How a 22-year-old built a $245 million crypto crime ring

Malone Lam pleaded guilty to leading a crypto theft enterprise that prosecutors say stole and laundered more than $245 million.

The 22-year-old Singapore citizen admitted Tuesday in Washington to participating in a racketeering conspiracy, marking a major turn in a case that began with one of the largest known thefts from an individual Bitcoin holder.

Prosecutors said Lam organized an international network that targeted crypto owners through social engineering and, in some cases, home break-ins to obtain information needed to drain their wallets. The enterprise operated from at least October 2023 through May 2025 and included participants in California, Connecticut, New York, Florida and overseas.

Lam, who used online aliases including “Anne Hathaway,” “$$$” and “King Greavy,” selected targets and coordinated roles across the group, prosecutors said. The network grew from relationships formed on online gaming platforms before developing into a wider operation built around stealing and laundering digital assets.

The proceeds financed an extravagant lifestyle. Members spent as much as $500,000 during a single nightclub evening, gave away luxury handbags at parties and bought watches worth between $100,000 and more than $500,000. Prosecutors also described private-jet rentals, homes in Los Angeles, the Hamptons and Miami, private security teams and exotic cars valued at as much as $3.8 million.

Prosecutors arrested Lam in September 2025 at a rented home in Miami. His guilty plea to one RICO conspiracy count turns allegations surrounding the broader organization into an admission of criminal participation, while the case against other alleged participants continues.

One victim lost more than 4,100 Bitcoin

The scale of Lam’s operation became public in 2024 after prosecutors accused him and Jeandiel Serrano of participating in the theft of more than 4,100 Bitcoin from a single Washington, D.C., victim.

The coins were worth more than $230 million when they were stolen on Aug. 18, 2024, accounting for most of the value initially tied to the case. The Justice Department’s latest figure of more than $245 million covers cryptocurrency stolen and laundered across the wider enterprise, not that single incident.

Earlier accounts of the theft described conspirators posing as Google and Gemini support representatives to gain the victim’s trust before obtaining remote access to a computer. That access exposed private keys controlling the Bitcoin, allowing the group to move the funds.

Prosecutors said stolen crypto was then routed through exchanges, mixing services, peel chains and pass-through wallets, while virtual private networks were used to conceal participants’ identities. The money was subsequently converted into cars, watches, travel, and other luxury spending that became a hallmark of the operation.

The case also highlights the continuing effectiveness of social engineering against large crypto holders. Rather than compromising Bitcoin itself, the conspirators targeted the people controlling wallet access and the credentials surrounding it.

US District Judge Colleen Kollar-Kotelly scheduled Lam’s next status hearing for Dec. 8. The proceeding is not a sentencing hearing, leaving the timetable and punishment for his RICO conviction unresolved as prosecutors continue pursuing others tied to the enterprise.