Malone Lam, a 22-year-old Singapore citizen, recently pleaded guilty to leading a sophisticated crypto theft enterprise that prosecutors claim stole and laundered over $245 million. This case marks a significant development in what began as one of the largest thefts from an individual Bitcoin holder.
According to prosecutors, Lam orchestrated an international network that targeted crypto owners through social engineering tactics and, in some instances, even resorted to home break-ins to obtain the information needed to drain their wallets. The operation, which ran from at least October 2023 to May 2025, involved participants in various locations including California, Connecticut, New York, Florida, and overseas.
Using online aliases such as “Anne Hathaway,” “$$$,” and “King Greavy,” Lam handpicked targets and delegated roles within the group. The network initially formed through relationships on online gaming platforms before evolving into a sophisticated operation focused on stealing and laundering digital assets.
The ill-gotten gains funded a lavish lifestyle for the members of the enterprise. They reportedly spent exorbitant sums of money during nightclub outings, gave away luxury handbags at parties, purchased watches valued at hundreds of thousands of dollars, and indulged in private-jet rentals, upscale homes, private security services, and high-end cars worth millions of dollars.
Lam was apprehended in September 2025 at a rented residence in Miami and subsequently pleaded guilty to one count of RICO conspiracy. While his admission implicates him in criminal activities, the case against other alleged participants is ongoing.
One of the most notable incidents linked to Lam’s operation involved the theft of over 4,100 Bitcoin from a single victim in Washington, D.C. The stolen coins, valued at more than $230 million when they were taken on August 18, 2024, represented a significant portion of the overall losses attributed to the enterprise.
The theft was executed by posing as Google and Gemini support representatives to gain the victim’s trust and obtain remote access to their computer. Once in possession of the private keys controlling the Bitcoin, the group was able to transfer the funds to their own accounts.
Stolen cryptocurrency was then funneled through various channels including exchanges, mixing services, peel chains, and pass-through wallets to obfuscate the trail. Virtual private networks were used to conceal the identities of the participants involved in the scheme.
This case underscores the effectiveness of social engineering tactics when targeting individuals with significant cryptocurrency holdings. Rather than directly compromising the security of the Bitcoin network, the perpetrators focused on exploiting vulnerabilities in the human element controlling wallet access and associated credentials.
US District Judge Colleen Kollar-Kotelly has scheduled Lam’s next status hearing for December 8, though it is not a sentencing hearing. The timeline for sentencing and the nature of the punishment for his RICO conviction remain to be determined as prosecutors continue to pursue other individuals connected to the criminal enterprise.