22-year-old pleads guilty to $240 million Bitcoin theft

The 22-year-old Malone Lam from Singapore is about to plead guilty to his role in one of the largest crypto thefts in American history. In August 2024, he and a group of young men stole more than 4,100 Bitcoin, worth over $240 million, from a Washington D.C. resident. The theft was followed by a month of lavish spending before the FBI intervened.

In brief:

• Lam and his accomplices stole over $240 million in Bitcoin in August 2024 through a social engineering attack.
• The group spent the stolen money within one month on luxury cars, private jets and nightclubs, with Lam spending $569.000 in a single night.
• Lam is set to plead guilty as the eleventh defendant; prosecutors estimate his minimum prison sentence at fourteen years.

Social engineering attack on a wealthy Bitcoin investor

On 18 August 2024, a man, referred to in court documents as “Victim 7”, received several phone calls. The first caller posed as a Google employee and reported suspicious login attempts. A second caller claimed to be from crypto exchange Gemini and warned of an attack on the victim’s crypto portfolio.

Through manipulation, the fraudsters managed to persuade the man to grant access to his Google Drive and release security codes. Lam used that information to steal more than 4,100 Bitcoin, prosecutors allege. The victim had been deliberately chosen because he had been a wealthy Bitcoin investor for some time.

Lam had previously committed similar thefts with the same group, whose members had met through online gaming platforms. According to AP, they worked with specialised money launderers to convert the stolen Bitcoin into cash via multiple exchanges.

Millions spent in one month

After the theft, an extravagant month followed. The group bought fleets of sports cars, flew in private jets and rented villas in Miami and the Hamptons. Lam bought more than thirty cars in total, including customised Porsches, Lamborghinis and Ferraris, and purchased a $2 million watch. In one evening, he spent $569.000 at a nightclub in Los Angeles. The group spent a total of $4 million on nightclubs in a single month.

The lavish spending quickly drew attention. Accomplice Jeandiel Serrano made a critical mistake by failing to hide his IP address when creating an account on a crypto exchange. Investigators linked that address to a property in Encino, California, which he rented for $47.500 per month. Serrano was arrested at Los Angeles airport while wearing a $500.000 watch. Lam was detained on the same day in one of his rented villas in Miami.

Guilty plea and possible fourteen-year sentence

Of the eighteen defendants in the case, ten have already pleaded guilty. Lam is about to become the eleventh. Prosecutors estimate that the sentencing guidelines for him point to at least fourteen years in prison. Judge Colleen Kollar-Kotelly previously sentenced two money launderers to prison terms of around six years.

This case does not stand alone. Reports of crypto investment fraud to the FBI rose by nearly 50% in 2025. At the same time, the Trump administration has disbanded the US Department of Justice enforcement team that focused on crypto-related crimes, while the president himself earned an estimated $1.2 billion through his crypto businesses in 2025.

Cybersecurity researcher Allison Nixon, who has tracked the criminal network The Com for years, warns that without additional investigative capacity the problems will continue to grow. “If we do not scale up the resources quickly and seriously, this will keep spreading further”, she says.