- Trending
- Comments
- Latest
Malone Lam, Singaporean crypto criminal who U.S. prosecutors described as the ringleader of an international cryptocurrency theft and money-laundering network has now admitted his role in one of the largest individual cryptocurrency thefts in U.S. history.
But the most important part of the case is not the $245 million figure.It is how easily a digital crime moved into the physical world.
On September 8, 2026, Lam, a 22-year-old Singaporean citizen and recent Miami resident, pleaded guilty in Washington, D.C, to participating in a RICO conspiracy connected to an international cryptocurrency theft and laundering operation. The U.S. Department of Justice says the wider enterprise stole and laundered more than $245 million.
According to a superseding indictment released in May 2025, the criminal enterprise developed from friendships formed through online gaming platforms. Its members eventually divided themselves into specialists, database hackers, target identifiers, callers, money launderers and residential burglars.
That structure suggests that this was not simply a group of young people who happened to steal some Bitcoin.
It was becoming a business.And the business had a system.
The story goes back at least to October 2023.
According to prosecutors, Lam and other members of the group connected through online gaming platforms. The group then moved beyond gaming and into cryptocurrency theft.
The DOJ says members obtained databases containing cryptocurrency-related information, either by hacking websites and servers or buying databases on the dark web.
They then searched those databases for valuable targets.
The target was not simply someone who owned cryptocurrency.
The target was someone who appeared to own enough cryptocurrency to make the risk worthwhile.
The operation was reportedly built around intelligence first.
Who has money?
Where are they?
What services do they use?
How can they be contacted?
What information might convince them that something is wrong?
Only after those questions were answered did the deception begin.
This is the part of the story that is easy to miss when the case is described simply as a $245 million Bitcoin hack.
There was no need to defeat Bitcoin’s underlying cryptography.
The attackers first tried to convince the owner to open the door.
The most significant theft happened on August 18, 2024.
According to the original federal indictment, Lam, Jeandiel Serrano and others contacted a Washington, D.C., victim and fraudulently obtained more than 4,100 Bitcoin, worth more than $230 million at the time.
The attackers allegedly impersonated employees from trusted technology and cryptocurrency companies.One impersonation involved Google.
Another involved the Gemini cryptocurrency exchange.
The victim was made to believe there was a problem with his accounts and that the people contacting him were trying to protect him.
Instead, they were trying to gain access.
According to prosecutors, the attackers ultimately obtained information that allowed them to reach cryptocurrency stored through the victim’s digital accounts.
The victim did not need to lose his private keys because a hacker mathematically defeated Bitcoin.
He needed to be convinced that the people asking for access were legitimate.
And it remains one of the most dangerous forms of cybercrime because the attacker is not necessarily attacking the technology first.
One of the strangest parts of the story is that the group reportedly behaved like people who had no expectation that anyone was watching.
After obtaining the Bitcoin, members began spending aggressively.
Prosecutors say stolen funds were used for luxury cars, watches, designer handbags, private jets, rental mansions, private security and nightclub entertainment.
At least 28 exotic cars were allegedly connected to the enterprise, with individual vehicles valued at between $100,000 and $3.8 million.
Nightclub spending reportedly reached as much as $500,000 in a single evening.
Lam’s alleged lifestyle became particularly visible.
Investigators and blockchain researchers tracked social-media posts showing luxury cars, watches, private jets and expensive nightlife.
Pseudonymous blockchain investigator ZachXBT played an important early role in tracing the stolen funds and identifying the suspects .
WIRED reported in 2024 that ZachXBT followed the money while also examining the suspects’ social-media activity. His investigation linked the suspected thieves to luxury vehicles, private jets, expensive watches and gifts of Hermès handbags.
That created an unusual contradiction.
The blockchain was designed to provide a permanent record of transactions.
The criminals were simultaneously creating a public record of their lifestyle.
They were laundering the money digitally while advertising the proceeds socially.
There is a common misconception that cryptocurrency allows criminals to disappear completely.
It does not.
Bitcoin transactions are pseudonymous rather than automatically anonymous.
The blockchain does not necessarily tell investigators who controls an address.
But once investigators connect an address to a person, exchange account, device, IP address or other piece of evidence, historical transactions can become extremely useful.
That appears to have happened here.
According to prosecutors, Serrano failed to conceal his IP address when he created an account on a cryptocurrency exchange holding nearly $30 million in stolen funds.
Investigators reportedly connected that IP address to a California residence he was renting for approximately $47,500 per month.
The digital trail eventually became a physical trail.
This is where the case becomes much more serious.
The enterprise did not rely exclusively on telephone deception.
When digital methods were not enough, prosecutors say members turned to physical burglary.
The May 2025 superseding indictment specifically describes residential burglars being used to target hardware cryptocurrency wallets.
One example involved Marlon Ferro.
Prosecutors said Ferro travelled to Texas in February 2024 and stole a hardware wallet containing approximately 100 Bitcoin, worth more than $5 million at the time.
Later, in July 2024, he travelled to New Mexico after members of the group believed another victim possessed about $30 million in cryptocurrency in a hardware wallet.
According to prosecutors, Lam monitored the victim’s location through an iCloud account while Ferro watched the house.
Ferro eventually broke into the residence through a window.
He did not find the hardware wallet.
The victim’s surveillance cameras reportedly captured the burglary.
This is the moment the phrase crypto hack stops being sufficient.
The crime had become a hybrid operation.
Online intelligence identified the target, social engineering obtained information, blockchain transactions moved the money and physical criminals were sent to houses when digital access was insufficient.
The stolen Bitcoin did not only produce luxury spending.
It appears to have attracted other criminals.
Approximately one week after the $245 million theft, Veer Chetal’s parents were attacked and briefly kidnapped in Connecticut.
Chetal was one of the young men who pleaded guilty in connection with the cryptocurrency theft.
According to prosecutors and subsequent reporting, the kidnappers believed the family had access to cryptocurrency and attempted to use the family to obtain money.
The kidnapping failed after police were alerted and the suspects were arrested.
The episode is important because it demonstrates a dangerous second-order effect of crypto crime.
Once criminals believe someone possesses enormous amounts of easily transferable wealth, that person can become a target even without being involved in the original crime.
In other words, cryptocurrency theft can create more cryptocurrency crime.
The original victim is targeted.
The thieves become targets.
Their families can become targets.
And people around them can become targets.
AP has documented the connection between the $245 million theft and the attempted kidnapping, while subsequent reporting has connected the episode to a broader network of crypto-related violence.
The spending spree may look like an irrelevant detail.
It is not.
It may have helped investigators understand the organisation.
The DOJ says members spent stolen cryptocurrency on nightclub services costing up to $500,000 per night, luxury watches worth as much as more than $500,000, private jets, expensive rental properties and exotic vehicles.
That level of spending creates problems for criminals trying to remain invisible.
A stolen Bitcoin transaction may not immediately identify the person controlling the funds.
A $3.8 million car is different.
So is a multimillion-dollar watch.
So is a luxury mansion.
So is a nightclub bill approaching half a million dollars.
Every purchase creates another potential witness, record, camera, employee, receipt, registration document or financial trail.
The more aggressively stolen money is spent, the more difficult it becomes to keep the criminal identity separate from the money.
This may explain one of the central ironies of the case.
The criminals were sophisticated enough to move cryptocurrency through mixers, exchanges, pass-through wallets and peel chains designed to obscure the movement of funds.
But they were apparently less disciplined about hiding how they lived.
The technology was being used to disappear.
The lifestyle was being used to announce their presence.
The money did not simply remain in one Bitcoin address.
According to the 2024 indictment, the conspirators moved stolen cryptocurrency through exchanges and mixing services.
They allegedly used pass-through wallets, VPNs and peel chains to make tracing more difficult.
The later indictment describes an even larger laundering infrastructure.
Some members allegedly converted cryptocurrency into U.S. dollars through unlicensed crypto-to-cash services.
Others allegedly arranged luxury rental properties using false identities, booked private jets with stolen cryptocurrency and concealed ownership of exotic cars through shell companies.
The indictment even alleges that bulk cash was mailed to members hidden inside Squishmallows.
That detail sounds almost absurd.
But it illustrates an important point.
Modern cryptocurrency crime does not necessarily stop at cryptocurrency.
Criminals still need to convert digital wealth into cars, property, travel, cash and physical goods.
The blockchain may be digital.
The consequences are not.
This matters because much of the story has circulated online through dramatic descriptions of the suspects.
Lam has pleaded guilty.
That changes the legal position substantially.
The DOJ says he admitted participating in the RICO conspiracy and identified him as the organiser who selected targets and coordinated the roles of other participants.
But not every allegation surrounding every person in the wider enterprise has been proven.
The May 2025 indictment charged 12 additional people and described a broader enterprise that prosecutors said stole more than $263 million.
An indictment, however, is an allegation.
The DOJ itself states that defendants are presumed innocent unless proven guilty beyond a reasonable doubt.
That distinction is especially important when discussing people who have not pleaded guilty.
The evidence against Lam is no longer simply an accusation because he has entered a guilty plea.
The same standard cannot automatically be applied to every person named in the wider case.
There is another detail worth understanding.
The headline theft is commonly described as approximately $245 million.
But the broader RICO case was later described by prosecutors as involving more than $263 million in cryptocurrency thefts.
That is not necessarily a contradiction.
The $245 million figure relates primarily to the enormous August 2024 theft and the value associated with the enterprise.
The $263 million figure represents the wider alleged criminal operation, including other cryptocurrency thefts.
The DOJ says the enterprise was responsible for multiple thefts and that one July 2024 incident involved more than $14 million in additional cryptocurrency.
This also matter because describing the entire organisation as having stolen exactly $245 million would understate the broader case.
The original investigation became public in September 2024.
At that point, Lam and Serrano were charged over the theft of more than $230 million in cryptocurrency.
The indictment said they were arrested on September 18, 2024, after investigators connected them to the operation.
The investigation did not end there.
By May 2025, prosecutors had expanded the case to include additional defendants, alleged burglaries, money laundering infrastructure and other cryptocurrency thefts.
By September 2026, Lam had pleaded guilty.
The progression tells its own story.
What initially looked like a two-person crypto theft developed into the alleged existence of a distributed criminal organisation.
Perhaps the most revealing part of the case is where the relationships reportedly began.
Online gaming platforms.
The DOJ says the enterprise grew from friendships developed through online gaming.
This does not mean online gaming causes cybercrime.
That would be an unjustified conclusion.
Millions of people use gaming platforms every day without becoming criminals.
The more relevant issue is that online communities can allow people with technical interests, money-making ambitions and criminal intentions to meet outside traditional criminal networks.
The old model of organised crime required physical proximity.
The newer model can begin with people who have never met.
They can develop trust online.
They can exchange technical skills.
They can recruit specialists.
They can divide tasks.
And they can operate across different states and countries.
Public reaction has focused heavily on the absurdity of the spending.
On Reddit, one highly upvoted discussion questioned how someone could spend half a million dollars in a nightclub in one night. Another commenter focused on the more important issue, that the theft reportedly depended on social engineering rather than a sophisticated attack against Bitcoin itself.
Another Reddit discussion described the case as a reminder that one of the biggest Bitcoin thefts could be carried out by convincing a human being to hand over access rather than breaking cryptography.
The strongest criticism coming from the public is actually split between two camps.
One side asks:
How could anyone hold hundreds of millions of dollars in cryptocurrency in a way that could be reached through a compromised online account?
The other asks:
Why blame the victim when professional impersonators deliberately created a false emergency designed to manipulate him?
Both questions are legitimate.
The first is a security question and the second is a human-behaviour question.
And the answer to the case requires both.
This is one of the easiest questions to ask and one of the least useful questions to stop at.
Holding large cryptocurrency balances obviously requires extraordinary security precautions.
But sophisticated social engineering is specifically designed to make sensible people behave differently from how they normally would.
The attackers reportedly did not simply call and say:
“Give us your Bitcoin.”
They created a narrative involving account compromise and technical support which is psychologically different.
The victim is no longer thinking about whether to give away money.
He is thinking about how to prevent someone else from stealing it.
That reversal is the foundation of social engineering.
The attacker does not necessarily need the victim to trust the attacker.
The attacker only needs the victim to fear the alternative.
The FBI’s latest data shows why this matters beyond one wealthy crypto investor.
In 2025, Americans filed 181,565 complaints involving cryptocurrency and reported more than $11 billion in losses.
The FBI said cryptocurrency-related complaints produced the highest reported losses among the categories tracked in its 2025 Internet Crime Report.
The same report recorded nearly 21 billion dollars in total reported cyber-enabled losses.
It also warned that scammers are increasingly using fake profiles, voice cloning, fake identification documents and believable videos to manipulate victims.
The technology is therefore getting better at producing something criminals have always needed:
credibility.
That is why the Lam case should not be treated as an isolated Bitcoin story.
The same psychological techniques can be used against bank accounts, investment accounts, corporate systems and cryptocurrency wallets.
Crypto simply provides an unusually attractive target because large amounts of value can move quickly once access is obtained.
There is another trend surrounding the case.
Crypto crime is increasingly moving from the screen to the street.
A 2025 investigation by The Guardian documented a growing number of physical attacks against cryptocurrency holders, including kidnappings, assaults and extortion attempts. The report cited more than 231 physical attacks recorded against people connected to crypto since the beginning of 2024.
The Lam enterprise fits into that broader development.
First, criminals identify wealth online.
Then they identify the person behind the wealth.
Then they determine whether digital access is possible.
If not, physical access becomes an option.
That creates a new security problem for wealthy cryptocurrency holders.
A hardware wallet may protect private keys from remote hackers.
It does not necessarily protect the person holding the hardware wallet from someone who knows where they live.
Hardware wallets remain an important security measure.
The lesson from this case is not that hardware wallets are useless. It is that hardware security is only one layer.
If a criminal can manipulate a victim into revealing a recovery phrase, approving a malicious transaction, exposing a device or revealing where a wallet is stored, the hardware itself cannot solve the entire problem.
And if criminals already know that a person owns millions of dollars in cryptocurrency, the security problem may become physical.
That is why crypto security increasingly needs to include operational security.
Not just:
Where is the private key?
But:
Who knows I have the assets?
Who knows where I live?
Who can identify my wallet?
Who can impersonate my exchange?
Who can contact my family?
Who has access to my cloud accounts?
What happens if my phone is compromised?
What happens if I am physically threatened?
Partly, perhaps.
It would be too simplistic to say the suspects were caught because they bought expensive cars.
Investigators used multiple sources of evidence.
Blockchain tracing.
IP information.
Exchange records.
Social-media activity.
Physical surveillance.
Traditional law enforcement.
And information from cooperating defendants.
But the spending created an additional trail.That is one of the most important lessons from the case.
Money laundering is not the same thing as making money disappear.
It is an attempt to make the origin of money difficult to understand.
Yes.
The underlying conditions have not disappeared.
Large amounts of cryptocurrency remain concentrated among wealthy individuals.
Social engineering remains effective and personal information is widely available.
Data breaches continue to expose information about high-net-worth individuals.
Criminal groups increasingly specialise.
And cryptocurrency can move across borders faster than traditional investigations can sometimes follow.
The FBI’s 2025 figures show that cryptocurrency-related losses remain enormous, while the agency is also warning about increasingly convincing impersonation techniques.
The risk therefore is not simply another Malone Lam.The risk is that the organisational model survives.
The organisation does not need everyone to understand cryptocurrency.
It only needs each to understand his part.
The $245 million theft is often presented as a story about young criminals living like billionaires which is the entertaining version.
The people behind the operation allegedly built a pipeline.
Information came in, targets were selected, trust was manipulated, access was obtained, cryptocurrency was transferred, funds were fragmented and laundered, cash and luxury goods came out.
And when digital access failed, people were allegedly sent to physical addresses.
That is not simply a hack.
It is an organised crime model adapted to the digital economy.
Crypto security has traditionally focused heavily on protecting keys.And that is still necessary.
But the Lam case shows why protecting the key is only part of the problem.
The attacker may never need the key if they can convince the owner to expose it.
They may never need to hack the wallet if they can manipulate the person controlling it.
They may never need to attack the blockchain if they can attack the infrastructure around the person.
And they may not even need digital access if they know where the hardware wallet is kept.
That changes the security equation.
The strongest wallet in the world cannot compensate for a compromised identity.
The strongest encryption cannot compensate for a convincing impersonator.
And the strongest digital security cannot completely protect someone whose physical location and wealth have become public.
First, treat unsolicited technical support calls as hostile until independently verified.
Do not verify the caller using a phone number, link or contact information provided by the caller.
Use an independently obtained official contact channel.
Second, never allow an unexpected caller to guide you through security settings while you are logged into an account containing valuable assets.
Third, separate valuable cryptocurrency holdings from everyday online activity wherever possible.
Fourth, reduce the amount of information publicly connecting your identity, home, family and cryptocurrency holdings.
Fifth, secure the accounts surrounding the wallet, not only the wallet itself.
A highly protected Bitcoin wallet can still be exposed through email, cloud storage, social media, phone accounts or other connected systems.
Finally, consider physical security.
For someone holding life-changing amounts of cryptocurrency, the question should not only be whether an attacker can steal the coins remotely.
It should also be whether an attacker can identify the person who owns them.
Malone Lam has pleaded guilty.
The legal process will continue, and other defendants in the wider case will have their allegations tested individually.
But the larger problem will not disappear with a prison sentence.
The crypto industry has spent years asking how to stop hackers from stealing private keys.
The Lam case asks a different question.
What happens when criminals realise they do not need to hack the key?
What happens when they can hack trust instead?
That is where this $245 million story becomes bigger than Malone Lam.
It is a warning that the security perimeter around digital wealth is no longer just a wallet, an exchange or a private key.
It is the human being.
And once criminals know where the money is, the distance between a phone call and a front door may be much shorter than the crypto industry wants to believe.
Copyright © 2025 - The Bit Gazette.
