Who Is Malone Lam? $245 Million Bitcoin RICO Conspiracy Case Explained

Malone Lam is a 22-year-old Singaporean who pleaded guilty on September 8, 2026, to participating in a federal RICO conspiracy that prosecutors say operated an international cryptocurrency theft and money-laundering enterprise. Federal authorities say Lam organized a network that used social engineering, stolen databases and, in some cases, residential burglaries to steal cryptocurrency from wealthy targets. The most spectacular theft involved more than 4,100 Bitcoin taken from a Washington, D.C., resident in August 2024.

Malone Lam Pleads Guilty

Lam Pleaded Guilty To A RICO Conspiracy Charge. Lam appeared before U.S. District Judge Colleen Kollar-Kotelly in Washington, D.C., on September 8, 2026, and pleaded guilty to one count of participating in a racketeering conspiracy. The Justice Department described him as a ringleader of the international cybercrime organization. [DOJ]

Lam Admitted Organizing The Cryptocurrency Theft Enterprise. Prosecutors said Lam organized social-engineering operations, selected targets and coordinated different roles performed by members of the network. [DOJ]

Lam Faces Up To 20 Years In Federal Prison. The RICO conspiracy charge carries a maximum sentence of 20 years in prison. Judge Kollar-Kotelly did not immediately impose a sentence, and another court hearing was scheduled for December 8, 2026. [AP] [DOJ]

Lam Became The Eleventh Defendant To Plead Guilty. Federal prosecutors have charged 18 people in the broader cryptocurrency racketeering case. Lam became the eleventh defendant to enter a guilty plea. [AP]

What Was The Malone Lam RICO Conspiracy?

The Enterprise Grew Out Of Online Gaming Connections. Federal prosecutors say members of the group developed relationships through online gaming platforms. The criminal enterprise began no later than October 2023 and continued through at least May 2025. [DOJ]

Members Of The Group Had Specialized Jobs. According to federal prosecutors, participants served as database hackers, target researchers, organizers, callers, money launderers and burglars who targeted physical cryptocurrency wallets. [DOJ]

Hackers Obtained Information About Cryptocurrency Owners. Prosecutors alleged that members hacked websites and servers or purchased cryptocurrency-related databases on the dark web. Other participants analyzed the information to identify people believed to possess large amounts of cryptocurrency. [DOJ]

Callers Used Social Engineering Against Victims. Members allegedly contacted targets using spoofed telephone numbers and impersonated representatives of technology companies and cryptocurrency platforms. The goal was to persuade victims to provide information or access that could be used to take control of their cryptocurrency. [DOJ]

$245 Million Bitcoin Theft

The Largest Known Theft Happened On August 18, 2024. Lam and other members of the group targeted a Washington, D.C., resident who possessed a large amount of Bitcoin. Prosecutors say the conspirators ultimately obtained more than 4,100 Bitcoin from the victim. [AP]

Conspirators Posed As Google And Gemini Representatives. According to prosecutors, conspirators impersonated representatives of Google and the Gemini cryptocurrency exchange. They manipulated the victim into granting access to his Google Drive account and providing security information. [AP]

The Group Stole More Than 4,100 Bitcoin. Authorities said the information obtained from the victim allowed conspirators to transfer more than 4,100 Bitcoin out of his control. Prosecutors later valued the cryptocurrency at more than $245 million at the time of the theft. [DOJ] [AP]

Earlier Federal Filings Used A Lower Dollar Figure. The original September 2024 indictment valued the more than 4,100 Bitcoin at over $230 million. Later Justice Department announcements used higher valuations for the same quantity of cryptocurrency. [DOJ] [DOJ]

Other Cryptocurrency Thefts

The Washington Bitcoin Theft Was Not The Only Alleged Operation. The superseding indictment expanded the case beyond the August 2024 attack and accused the enterprise of stealing cryptocurrency from multiple victims around the United States. [DOJ]

Lam And Others Were Linked To A $14 Million Theft In July 2024. Federal prosecutors identified another cryptocurrency theft involving Lam and other members of the organization approximately one month before the Washington attack. [DOJ]

Home Break-Ins And Hardware Wallets

The Enterprise Allegedly Used Burglary When Online Deception Was Not Enough. Prosecutors say members of the organization sometimes targeted victims’ homes in an effort to physically obtain hardware cryptocurrency wallets. [DOJ]

Marlon Ferro Broke Into A New Mexico Home. Prosecutors said Ferro, who used the name “GothFerrari,” traveled to New Mexico in July 2024 and entered a victim’s home in an attempt to obtain a cryptocurrency hardware wallet. Ferro later pleaded guilty and was sentenced to 78 months in federal prison. [DOJ]

Prosecutors Say Lam Helped Track The Victim. The superseding indictment alleged that Lam monitored the New Mexico victim’s whereabouts by accessing the victim’s iCloud account while Ferro carried out the burglary. [DOJ]

How The Stolen Cryptocurrency Was Laundered

The Group Used Cryptocurrency Mixers And Chains Of Wallets. Federal prosecutors said stolen cryptocurrency was moved through exchanges and mixing services using techniques including peel chains, pass-through wallets and virtual private networks designed to obscure who controlled the funds. [DOJ]

Other Members Converted Cryptocurrency Into Cash. Money launderers working with the enterprise converted stolen digital assets into U.S. dollars through cash transactions and wire transfers. [DOJ]

Shell Companies Were Used To Disguise Transactions. Kunal Mehta, one of the group’s money launderers, admitted creating shell companies and using their bank accounts to move money while making transactions appear legitimate. Prosecutors said Mehta generally charged a 10% fee for his services. [DOJ]

Cash Was Shipped Inside Stuffed Animals. The superseding indictment accused members of mailing bulk cash concealed inside Squishmallow stuffed toys as part of the laundering network. [DOJ]

Malone Lam Spending Spree

Lam Spent Millions Of Dollars After The Bitcoin Theft. Prosecutors said stolen cryptocurrency financed luxury homes, private jets, expensive watches, designer clothing and extraordinarily expensive nights at clubs. [DOJ]

Lam Spent $569,000 In A Single Night At A Los Angeles Club. AP reported that Lam spent $569,000 during one night out and millions of dollars at nightclubs overall. [AP]

He Bought More Than 30 Luxury Cars. Authorities said Lam’s purchases included more than 30 vehicles, among them customized Porsches, Lamborghinis and Ferraris. [AP]

One Watch Cost Approximately $2 Million. Federal authorities identified a watch worth roughly $2 million among Lam’s luxury purchases. [AP]

The Broader Enterprise Accumulated A Fleet Of Exotic Cars. Prosecutors said members and associates possessed at least 28 exotic vehicles valued between approximately $100,000 and $3.8 million each. They also rented luxury properties in Miami, Los Angeles and the Hamptons. [DOJ]

Malone Lam Arrest

The FBI Arrested Lam In Miami In September 2024. Federal agents arrested Lam on September 18, 2024, shortly before prosecutors unsealed the original indictment accusing him and Jeandiel Serrano of wire-fraud and money-laundering conspiracies. [DOJ]

An Off-Duty Law-Enforcement Officer Allegedly Warned Lam About His Arrest. According to allegations in the broader case, Lam received advance warning that authorities were coming to arrest him. [AP]

Alleged Activity After Lam’s Arrest

Prosecutors Accused Lam Of Continuing To Direct Associates From Jail. The superseding indictment alleged that after his arrest Lam continued communicating instructions to members of the enterprise and arranging for stolen cryptocurrency to be collected. [DOJ]

Associates Allegedly Bought Hermès Birkin Bags For Lam’s Girlfriend. Prosecutors alleged that Lam instructed enterprise members to purchase luxury Birkin bags and have them delivered to his girlfriend in Miami while he was detained. [DOJ]

Other Members Tried To Destroy Evidence After His Arrest. Prosecutors said Evan Tangeman accessed security systems to photograph FBI agents searching residences before directing another member to retrieve and destroy digital devices. Tangeman later pleaded guilty and was sentenced to 70 months in prison. [DOJ] [DOJ]

Why Is This A RICO Case?

RICO Allows Prosecutors To Treat The Group As A Criminal Enterprise. The federal Racketeer Influenced and Corrupt Organizations Act makes it illegal to participate in or conspire to participate in an enterprise through a pattern of racketeering activity. Lam pleaded guilty under the RICO conspiracy provision, 18 U.S.C. § 1962(d). [Federal Law]

The Government Connected Multiple Types Of Crimes Into One Enterprise. Rather than treating each cryptocurrency theft as an isolated fraud, prosecutors tied together social-engineering attacks, stolen databases, money laundering, burglaries and other alleged conduct involving participants with specialized roles. [DOJ]

Who Is Malone Lam?

Lam Is A Citizen Of Singapore. He was 20 years old when the federal case against him was first unsealed in September 2024 and is now 22. Prosecutors have described him as a recent resident of Miami who had also lived in Los Angeles. [DOJ] [DOJ]

Lam Used Several Online Aliases. Federal records have identified aliases including “Anne Hathaway,” “$$$,” “King Greavy,” “7” and “Kg.” [DOJ]

Lam Left School At A Young Age. AP reported during coverage of his guilty plea that Lam was an eighth-grade dropout who came to the United States from Singapore. [AP]

Other Defendants And Guilty Pleas

The Federal Case Expanded To 18 Defendants. What began in September 2024 as a case against Lam and Jeandiel Serrano expanded through superseding indictments into a broad RICO prosecution involving alleged hackers, callers, organizers, burglars and money launderers. [AP] [DOJ]

Several Members Have Already Received Prison Sentences. Evan Tangeman was sentenced to 70 months in prison for laundering millions of dollars for the group, while Marlon Ferro received 78 months and was ordered to pay $2.5 million in restitution for his role in the enterprise. [DOJ] [DOJ]

Lam’s Guilty Plea Marked A Major Development In The Prosecution. As one of the people prosecutors identified as an organizer and ringleader, Lam’s September 8, 2026 guilty plea represented one of the most significant developments in the federal case. [DOJ] [AP]