Malone Lam, a 22-year-old Singaporean national behind one of the largest cryptocurrency thefts ever prosecuted in the U.S., pleaded guilty on Sept. 8 to Racketeer Influenced and Corrupt Organizations (RICO) conspiracy in federal court in Washington, D.C. The ring used social engineering to gain access to victims’ wallets, with the largest single theft involving over $245 million in cryptocurrency, according to prosecutors.
The Guilty Plea and Scope of the Case
At a hearing presided over by the U.S. District Judge Colleen Kollar-Kotelly, Lam pleaded guilty to one count of conspiracy under RICO Act. The charge carries a maximum sentence of 20 years in prison, though the actual penalty will be determined after the court considers federal sentencing guidelines and other relevant factors. A sentencing date has not yet been set, while the next status conference is scheduled for Dec. 8, 2026.
The scheme operated from at least October 2023 through May 2025, originating from connections formed on online gaming platforms and involving members across multiple U.S. states and abroad. Lam was responsible for identifying targets and coordinating the roles of participants. He is the 11th defendant to plead guilty among 18 who have been charged, according to the U.S. Department of Justice.
The plea agreement establishes approximately $245.1 million in restitution for which Lam and relevant co-conspirators are liable, along with a forfeiture money judgment of an equivalent amount. Lam also agreed to surrender cryptocurrency traceable to the offense. This figure is separate from the more than $263 million that a 2025 superseding indictment attributed to the ring’s overall operations across multiple victims.
How the $245 Million Crypto Theft Worked
To locate targets, some ring members breached websites and servers or purchased stolen data on the dark web, subsequently screening the information to identify high-net-worth cryptocurrency holders. Other members then approached these individuals by impersonating employees of trusted companies, according to DOJ filings.
In the days leading up to the largest theft, the group repeatedly sent Washington, D.C. man notifications regarding unauthorized Google access attempts. A ring member then called, posing as a Google support agent assisting with suspicious login activity, and convinced the victim to grant access to his account.
After determining the victim’s cryptocurrency holdings, the group further impersonated Gemini security personnel. The victim was requested to provide authentication codes and necessary security information, thereby facilitating the ring members’ access to the cryptocurrency wallets.
On Aug. 18, 2024, Lam and his co-conspirators transferred more than 4,100 Bitcoins out of the victim’s control. This asset was valued at approximately $245.1 million in court filings related to the plea agreement, making it the largest single theft attributed to the ring. The modus operandi relied on manipulating the victim into surrendering login credentials, rather than exploiting vulnerabilities in Bitcoin or compromising Google and Gemini systems.
From Stolen Crypto to Luxury Assets
According to prosecutors, the stolen cryptocurrency was routed through mixing services, exchanges, and intermediary wallets before being converted into cash or bank transfers. The ring also utilized fake identification, shell companies, and nominees to conceal ownership of vehicles and real estate transactions.
The funds were used to lease residences in Miami, Los Angeles, and the Hamptons, charter private jets, hire private security personnel, and purchase a vast array of luxury items. The entire ring reportedly spent approximately $4 million at nightclubs and $9 million on automobiles. Lam alone spent $569,000 in a single night in Los Angeles and purchased a wristwatch valued at around $2 million.
Among the seized assets were at least 28 luxury vehicles, ranging in value from $100,000 to $3.8 million each. The fleet included models from Rolls-Royce, Lamborghini, Ferrari, and Pagani. The forfeiture orders also encompassed approximately 95 pieces of jewelry, watches, clothing, and other luxury brand items.
What Happens Next
Lam remains in custody following his arrest by the FBI at a rented home in Miami on Sept. 18, 2024. Following his guilty plea, the case moves to the sentencing phase, although the court has not yet set a specific date. Judge Colleen Kollar-Kotelly will hold a status conference on Dec. 8, 2026, and may establish the subsequent schedule at that time.
In addition to potential imprisonment, Lam faces financial obligations set forth in the plea agreement, including approximately $245.1 million in restitution and an equivalent forfeiture money judgment. Cryptocurrency traceable to the offense is also subject to forfeiture, while the asset recovery process for victims and proceedings against other defendants remain ongoing.
