Malone Lam, a 22-year-old Singaporean national, pleaded guilty on September 9, 2026, before U.S. District Judge Colleen Kollar-Kotelly in Washington, D.C., to one count of racketeering conspiracy in connection with the theft of more than 4,100 Bitcoin from a single victim in August 2024. The stolen funds were valued at roughly $243 million to $245 million at the time of the theft. The case carries the distinction of being the first time the U.S. Department of Justice has applied the Racketeer Influenced and Corrupt Organizations Act, commonly known as RICO, to a Bitcoin theft network. Lam faces a maximum sentence of 20 years, with sentencing guidelines recommending a minimum of 14 years under his plea agreement. A status hearing is scheduled for December 8, 2026.

The victim was a creditor of Genesis Global Capital, a crypto lending firm that collapsed in January 2023 following the FTX contagion. Genesis creditors had been locked out of their assets for over a year, leaving them acutely anxious about account security and especially susceptible to urgent warnings of account compromise. That vulnerability was precisely what the attackers exploited. The victim held assets through the Gemini exchange. On August 18, 2024, members of the criminal network impersonated Google and Gemini customer support staff using spoofed phone numbers. They persuaded the victim to hand over Google Drive access and two-factor authentication codes by claiming his account had been compromised. The funds were gone within hours. Investigators say the ring had been running similar social engineering attacks against high-value crypto holders since at least October 2023, when Lam and early co-conspirators became roommates in Texas and began coordinating their operations. Lam operated under aliases including "Anne Hathaway" and "$$$."

After gaining access to the victim's wallet, the group moved the stolen Bitcoin through a series of laundering techniques designed to obscure its origin: peel chains (a method that splits large sums into many smaller transactions across successive wallets), cryptocurrency mixers, and VPN-masked exchange accounts. Authorities have frozen just over $9 million and returned approximately $500,000 to the victim, meaning roughly 0.2 percent of the total theft has been recovered. Twenty-two of the 31 luxury vehicles purchased with the proceeds remain unaccounted for. The haul financed a $3.8 million Pagani Huayra, a $2 million watch, and a single night at a Los Angeles nightclub that cost $569,000. When Judge Kollar-Kotelly asked Lam to name all the luxury cars he had bought, he replied: "I would need some time."

U.S. Magistrate Judge Alicia Valle, in remarks during related proceedings, offered her own summary. "I could only think of Ferris Bueller gone bad," she said. Federal prosecutor William Hart was more direct at a co-defendant's sentencing: "This luxury lifestyle, of which so many young men and women could only dream, was just built on a foundation of fraud."

Pseudonymous on-chain investigator ZachXBT, whose work tracing stolen crypto funds is well established in the industry, received an alert about an unusually large Bitcoin transaction just one day after the theft, on August 19, 2024, while preparing to board a flight. He began tracing the peel chains in real time, shared his analysis with the FBI and DOJ, and that work contributed directly to the September 18, 2024 arrests of the first defendants. Co-conspirator Jeandiel Serrano, known online as "Box," accelerated his own capture by failing to mask his IP address when using an exchange account to move $30 million in stolen funds. A second key co-conspirator, Veer Chetal, known online as "Wiz," had approximately $37 million in crypto and roughly $500,000 in cash seized. In total, 18 people have been charged in the case; Lam is the 11th to plead guilty.

The DOJ's use of RICO is significant. The law was originally built to dismantle organised crime by treating a criminal enterprise and all its members as collectively liable, rather than prosecuting individual offences in isolation. Applying it here signals that prosecutors view large-scale crypto theft rings as structured organisations, not opportunistic one-off frauds. Legal analysts suggest that framing could influence how regulators and law enforcement in the UK, Australia, Singapore, and India approach coordinated crypto crime in their own jurisdictions. Cybersecurity researcher Allison Nixon framed the urgency clearly: "If we don't seriously ramp up the resources to take these people down and do it faster, then it's going to spread more and more."

For users outside the United States, the attack method poses a direct threat to crypto users in Nigeria, Kenya, India, and Pakistan, where exchange-based custody is the norm and social engineering via phone or WhatsApp remains effective. The fact that this single attack yielded more than $243 million in Bitcoin underscores how catastrophically these tactics can scale. Adding to the complexity is the DOJ's own institutional position: the department disbanded its dedicated cryptocurrency enforcement unit in the period leading up to this prosecution, even as FBI crypto fraud complaints rose nearly 50 percent in 2025. This case was built substantially on legacy capacity and collaboration with private investigators, raising real questions about whether the infrastructure exists to handle the next one.

Lam's Singaporean nationality has drawn quiet attention in a jurisdiction that has worked hard to build credibility as a responsible crypto hub. The Monetary Authority of Singapore (MAS) tightened licensing rules in mid-2025 to cover firms serving overseas customers, a move analysts say is designed to close the regulatory gaps that globally mobile actors can exploit. The country's crypto-related scam losses accounted for roughly one-fifth of its total national scam losses in 2025. No official response to Lam's case has been issued by Singapore authorities, as the crimes occurred entirely under U.S. jurisdiction.

The structural reality of this case is a direct warning for self-custody users worldwide. Of the roughly $243 million to $245 million stolen, approximately $500,000 has been returned. For crypto holders in emerging markets where exchange-based custody is common and legal recourse is limited, that figure is not a footnote. It is a probable outcome.