Malone Lam, the alleged ringleader of a group accused of stealing more than 240 million USD in Bitcoin from a Washington, D.C. investor, is scheduled to appear in court Tuesday for a plea agreement hearing, according to the Associated Press. The 22-year-old Singaporean is set to become the 11th of 18 charged defendants to admit guilt in one of the largest social engineering thefts ever prosecuted in the United States.
The hearing arrives nearly two years after prosecutors say Lam and his associates used phone-based deception to drain more than 4,100 BTC from a longtime cryptocurrency investor in August 2024. At Lam’s first court appearance, a prosecutor estimated that federal sentencing guidelines could recommend at least 14 years in prison if he is convicted.
How the attack unfolded
The case centers on an August 18, 2024 attack against a Washington resident identified in court filings only as “Victim 7.” Prosecutors said the group targeted the man specifically because he was a wealthy, longtime cryptocurrency holder.
The scheme was classic social engineering. One caller posed as a Google representative and asked about supposed attempts to compromise the victim’s account. A second pretended to work for the Gemini exchange and warned that malware had infected his wallet. Together, the callers persuaded the victim to grant access to his Google Drive and to disclose security codes, handing the group control of more than 4,100 BTC.
A private recording captured the moment the suspects realized the scale of their haul, with one voice exclaiming that he was going to “spaz out.” Blockchain investigator ZachXBT helped trace the theft and published material connected to the group, while money launderers moved the stolen coins through multiple exchange platforms, converting portions into fiat.
A month of luxury, then the FBI
Lam was arrested in September 2024 after investigators documented a month-long spending spree: luxury cars, private jets, expensive watches, mansions and millions of dollars burned through at nightclubs. The group had met through online gaming communities and, according to prosecutors, had run similar multimillion-dollar social engineering thefts since late 2023 before the August operation.
The breakthrough came from an operational mistake. Veer cohort Jeandiel Serrano created an account on a cryptocurrency exchange to hold nearly 30 million USD in stolen assets but failed to conceal his internet protocol address. Investigators traced it to a home in Encino, California, that he was renting for 47,500 USD per month.
Ten co-defendants have already pleaded guilty, including co-accused participants Veer Chetal and Jeandiel Serrano, who were linked to the roughly 243 million USD attack in reporting from September 2024. Lam’s plea would leave the remaining defendants to face trial or negotiate their own agreements.
Social engineering remains crypto’s biggest theft vector
The prosecution is a landmark for a crime type that continues to plague the industry. Unlike exchange hacks or smart contract exploits, social engineering attacks bypass code entirely and target the human operator of a wallet. In January 2026, a crypto holder lost more than 282 million USD in Bitcoin and Litecoin after being deceived in another social engineering scheme involving a hardware wallet, with ZachXBT reporting the stolen assets were moved through instant exchanges and converted into Monero.
That case, still larger in dollar terms than the Washington theft, underscores how little the pattern has changed even as enforcement matures. Callers impersonating technology companies and exchanges, requests for remote access, and pressure to move funds to “safe” wallets appear again and again in incident reports.
What the plea signals
For federal prosecutors, the Lam plea caps a methodical takedown that began with on-chain tracing, moved through FBI arrests across multiple states, and now proceeds through coordinated guilty pleas. The U.S. Justice Department has increasingly treated large-scale crypto theft crews as organized criminal enterprises rather than isolated fraudsters, a framing that carries heavier sentencing exposure.
For ordinary holders, the lesson is procedural. No legitimate company calls unsolicited to request account access or security codes. Hardware wallets, deliberately verified contact channels and a refusal to move assets under phone pressure remain the most reliable defenses against a playbook that has now produced nine-figure losses twice in under two years.
As of the time of writing, Bitcoin trades near 79,300 USD, Ethereum near 2,497 USD, and Solana near 105 USD.
Disclaimer: This article is for informational purposes only and does not constitute financial advice.
fake Google rep then fake Gemini support, that exact script almost got my uncle last spring. 4100 BTC drained in one evening is nightmare fuel
your uncle almost fell for it because the script works. real Google branding, hours on the phone, manufactured urgency. exchanges never cold call you
11 of 18 pleading out and Lam staring at 14 years under the guidelines. Hard to feel anything for them after that phone script against Victim 7.
14 years is just the guideline floor. a plea this early usually means he is cooperating, which is bad news for the remaining seven
agree, cooperation is the only card left. the encino house and the lambos basically pre-wrote the sentencing memo
all that planning undone by one unmasked IP while renting a 47k a month house in Encino. and ZachXBT doing half the tracing work for free again
one unmasked IP from a 47k rental, poetic. also agree zachxbt deserves an invoice line at this point
^ one unmasked IP off a 47k rental and zachxbt basically wrote the case file. hope forfeiture includes some kind of finders fee for him
Two years from the Aug 2024 attack to a plea hearing is quick by federal standards. Feels like the dragnet on the remaining seven will speed up now.
the unmasked IP did more work than two years of paperwork tbh. zachxbt deserves a line item in the doj budget
plea deal means he sings on the remaining seven. 22 years old with a 47k a month rental, the math on how long that lasts was always zero
^ and forfeiture is the real headline here. a guilty plea means the government gets cooperation on where the remaining 4100 btc got stashed, expect clawback filings next
clawback filings only work if the coins are still findable. two years of swap hops means a chunk of that 4100 btc is probably dust on some privacy chain by now
swap hops or not, a plea means Lam hands over his own mixing trail. dude kept the Encino house under his name while running from a 4100 BTC case, the mastermind energy was never there
the encino house under his own name is my favorite detail. 4100 BTC heist brain and a paper trail a first year auditor could follow
Encino house in his own name while running from a 4100 BTC case tells you the whole story. plea plus forfeiture cooperation means that swap trail is about to get real interesting for whoever held his bags
cooperation math checks out, 11 of 18 already pleaded. the remaining seven should be refreshing their lawyers voicemails
victim 7 stayed on the line for hours because the script had real data. no password manager fixes being read your own history by a calm voice
4100 BTC stolen with a phone script and a fake support page. two years later its a plea deal, wild how fast this one moved
fast because he folded. 11 of 18 pleading this early means prosecutors had the chat logs from day one, cooperation was the only play left
the detail nobody covers, victim 7 only engaged because the caller knew real account activity. these crews buy leaked data first and script second. the phone call was step three
^ that is the scary part. the script quoted real account activity so anyone would have stayed on the line. leaked data is the actual root cause here
this is the detail that keeps me up. once the caller reads your actual transaction history back to you the trust question is already answered. data brokers are upstream of every one of these crews
exactly, the caller knowing real transaction history is the part exchanges still do not address. every one of these crews starts with a purchased data set
fake google rep into fake gemini support and 4100 BTC gone from a phone call. and here i am triple checking a password reset email for ten minutes