Malone Lam, the alleged ringleader of a group accused of stealing more than $240 million in Bitcoin from a Washington, D.C., investor, has been set for a plea agreement hearing after 10 other defendants admitted guilt in the sprawling crypto theft case.
Summary
- Malone Lam is set for a plea agreement hearing over the theft of more than 4,100 Bitcoin worth over $240 million from a Washington investor.
- Prosecutors said Lam and his associates used social engineering to obtain account access and security codes before moving the stolen crypto through multiple platforms.
- The group spent millions on luxury cars, private jets, mansions, watches and nightclubs before FBI arrests began in September 2024.
- Eighteen defendants have been charged in the case, with Lam set to become the 11th to plead guilty and potentially facing at least 14 years in prison.
The Associated Press reported that the 22-year-old Singaporean is scheduled to appear in court Tuesday, nearly two years after prosecutors accused him and his associates of using social engineering to steal more than 4,100 Bitcoin from a longtime crypto investor in August 2024.
Eighteen defendants have been charged in the case, with Lam set to become the 11th to plead guilty. A prosecutor estimated during his first court appearance that federal sentencing guidelines could recommend at least 14 years in prison if he is convicted.
Lam was arrested in September 2024 after investigators traced a month-long spending spree involving luxury cars, private jets, expensive watches, mansions and millions of dollars spent at nightclubs.
Malone Lam case began with a $240 million Bitcoin theft
The case centers on an Aug. 18, 2024, attack against a Washington resident identified in court filings as “Victim 7.”
Prosecutors said the group targeted the man because he was a wealthy, longtime cryptocurrency investor. One caller posed as a Google representative and asked about supposed attempts to compromise the victim’s account. Another pretended to work for crypto exchange Gemini and warned that malware had affected his wallet.
The callers persuaded the victim to give them access to his Google Drive and disclose security codes, allowing the group to take control of more than 4,100 BTC.
Crypto.news previously reported in September 2024 that Lam, Veer Chetal and Jeandiel Serrano were linked to the roughly $243 million social engineering attack. Blockchain investigator ZachXBT helped trace the theft and published material tied to the group.
A private recording captured the suspects reacting after gaining control of the Bitcoin, according to the AP. One voice could be heard saying, “Oh, my God! Bro, bro, I’m going to spaz out!”
The stolen cryptocurrency was subsequently moved through multiple exchange platforms as money launderers worked to convert parts of the proceeds into fiat currency, prosecutors said.
Investigators alleged that the August theft was not the group’s first operation. Lam and his associates, who had met through online gaming communities, had worked together on other multimillion-dollar thefts since late 2023 using similar social engineering methods.
Such attacks have remained a major source of cryptocurrency losses. In January 2026, a crypto holder lost more than $282 million in Bitcoin and Litecoin after being deceived in another social engineering scheme involving a hardware wallet. ZachXBT said the stolen assets were moved through instant exchanges and converted into Monero.
Investigators traced the group through an IP address
One operational mistake helped investigators identify the people behind the 2024 theft.
Prosecutors said Serrano created an account on a cryptocurrency exchange to hold nearly $30 million in stolen assets but failed to conceal his internet protocol address. Investigators traced it to a home in Encino, California, that he was renting for $47,500 per month.
By then, members of the group had started spending their proceeds.
Serrano was vacationing in the Maldives when investigators identified him as a suspect, while Lam and his associates spent $4 million at Los Angeles nightclubs within a month, according to authorities.
Lam alone spent more than $569,000 during one night at a Los Angeles club. The FBI said he used stolen cryptocurrency to buy a $2 million watch and more than 30 vehicles, including customized Porsches, Lamborghinis and Ferraris.
Chetal bought his parents a Lamborghini and kept $500,000 in cash inside a duffel bag hidden in their washing machine.
Their spending soon created another security problem. Roughly a week after the Bitcoin theft, several masked men intercepted Chetal’s parents while they were driving in Danbury, Connecticut.
The attackers beat Chetal’s father with a baseball bat, forced the couple into a van and bound their hands, according to the AP. Prosecutors said the group intended to use the parents to pressure Chetal into surrendering his portion of the stolen cryptocurrency.
Witnesses contacted police, and officers arrested the alleged kidnappers before the ransom plan could be completed.
Physical attacks involving cryptocurrency holders and their relatives have become more common. Chainalysis estimated that criminals stole more than $30 million through successful physical crypto attacks worldwide during the first half of 2026.
The blockchain analytics firm documented 46 attacks through late June, of which 12 resulted in payments. Family members or people connected to crypto holders accounted for roughly 25% to 30% of documented cases by early 2026.
FBI arrests followed the group’s spending spree
The FBI searched Chetal’s apartment in Brunswick, New Jersey, on Sept. 9, 2024, finding $37 million in stolen cryptocurrency in his possession. Chetal subsequently agreed to cooperate with investigators.
Nine days later, agents arrested Serrano at Los Angeles International Airport while he was wearing a watch valued at $500,000.
Serrano initially denied involvement but later acknowledged possessing roughly $20 million in cryptocurrency stolen from the Washington victim, prosecutors said. His charges remain pending.
Lam was arrested the same day at one of the Miami properties he had been using. Prosecutors later alleged that an off-duty law enforcement officer warned him that authorities were preparing to make the arrest.
“We always talked about what it would be like if I were to go down, but never thought it would be this crazy,” Lam told associates during a recorded jail call cited in his indictment.
His spending surprised U.S. Magistrate Judge Alicia Valle during his initial appearance in Miami.
“I could only think of Ferris Bueller gone bad,” Valle said, referring to the main character in the 1986 film “Ferris Bueller’s Day Off.”
The arrests did not immediately stop stolen funds from being spent. Prosecutors said another defendant, Ferro, later used proceeds from the scheme to pay Lam’s legal expenses. Ferro pleaded guilty to racketeering conspiracy and declined to address the court when he was sentenced in May.
Social engineering losses remain high
The Lam case is part of a series of large cryptocurrency thefts in which attackers have targeted people instead of exploiting blockchain code.
Another elderly American lost $330.7 million worth of Bitcoin in April 2025 after attackers used a social engineering scheme to take 3,520 BTC, according to ZachXBT. The funds were subsequently moved through more than 300 wallets and at least 20 exchanges.
Federal data have recorded substantial losses from crypto-related fraud. The FBI received 181,565 cryptocurrency-related complaints involving $11.37 billion in losses during 2025, while investment fraud accounted for 61,559 complaints and $7.23 billion in reported losses.
Cybersecurity researcher Allison Nixon, who has tracked an online hacker subculture known as The Com, told the AP that the large sums available through crypto fraud have attracted young offenders and called for more law enforcement resources.
“If we don’t seriously ramp up the resources to take these people down and do it faster, then it’s going to spread more and more,” Nixon said.
U.S. District Judge Colleen Kollar-Kotelly, who is overseeing Lam’s case, has already sentenced three of his alleged co-conspirators. Two defendants involved in laundering the stolen funds received prison terms of roughly six years.
Chetal pleaded guilty to conspiracy charges in November 2024 and is awaiting sentencing, while Tucker Desmond received probation after pleading guilty to destroying evidence connected to other members of the group.
Desmond told the court during his March sentencing that he had become “obsessed with the image of success rather than actually becoming a hard-working individual myself.”
During Ferro’s sentencing in May, defense attorney Kevin Wilson described the defendants as mischievous “young kids,” an argument Kollar-Kotelly rejected.
“Being young only goes so far,” the judge said.
