A Singaporean man has admitted directing an international network that stole and laundered more than $245m (£183m) in cryptocurrency through online impersonation, social engineering and home burglaries.
Malone Lam, a 22-year-old Singaporean citizen who had recently been living in Miami, pleaded guilty on 8 September in the US District Court in Washington to taking part in a Racketeer Influenced and Corrupt Organizations Act (RICO) conspiracy.
The US Department of Justice identified Lam as the ringleader of the enterprise, which prosecutors said operated across the United States and other countries. Lam selected targets, allocated tasks and coordinated members using the aliases “Anne Hathaway”, “$$$” and “King Greavy”.
Those involved were based in California, Connecticut, New York, Florida and elsewhere. The operation brought together people responsible for hacking, burglary and laundering the proceeds.
“If you build a cybercrime empire, we will find you, dismantle your operation, and hold you accountable,” U.S. Attorney Jeanine Ferris Pirro stated, adding:
“Working with our partners at the FBI and IRS-CI, we will continue to hunt down the criminals who weaponize technology to steal from innocent people,” Pirro continued.
How the cryptocurrency was stolen
The case first became public in September 2024, when prosecutors charged Lam and Jeandiel Serrano with conspiring to steal and launder more than $230m from a victim in Washington.
The initial allegations focused on more than 4,100 bitcoin, which prosecutors said had been obtained during a social-engineering attack on 18 August 2024.
The group allegedly posed as employees of Google and Gemini before persuading the victim to disclose information held in Google Drive. The victim was then manipulated into opening files containing private keys, allowing the conspirators to access the cryptocurrency.
Court documents described how the stolen bitcoin was divided between members of the group after the breach.
The network also turned to physical crime when online deception and account intrusions did not provide access to a target’s assets. Marlon Ferro, another member, was sentenced to 78 months in prison after admitting his involvement.
Ferro’s offences included taking a hardware wallet containing about 100 bitcoin from a home in Texas. In a separate incident, he used a brick to smash the window of a house in New Mexico while searching for cryptocurrency.
Social engineering attacks exploit people rather than a technical vulnerability, often by pretending to represent a trusted business or organisation. Recommended precautions include keeping private keys and recovery phrases offline, refusing unsolicited requests for wallet information and avoiding public disclosure of substantial cryptocurrency holdings, which can make people vulnerable to both online and physical attacks.
Lavish spending and wider fraud concerns
Prosecutors said Lam’s organisation was active from at least October 2023 until at least May 2025. Its members had developed relationships through online gaming platforms before building a more structured criminal enterprise.
The group’s division of labour reflects the increasingly professional nature of cryptocurrency fraud. Impersonation scams increased by more than 1,400% in 2025, according to the source article, as specialist infrastructure and money-laundering networks helped criminals run more organised operations.
The FBI’s latest annual internet crime report recorded the highest reported losses in the cryptocurrency category. Americans filed 181,565 complaints involving cryptocurrency losses of more than $11bn during 2025. Investment fraud represented almost half of all reported losses from cyber-enabled scams.
The proceeds from the network’s activities funded an extravagant lifestyle. Prosecutors said the group spent up to $500,000 on nightclub services in a single evening and bought watches worth more than $500,000.
Other spending included private jet hire, rented homes, security guards and exotic cars valued at as much as $3.8m.
Lam was arrested at his rented home in Miami on 18 September 2024. His next status hearing is scheduled for 8 December.
Federal prosecutors are also seeking about $47,000 in cryptocurrency allegedly taken from five victims in a fraud scheme involving technology-support and government impersonation.
