Malone Lam pleaded guilty on Sept. 8 to participating in a racketeering conspiracy that U.S. prosecutors linked to more than $245 million in cryptocurrency thefts.
Summary
- Malone Lam pleaded guilty to one RICO conspiracy count involving $245 million in cryptocurrency thefts.
- Prosecutors said Lam organized an international network using social engineering and occasional residential break-ins worldwide.
- More than 4,100 Bitcoin were stolen from one Washington resident during the August 2024 attack.
- The criminal enterprise operated from October 2023 through at least May 2025, court documents show.
- Judge Colleen Kollar-Kotelly scheduled a December 8 status hearing without announcing Lam’s sentencing date yet.
The 22-year-old Singaporean national entered his plea before U.S. District Judge Colleen Kollar-Kotelly in Washington, D.C. He admitted one count of participating in a Racketeer Influenced and Corrupt Organizations conspiracy, according to the Justice Department’s official statement.
Prosecutors described Lam as the organizer of an international network that targeted cryptocurrency holders through impersonation, account takeovers and occasional home break-ins. The group allegedly stole funds worth more than $245 million.
The guilty plea establishes Lam’s criminal responsibility in the conspiracy. Allegations involving defendants who have not pleaded guilty or been convicted remain unproven.
Malone Lam admits organizing the crypto theft network
Court documents say the enterprise began no later than October 2023 and continued through at least May 2025. Participants met through online gaming platforms and operated across several U.S. states and foreign jurisdictions.
Prosecutors said Lam used the online names “Anne Hathaway,” “$$$” and “King Greavy.” He identified prospective victims, organized social-engineering operations and assigned roles to other participants.
The group allegedly included database hackers, target researchers, impersonators, money launderers and residential burglars. Hackers obtained information from compromised websites, servers and databases purchased through dark-web markets.
Callers then contacted wealthy cryptocurrency holders while pretending to help resolve security problems. Prosecutors said the callers persuaded victims to disclose information that allowed the group to drain their wallets.
When remote methods failed, some conspirators allegedly targeted physical homes containing hardware wallets. In related coverage, a member of the same crypto theft ring received 78 months in prison for conduct that included residential burglaries.
The case grew from a 4,100 Bitcoin theft
The investigation originally centered on the theft of more than 4,100 BTC from a Washington, D.C., resident on Aug. 18, 2024. The Bitcoin was worth more than $230 million at the time.
The original Justice Department release accused Lam and Jeandiel Serrano of obtaining access to the victim’s accounts and laundering the proceeds through exchanges, mixers, pass-through wallets and peel chains.
Blockchain investigator ZachXBT previously identified the victim as a Genesis creditor. According to his investigation, the callers impersonated Google support before posing as representatives of cryptocurrency exchange Gemini.
They allegedly convinced the victim to reset security protections and use screen-sharing software. That process exposed information needed to transfer the Bitcoin.
The Justice Department expanded the prosecution in May 2025 through a superseding indictment. It added 12 defendants and described a wider enterprise responsible for more than $263 million in alleged thefts.
The broader total included a separate theft of more than $14 million in July 2024. The latest guilty-plea announcement uses a figure of more than $245 million for Lam’s admitted conspiracy conduct.
Stolen cryptocurrency funded cars and nightclub bills
Prosecutors said members spent stolen funds on rental mansions, private jets, security guards, watches, designer clothing and at least 28 exotic vehicles.
The vehicles were valued between $100,000 and $3.8 million each. Nightclub spending allegedly reached $500,000 per evening, while expensive handbags were distributed during parties.
The group also used crypto-to-cash services and shell companies to disguise ownership of assets. Some participants allegedly shipped bulk cash through the mail inside stuffed toys.
Money laundering supported the enterprise by converting stolen cryptocurrency into cash or assets. Conspirators allegedly used virtual private networks and chains of intermediary wallets to make transactions harder to trace.
Lam was arrested on Sept. 18, 2024, according to the original indictment announcement. The Justice Department’s newest release lists Sept. 18, 2025, but that conflicts with the contemporaneous court record and appears to be a clerical error.
Prosecutors previously alleged that Lam continued directing associates while held in pretrial detention. Those allegations included requests for conspirators to purchase luxury handbags and deliver them to his girlfriend.
As previously reported, another participant received 70 months for laundering stolen cryptocurrency connected to the same wider enterprise.
December hearing comes before sentencing
Judge Kollar-Kotelly scheduled Lam’s next status hearing for Dec. 8, 2026. The Justice Department did not announce a sentencing date or expected prison term.
The court will determine Lam’s sentence using the applicable federal statute, advisory sentencing guidelines and other factors. His plea agreement may also address cooperation, restitution and forfeiture, but the Justice Department did not publish those details in its announcement.
Three agencies led the investigation: the U.S. Attorney’s Office for the District of Columbia, the FBI’s Washington Field Office and IRS Criminal Investigation.
Federal offices in California, Florida and New Jersey also provided support. Assistant U.S. Attorneys Christopher Howland and David Liss are prosecuting the case.
Lam’s plea does not end the wider prosecution. Charges against other defendants remain pending, while several participants have already pleaded guilty or received sentences.
The case also shows how attackers combine digital deception with physical threats. Crypto.news reported that home invasions accounted for 37% of documented physical crypto attacks through mid-2026.
Further court filings should establish Lam’s sentencing schedule, forfeiture obligations and any restitution owed to victims. No recovery total was disclosed with the guilty plea.
