Singaporean national Malone Lam pleaded guilty to helping lead an international cryptocurrency theft and laundering operation that allegedly combined online deception with physical break-ins and extravagant spending.
A Singaporean cybercrime organizer has admitted participating in an international operation that stole and laundered more than $245 million in cryptocurrency, according to US prosecutors.
The network allegedly relied on a combination of social engineering, impersonation, cryptocurrency theft, residential burglaries and money laundering. Prosecutors said members used the proceeds to finance an extravagant lifestyle that included exotic automobiles, private aircraft, luxury watches, rental properties and high-end nightlife.
The case illustrates how large-scale crypto theft can extend beyond digital attacks, with criminals allegedly moving from online manipulation to physical targeting when conventional methods failed.
Malone Lam Pleads Guilty in $245 Million Crypto Case
Malone Lam, a 22-year-old Singaporean citizen who recently lived in Miami, pleaded guilty on September 8 in the US District Court in Washington to participating in a conspiracy under the Racketeer Influenced and Corrupt Organizations Act, or RICO.
The Justice Department identified Lam as a leading figure in the enterprise, which prosecutors said stole and laundered cryptocurrency worth more than $245 million.
According to federal authorities, Lam helped select targets and coordinate different participants involved in the operation.
The alleged network included individuals operating from California, Connecticut, New York, Florida and other countries. Lam reportedly used several aliases, including “Anne Hathaway,” “$$$” and “King Greavy.”
US Attorney Jeanine Ferris Pirro said the case demonstrates the government’s intention to pursue organized cybercrime networks rather than focusing only on individual hackers.
The federal investigation initially became public in September 2024, when prosecutors accused Lam and Jeandiel Serrano of conspiring to steal and launder more than $230 million from a Washington-based victim.
Attackers Used Impersonation to Access Private Keys
The alleged operation relied heavily on manipulating victims rather than simply exploiting technical vulnerabilities.
In the Washington theft, participants allegedly posed as employees associated with Google and Gemini. Prosecutors said they persuaded the victim to disclose information stored in Google Drive and subsequently convinced the individual to open files containing cryptocurrency private keys.
Once the attackers gained access, the stolen Bitcoin was allegedly divided among participants involved in the operation.
The original case centered on more than 4,100 BTC allegedly obtained during a social-engineering attack on August 18, 2024.
Social engineering is particularly dangerous because it targets human behavior and trust instead of relying exclusively on software vulnerabilities.
A convincing impersonation of a legitimate company employee can potentially persuade a victim to reveal information that would otherwise remain protected.
The Operation Allegedly Expanded Into Home Burglaries
When online deception and account intrusions were not sufficient, members of the network allegedly turned to physical crimes.
One participant, Marlon Ferro, was sentenced to 78 months in prison after admitting his role in the broader operation.
His crimes included stealing a hardware wallet containing approximately 100 BTC from a Texas residence.
In another incident, Ferro allegedly participated in a search of a New Mexico home where a window was smashed with a brick.
The alleged use of residential burglaries adds a particularly serious dimension to the case. It suggests that criminals were not only attempting to compromise digital wallets but were also willing to physically target people believed to possess significant cryptocurrency holdings.
Crypto Holders Face Both Digital and Physical Risks
The case highlights an often-overlooked risk associated with publicly revealing substantial cryptocurrency holdings.
Large balances can make individuals attractive targets for both digital and physical attacks.
Basic security practices include keeping private keys and recovery phrases offline, refusing unsolicited requests for wallet information and avoiding unnecessary public disclosure of cryptocurrency holdings.
Social engineering attacks can be particularly effective because the attacker attempts to create a sense of legitimacy or urgency before persuading the victim to provide sensitive information.
Once private keys or recovery phrases are exposed, the blockchain itself generally cannot reverse an unauthorized transfer.
Prosecutors Say the Enterprise Was Highly Organized
According to prosecutors, the operation was active from at least October 2023 through May 2025.
Its members allegedly divided responsibilities among different groups, including hackers, burglars and money launderers.
The structure reflects the increasingly specialized nature of some cryptocurrency crime operations, where different participants can provide specific services rather than one individual handling every stage of a scheme.
The broader crypto fraud environment has also expanded significantly.
According to Chainalysis, impersonation-based scams grew by more than 1,400% during 2025.
The FBI’s latest internet crime data further illustrates the scale of the problem. Americans filed 181,565 cryptocurrency-related complaints involving more than $11 billion in reported losses during 2025.
Investment fraud accounted for nearly half of reported losses from cyber-enabled scams.
Stolen Crypto Funded a Lavish Lifestyle
Prosecutors said the stolen cryptocurrency was ultimately converted into an unusually expensive lifestyle.
The alleged spending included:
- Nightclub services costing as much as $500,000 per night
- Luxury watches worth more than $500,000
- Private jet rentals
- High-end rental properties
- Personal security
- Exotic automobiles valued at up to $3.8 million
The spending allegedly demonstrated how cryptocurrency stolen through social engineering could quickly be converted into luxury goods and services.
For investigators, such spending patterns can also provide potential evidence of how illicit funds moved through the financial system.
Lam Was Arrested in Miami
Lam was arrested at his Miami rental residence on September 18, 2024.
His guilty plea now moves the case toward sentencing and further proceedings involving the alleged enterprise.
A status hearing is scheduled for December 8.
The case remains notable because of the scale of the alleged theft and the combination of digital and physical criminal tactics involved.
The Bigger Lesson for Crypto Security
The Lam case demonstrates that cryptocurrency theft is no longer limited to sophisticated malware, exchange breaches or blockchain exploits.
Criminal groups can target the weakest component in the security chain: the person controlling the assets.
Impersonation can be used to obtain sensitive information, stolen credentials can lead to private keys, and physical intimidation or burglary can become another route to cryptocurrency.
For high-value holders, protecting digital assets therefore requires more than securing a wallet. Privacy, operational security, careful verification of unexpected communications and protection against physical targeting can all play an important role.
As prosecutors pursue Lam and other alleged participants, the case offers a broader warning to the cryptocurrency industry: when digital wealth becomes highly visible, the threat can move from the screen to the front door.
