22-year-old school dropout steals $245 million in Bitcoin by posing as Google and Gemini executives; pleads guilty as stolen fortune funds Ferraris, mansions and a $569,000 night out
A 22-year-old Singaporean man has pleaded guilty to his role in an international cryptocurrency racketeering operation that prosecutors say stole and laundered more than $245 million in digital assets. Malone Lam, an eighth-grade dropout who later lived in Miami, admitted to participating in a RICO conspiracy after investigators linked him to a network that used social engineering to target cryptocurrency holders. In the biggest theft described in the case, Lam and his associates obtained more than 4,100 Bitcoin from a Washington, DC, victim in August 2024 after conspirators posed as representatives of Google and the Gemini cryptocurrency exchange. The stolen fortune was then converted into an extravagant lifestyle involving exotic cars, luxury watches, mansions, private jets and lavish nightclub spending, including one $569,000 night out in Los Angeles.
22-year-old school dropout pleads guilty after $245 million crypto theft
Lam pleaded guilty on September 8, 2026, in US District Court in Washington, DC, to one count of participating in a RICO conspiracy. The US Department of Justice describes him as the ringleader of an international cybercrime enterprise that used social engineering to steal and launder cryptocurrency valued at more than $245 million. The enterprise allegedly operated from at least October 2023 through May 2025 and involved people based in several US states and abroad. Lam, a Singapore citizen and former Miami resident, allegedly used online aliases including “Anne Hathaway”, “$$$” and “King Greavy”. Prosecutors say he organised the social engineering operation, identified potential victims and coordinated the different roles within the network. He is one of 18 defendants charged in the wider case and the 11th to plead guilty. Lam faces a maximum sentence of 20 years on the RICO conspiracy charge, while a status hearing has been scheduled for December 8, 2026.
How the group stole more than 4,100 Bitcoin
The most significant theft in the case occurred on August 18, 2024, when Lam and alleged co-conspirators targeted a cryptocurrency investor in Washington, DC. According to prosecutors, members of the group used social engineering rather than simply breaking into the victim’s cryptocurrency wallet. Two conspirators posed as representatives of Google and the Gemini cryptocurrency exchange and convinced the victim that his accounts were facing security problems. They manipulated him into providing access to his Google Drive and revealing security codes. Those details allowed the conspirators to gain the access needed to transfer more than 4,100 Bitcoin from the victim. The original federal indictment valued the Bitcoin at more than $230 million at the time of the theft. The Justice Department’s current case describes the broader enterprise as having stolen and laundered cryptocurrency worth more than $245 million.The operation was allegedly larger than the single Washington theft. The expanded indictment says members of the enterprise also stole more than $14 million in cryptocurrency from another victim in July 2024. Prosecutors described a division of labour involving database hackers, target identifiers, callers, organisers, money launderers and people allegedly involved in residential burglaries targeting cryptocurrency hardware wallets. The group reportedly developed through friendships formed on online gaming platforms, showing how an online social network evolved into a criminal enterprise targeting wealthy cryptocurrency holders.
Stolen Bitcoin funded Ferraris, mansions and a $569,000 night out
After obtaining the cryptocurrency, Lam and other members of the operation allegedly moved the money through various channels in an effort to conceal its origins before converting portions of it into cash and luxury purchases. The spending was extraordinary. According to AP, Lam purchased more than 30 cars, including custom Porsches, Lamborghinis and Ferraris, and bought a watch worth about $2 million. He and associates also rented mansions in Miami and used stolen cryptocurrency to fund private jets, security personnel, luxury clothing and expensive watches. One of the most striking individual spending figures came from a Los Angeles nightclub, where Lam spent approximately $569,000 during a single evening. The Justice Department says members and associates of the wider conspiracy spent as much as $500,000 per evening on nightclub services and bought exotic vehicles ranging in value from $100,000 to $3.8 million.The wider investigation also uncovered unusual methods allegedly used to move and conceal the proceeds. Prosecutors say members of the enterprise used luxury rental properties, private aircraft and shell companies to disguise ownership of assets. The expanded indictment alleges that some members provided unlicensed cryptocurrency-to-cash services and that bulk cash was even shipped through the US postal system concealed inside Squishmallow stuffed toys. These details come from the indictment and should therefore be treated as allegations against the relevant defendants unless separately established through guilty pleas or convictions.
A month-long spending spree ended with FBI arrests
The extravagant lifestyle did not last long. Lam and alleged co-conspirator Jeandiel Serrano were arrested in September 2024, about a month after the major Bitcoin theft. Investigators were able to trace part of the operation despite attempts to conceal the digital trail. AP reported that Lam was arrested in Miami after an off-duty law enforcement officer allegedly warned him that authorities were coming. Serrano was also arrested after investigators traced cryptocurrency activity to a luxury property in California. The investigation eventually expanded dramatically, with federal prosecutors charging 18 people in connection with the wider enterprise. Three co-conspirators had already been sentenced before Lam’s guilty plea, while other defendants have entered guilty pleas or remain involved in pending proceedings.Lam’s own response during the investigation provided another extraordinary detail. According to AP, investigators recorded him speaking from jail and saying that he and his associates had previously discussed what it would be like if he were arrested but had never expected events to become so serious. At an earlier court appearance, a prosecutor described the scale of the spending, prompting US Magistrate Judge Alicia Valle to compare the case to “Ferris Bueller gone bad”. The comparison referred to the young protagonist of the 1986 film who skips school and embarks on an extravagant day of adventure, although Lam’s alleged activities were far more serious and involved hundreds of millions of dollars in stolen cryptocurrency.
From online gaming friendships to one of America’s biggest crypto thefts
The case illustrates how social engineering can turn personal information into access to enormous cryptocurrency holdings without requiring criminals to physically break into a victim’s home or directly defeat sophisticated blockchain technology. Prosecutors say Lam’s enterprise grew from friendships formed through online gaming platforms and eventually developed specialised roles for finding wealthy targets, contacting them, obtaining sensitive information and laundering the resulting cryptocurrency. The group sometimes allegedly combined digital deception with physical crimes, including home break-ins targeting hardware wallets. Lam’s guilty plea now represents a major development in a federal investigation that prosecutors have described as one of the largest cryptocurrency theft cases in US history. He has admitted to the RICO conspiracy, but the allegations involving other defendants remain subject to the legal process.Lam’s sentencing has not yet taken place. His next status hearing is scheduled for December 8, 2026, and he faces a statutory maximum of 20 years in prison on the RICO conspiracy charge. The case has also resulted in the forfeiture and recovery of luxury assets connected to the operation, adding another chapter to a story that began with online gaming connections and social engineering calls and escalated into a cryptocurrency theft worth hundreds of millions of dollars.
