Malone Lam, the alleged ringleader of a group accused of stealing more than 240 million USD in Bitcoin from a Washington, D.C. investor, is scheduled to appear in court Tuesday for a plea agreement hearing, according to the Associated Press. The 22-year-old Singaporean is set to become the 11th of 18 charged defendants to admit guilt in one of the largest social engineering thefts ever prosecuted in the United States.
The hearing arrives nearly two years after prosecutors say Lam and his associates used phone-based deception to drain more than 4,100 BTC from a longtime cryptocurrency investor in August 2024. At Lam’s first court appearance, a prosecutor estimated that federal sentencing guidelines could recommend at least 14 years in prison if he is convicted.
How the attack unfolded
The case centers on an August 18, 2024 attack against a Washington resident identified in court filings only as “Victim 7.” Prosecutors said the group targeted the man specifically because he was a wealthy, longtime cryptocurrency holder.
The scheme was classic social engineering. One caller posed as a Google representative and asked about supposed attempts to compromise the victim’s account. A second pretended to work for the Gemini exchange and warned that malware had infected his wallet. Together, the callers persuaded the victim to grant access to his Google Drive and to disclose security codes, handing the group control of more than 4,100 BTC.
A private recording captured the moment the suspects realized the scale of their haul, with one voice exclaiming that he was going to “spaz out.” Blockchain investigator ZachXBT helped trace the theft and published material connected to the group, while money launderers moved the stolen coins through multiple exchange platforms, converting portions into fiat.
A month of luxury, then the FBI
Lam was arrested in September 2024 after investigators documented a month-long spending spree: luxury cars, private jets, expensive watches, mansions and millions of dollars burned through at nightclubs. The group had met through online gaming communities and, according to prosecutors, had run similar multimillion-dollar social engineering thefts since late 2023 before the August operation.
The breakthrough came from an operational mistake. Veer cohort Jeandiel Serrano created an account on a cryptocurrency exchange to hold nearly 30 million USD in stolen assets but failed to conceal his internet protocol address. Investigators traced it to a home in Encino, California, that he was renting for 47,500 USD per month.
Ten co-defendants have already pleaded guilty, including co-accused participants Veer Chetal and Jeandiel Serrano, who were linked to the roughly 243 million USD attack in reporting from September 2024. Lam’s plea would leave the remaining defendants to face trial or negotiate their own agreements.
Social engineering remains crypto’s biggest theft vector
The prosecution is a landmark for a crime type that continues to plague the industry. Unlike exchange hacks or smart contract exploits, social engineering attacks bypass code entirely and target the human operator of a wallet. In January 2026, a crypto holder lost more than 282 million USD in Bitcoin and Litecoin after being deceived in another social engineering scheme involving a hardware wallet, with ZachXBT reporting the stolen assets were moved through instant exchanges and converted into Monero.
That case, still larger in dollar terms than the Washington theft, underscores how little the pattern has changed even as enforcement matures. Callers impersonating technology companies and exchanges, requests for remote access, and pressure to move funds to “safe” wallets appear again and again in incident reports.
What the plea signals
For federal prosecutors, the Lam plea caps a methodical takedown that began with on-chain tracing, moved through FBI arrests across multiple states, and now proceeds through coordinated guilty pleas. The U.S. Justice Department has increasingly treated large-scale crypto theft crews as organized criminal enterprises rather than isolated fraudsters, a framing that carries heavier sentencing exposure.
For ordinary holders, the lesson is procedural. No legitimate company calls unsolicited to request account access or security codes. Hardware wallets, deliberately verified contact channels and a refusal to move assets under phone pressure remain the most reliable defenses against a playbook that has now produced nine-figure losses twice in under two years.
As of the time of writing, Bitcoin trades near 79,300 USD, Ethereum near 2,497 USD, and Solana near 105 USD.
fake Google rep then fake Gemini support, that exact script almost got my uncle last spring. 4100 BTC drained in one evening is nightmare fuel
your uncle almost fell for it because the script works. real Google branding, hours on the phone, manufactured urgency. exchanges never cold call you
11 of 18 pleading out and Lam staring at 14 years under the guidelines. Hard to feel anything for them after that phone script against Victim 7.
14 years is just the guideline floor. a plea this early usually means he is cooperating, which is bad news for the remaining seven
all that planning undone by one unmasked IP while renting a 47k a month house in Encino. and ZachXBT doing half the tracing work for free again
Two years from the Aug 2024 attack to a plea hearing is quick by federal standards. Feels like the dragnet on the remaining seven will speed up now.