An ancient wallet that had been dormant for 12 years is raided by social engineering, and blockchain detectives uncover the criminal network. With the 22-year-old main perpetrator pleading guilty and surrendering his luxury car fleet, the first major cryptocurrency case applying the anti-mafia RICO Act in the U.S. arrives at a critical trial moment.

Written by: Sanqing, Foresight News

On September 8, at the federal district court in Washington D.C., 22-year-old Singaporean Malone Lam (online alias "Greavys") pleaded guilty before the judge. He admitted to a charge of racketeering conspiracy (RICO Conspiracy). According to a sentencing agreement reached between the prosecution and defense, this young man from Singapore, who once stole $245 million, faces a sentencing guideline recommending a minimum prison term of 14 years, with a statutory maximum of 20 years. The Washington D.C. U.S. Attorney's Office (USAO-DC) announced this news on its official X account.

From the phone call impersonating a customer service in August 2024, to being uprooted within a month by blockchain detectives and the FBI, and then escalating over two years from a two-person online theft case to a federal felony investigation involving 18 people, the prosecution ultimately resorted to the RICO Act, usually used to target gangs. This single victim theft case, with the highest amount involved in cryptocurrency history, has now reached this critical point with the main perpetrator's guilty plea.

Deadly Phone Call, 4,100 Bitcoins Vanish

The starting point of this shocking case originated from a socially engineered attack designed to breach the psychological defenses of humans.

On August 18, 2024, an early Bitcoin investor, residing in Washington D.C. and having held Bitcoin since 2012 without using it for years, received a phone call with the caller ID disguised as the official Google support hotline. On the other end, the scammer claimed that there was an unauthorized login risk on the victim's account.

After generating panic through psychological pressure, the call was quickly "transferred" to a customer service team pretending to be the crypto exchange Gemini, misleading the victim to reset two-factor authentication (2FA) and transfer the assets from his Gemini account to a wallet controlled by hackers.

In the final step of the attack, the perpetrator induced the victim to share his screen using remote desktop control software AnyDesk under the pretext of "risk investigation".

The victim was unaware that the hacker used this opportunity to steal the private key from his Bitcoin core wallet. With the final operation completed, this ancient cold wallet, dormant for 12 years, was instantly emptied. A total of 4,100 Bitcoins (worth about $245 million to $263 million at that time, now worth over $320 million) were all transferred out.

On the other end of the screen, a group of young thieves, averaging just over twenty years old and often present in gaming communities, were livestreaming this heist to their accomplices via Discord and Telegram groups. In a later leaked recording, as the nine-digit sum landed in their accounts, several suspects exclaimed, "Oh my God! Bro, bro, I'm going crazy!"

Faceless Detective, Pursuing the Criminal from Thousands of Meters High

However, these young hackers underestimated the immutable public ledger of the blockchain and even more so the on-chain hunters lurking in the shadows of the internet.

The day after the theft, on August 19, 2024, the blockchain detective ZachXBT, known for his anonymous platypus avatar, was preparing to board a flight.

As one of the sharpest on-chain detectives globally, ZachXBT had been monitoring dozens of small exchanges and liquidity pools. Just before boarding, an alert popped up on his phone. An anomalous transfer of $600,000 worth of Bitcoin entered a lesser-known exchange, followed shortly by $1 million, then $2 million.

In the last few minutes before the plane took off, ZachXBT traced back the on-chain transactions using just his phone and identified the fund's source as an ancient address that had been silent for 12 years. His intuition told him: this was a theft worth hundreds of millions, and it was still occurring.

As the aircraft climbed and the in-flight Wi-Fi connected, ZachXBT launched a cross-timezone digital chase.

The hackers were rapidly diverting the 4,100 Bitcoins to over a dozen exchanges, instant exchange platforms, and cross-chain bridges, trying to sever the trail with mixers. Meanwhile, as news of the theft spread through hacker circles, the group's internal recorded boasting clip also circulated.

In the recording, one accomplice accidentally shouted out the real name of member Veer Chetal, and the screen-sharing display revealed his full name, leaving a fatal open-source intelligence (OSINT) vulnerability.

ZachXBT took this clue and followed the threads to trace the suspect's private accounts on social media, identifying the Singaporean youth Malone Lam, who entered the U.S. on a short-term visa, along with accomplices Jeandiel Serrano (online alias "Box") and Veer Chetal (online alias "Wiz").

Investigations discovered that Lam was renting a luxury mansion in Miami for tens of thousands a month and had purchased over 30 supercars; according to reports from the Associated Press and others, he had spent as much as $569,000 in a single night at a nightclub in Los Angeles on champagne, and had publicly distributed luxury handbags worth tens of thousands to women in the crowd.

ZachXBT synced the on-chain flowchart and real identities of the suspects with law enforcement.

On September 18, 2024, just a month after the shocking case occurred, the FBI raided Lam's mansion in Miami and arrested him. The supercars lined up in his driveway and the luxury goods in his mansion became irrefutable evidence.

From Hacker Myth to "Bitcoin RICO" Trial

When Malone Lam and accomplice Jeandiel Serrano were initially charged, the public thought it was just a typical case of a "genius youth raiding a crypto whale through social engineering" in isolation.

However, as the Justice Department's grand jury investigation deepened, the truth was far more extensive than imagined. In the initial indictment against Malone Lam and Jeandiel Serrano in September 2024, the charges were only for conspiracy to defraud through wire transfer and conspiracy to launder money, which are relatively common accusations.

It wasn't until May 2025 that the U.S. Justice Department unveiled an expanded superseding indictment, expanding the defendants from two to 18, and for the first time invoked the RICO Act, originally meant for combating mafia families and drug trafficking organizations, officially categorizing this group as a transnational criminal organization spanning California, Connecticut, New York, Florida, and various overseas locations.

The 18 formal defendants collectively stole and laundered over $245 million to $263 million in crypto assets through means such as impersonating customer service, purchasing data on the dark web, and home invasions (the gang members had carried firearms during at least one home invasion in 2024). As of September 2026, Malone Lam was the 11th of the 18 to plead guilty.

Documents disclosed by the Justice Department reveal that these young people, who met in gaming forums, gradually evolved into a highly organized crime machine. Some were specifically responsible for purchasing leaked databases on the dark web to target individuals with substantial crypto assets, while others specialized in crafting fraudulent phone lines for call scams, and some were in charge of laundering money through luxury cars and jewelry.

According to reports from the Associated Press and others, the first blow to Malone Lam's bargaining chips came when accomplice Veer Chetal pleaded guilty and committed to testify in November 2024.

Verifiable official announcements from the Justice Department show that Marlon Ferro (20 years old, online alias "GothFerrari"), who was responsible for home invasions and money laundering, pleaded guilty in October 2025 and was sentenced to 78 months in prison in May 2026; Evan Tangeman, responsible for the money laundering aspect, pleaded guilty to the RICO conspiracy charge in December of the same year and was ultimately sentenced to 70 months in April 2026.

Faced with overwhelming on-chain evidence and confessions from accomplices, the core mastermind Malone Lam ultimately gave up his defense and signed a plea agreement before a federal judge.

As part of the plea agreement, Malone Lam agreed to surrender several luxury cars including Ferraris, Rolls Royces, Lamborghinis, and Mercedes Benzes registered in his name to compensate the victims' losses.

The Washington D.C. U.S. Attorney's Office included photographs of these vehicles awaiting seizure parked in private garages and driveways in the same tweet announcing the guilty plea. The cars that were once displays of successful outcomes have now become items on the compensation list.

Chief Judge Colleen Kollar-Kotelly had previously dismissed the common mitigating argument "the defendant is still young" in other defendants' hearings, stating flatly that "youth is not a reason for leniency," a stance that is expected to also affect Malone Lam's sentencing outcome.

Reflecting on this dramatic $245 million heist and hunt in cryptocurrency history, social engineering attacks have become the number one threat to whale assets. In this case, the blockchain's smart contracts were not breached, and cryptographic algorithms did not fail; what the hackers breached was always the weakest link in the system—humans.

In traditional finance, hundreds of millions of dollars laundered are often hidden in complex offshore shell companies and underground money houses; but in the blockchain world, every Satoshi's (Satoshi is the smallest unit of Bitcoin) displacement is recorded on the public chain, and the reality of lavishly spending money on luxury cars ultimately becomes the coordinates for on-chain detectives and the FBI to pin down criminals.

Two years have passed since the crime occurred, with slow progress in recovery. In the FBI's September 2024 search, approximately $37 million in crypto assets was seized from Veer Chetal's residence, around $20 million was recovered from Jeandiel Serrano, and another $500,000 in cash hidden in the washing machine at an accomplice's parents' house was discovered; combined with over thirty luxury cars and several luxury watches awaiting seizure, this forms the currently available asset recovery list.

In May 2026, Marlon Ferro was ordered to pay $2.5 million in restitution. However, Prosecutor Christopher Howland admitted during the court hearing on the day Malone Lam pleaded guilty that a significant portion of the funds had already been transferred to foreign or on-chain corners beyond the reach of the jurisdiction, making them untraceable.

As the status hearing before sentencing for Malone Lam is scheduled for December 8, 2026, this 22-year-old Singaporean youth will spend his long youth years in federal prison.