Drive and revealing security codes.

That information allegedly enabled Lam, Veer Chetal and Jeandiel Serrano to take more than 4,100 bitcoin. Prosecutors say the trio selected the victim because he was a wealthy, longtime cryptocurrency investor.

The stolen cryptocurrency was then moved through multiple exchange platforms and converted into government-issued currency, with money laundering specialists allegedly helping conceal the proceeds.

Prosecutors say the group had already carried out other multimillion-dollar thefts since late 2023 after meeting through online gaming forums.

The operation was therefore not presented by investigators as an isolated incident. Instead, prosecutors say the August 2024 theft followed a pattern in which the young men targeted cryptocurrency holders and used social engineering to gain access to their digital assets.

The crypto scammer spending spree

The scale of the spending quickly attracted attention. Authorities say Lam and his associates spent millions of dollars at nightclubs, rented expensive properties in Miami and the Hamptons, traveled on private jets and hired security guards.

Lam allegedly spent more than $569,000 at a Los Angeles nightclub in a single evening. Over one month, he and his friends reportedly spent about $4 million at nightclubs.

The alleged crypto scammer also used stolen funds to purchase a $2 million watch and more than 30 vehicles, including customized Porsches, Lamborghinis and Ferraris. Chetal, meanwhile, allegedly gave his parents a Lamborghini and concealed a duffel bag containing $500,000 in cash inside their laundry machine.

“This luxury lifestyle, of which so many young men and women could only dream, was just built on a foundation of fraud,” prosecutor William Hart said during a recent sentencing hearing for a money laundering co-defendant.

The sudden wealth also brought danger.

A week after the theft, masked men from Miami allegedly abducted Chetal’s parents in Danbury, Connecticut, beating his father with a baseball bat and attempting to use the couple as leverage to extort Chetal for his share of the stolen cryptocurrency.

The ransom plot collapsed after witnesses alerted police, allowing authorities to apprehend the alleged kidnappers.

The FBI later searched Chetal’s apartment in Brunswick, New Jersey, on Sept. 9, 2024. Investigators found approximately $37 million in stolen cryptocurrency in his possession, according to the story, after which Chetal agreed to cooperate with the investigation.

The crypto scammer investigation unravels

The investigation gained a major breakthrough after Serrano allegedly failed to conceal his IP address while creating a cryptocurrency exchange account holding nearly $30 million in stolen assets.

Investigators traced the address to a home in Encino, California, which Serrano was renting for $47,500 a month.

Serrano was in the Maldives when investigators identified him as a suspect. He was later arrested at Los Angeles International Airport on Sept. 18, 2024, wearing a watch valued at about $500,000. Prosecutors said he initially denied wrongdoing but later admitted possessing roughly $20 million of the victim’s stolen cryptocurrency.

The FBI also arrested Lam that day at one of his Miami mansions. According to the indictment, an off-duty law enforcement officer had warned him that authorities were coming.

Lam’s arrest did not immediately bring an end to the spending associated with the stolen funds. Another defendant, Ferro, who later pleaded guilty to a racketeering conspiracy charge, used stolen funds to cover Lam’s legal expenses.

U.S. Magistrate Alicia Valle was struck by the scale of Lam’s spending when prosecutors outlined the case during his initial court appearance in Miami.

“I could only think of Ferris Bueller gone bad,” Valle said.

The comparison highlighted the extraordinary lifestyle described by prosecutors: expensive cars, luxury watches, high-end properties, private travel and enormous nightclub bills, all allegedly financed by cryptocurrency obtained through fraud.

What happens next for the crypto scammer defendants

The investigation eventually produced charges against 18 defendants. Lam would become the 11th to plead guilty if his agreement proceeds. Prosecutors previously estimated that his sentencing guidelines would recommend at least 14 years in prison upon conviction.

U.S. District Judge Colleen Kollar-Kotelly, who presides over Lam’s case, has already sentenced three co-conspirators, including two money launderers who received prison terms of approximately six years.

Chetal pleaded guilty to conspiracy charges in November 2024 and is awaiting sentencing, while Serrano’s charges remain pending.

Tucker Desmond, who pleaded guilty to destroying evidence connected to other plotters’ crimes, received probation. Ferro pleaded guilty to racketeering conspiracy and declined to address the court during his May sentencing hearing.

Ferro’s attorney, Kevin Wilson, described the co-defendants as mischievous “young kids,” but Kollar-Kotelly rejected youth as a sufficient explanation for their conduct.

“Being young only goes so far,” Kollar-Kotelly said.

The prosecution of the alleged crypto scammer network comes as cybersecurity researcher Allison Nixon calls for greater law enforcement resources to pursue young hackers involved in cryptocurrency fraud.

Nixon has spent years tracking The Com, an underground subculture of young hackers associated with cryptocurrency fraud and other cybercrime. She has warned that the profitability of these schemes could encourage more young people to enter the field if authorities fail to respond quickly.

“If we don’t seriously ramp up the resources to take these people down and do it faster, then it’s going to spread more and more,” Nixon said.

The case illustrates how a single social-engineering attack can develop into a sprawling criminal investigation, exposing not only the methods allegedly used to steal cryptocurrency but also the conspicuous spending, criminal rivalries and law enforcement trail that followed the $240 million theft.