Crypto theft ring used social engineering to steal 4,100 BTC

For cybersecurity teams, Lam's operation demonstrates the convergence of social engineering, identity manipulation, and physical intrusion into a single attack chain. The $245M+ heist did not rely on a zero-day exploit; instead, it weaponized trusted Discord and Minecraft communities to recruit operators and identify victims, then used home break-ins to complete the theft.

On September 8, 2026, 22-year-old Singaporean national Malone Lam pleaded guilty in the U.S. District Court for the District of Columbia to one count of participating in a Racketeer Influenced and Corrupt Organizations conspiracy before Judge Colleen Kollar-Kotelly, marking a pivotal development in one of the largest cryptocurrency thefts ever prosecuted by American authorities. The plea, confirmed by the U.S. Department of Justice, establishes Lam's criminal responsibility for organizing an international enterprise that allegedly stole and laundered more than $245 million in cryptocurrency, according to Hindustan Times, while CNA's on-scene report cited a figure above $265 million. US Attorney for DC Jeanine Pirro summarized the case in stark terms, saying Lam "led an international network that preyed on victims through deception."

“

The most significant single theft occurred on August 18, 2024, when Lam and co-defendant Jeandiel Serrano allegedly defrauded a Washington, DC resident of more than 4,100 Bitcoin, valued at over $230 million at the time.

The criminal operation, according to prosecutors, combined digital social engineering with physical home invasions to target wealthy cryptocurrency holders. The most significant single theft occurred on August 18, 2024, when Lam and co-defendant Jeandiel Serrano allegedly defrauded a Washington, DC resident of more than 4,100 Bitcoin, valued at over $230 million at the time. Blockchain investigator ZachXBT subsequently identified that victim as a Genesis creditor, linking the theft to the broader fallout from the crypto lending collapse. The enterprise itself operated from no later than October 2023 through at least May 2025, and was formed through relationships built in online gaming communities such as Minecraft and Discord. This model represents an evolution in cyber-enabled financial crime, where trusted communities become talent pools and target environments for criminals.

Lam's personal trajectory adds a cross-border dimension to the enforcement problem. He grew up in Singapore, attended Unity Secondary School in Choa Chu Kang, dropped out as a teenager, and became active in cryptocurrency trading and gaming communities. He moved to the United States in October 2023 under the Visa Waiver Program and lived in Miami, Los Angeles, and the Hamptons before his arrest; court records indicate his visa waiver authorization had expired by 2024. The case raises difficult questions about how border-entry programs can be abused by individuals whose criminal enterprises span multiple countries, and whether enhanced vetting of visa waiver travelers with crypto-related wealth is warranted.

From a legal and regulatory perspective, the use of RICO conspiracy against a decentralized, crypto-native group is significant. RICO was designed to dismantle organized crime by targeting the enterprise itself rather than isolated acts, and prosecutors are increasingly applying it to cryptocurrency theft and laundering. Lam's guilty plea avoids a trial and likely includes some form of cooperation or an agreed factual basis, though sentencing details remain unresolved; a status hearing is scheduled for December 8, 2026, and no sentencing date has been announced. The maximum penalty for RICO conspiracy is 20 years in prison, but actual sentencing will hinge on the loss amount, role enhancement, acceptance of responsibility, and any cooperation. This case may serve as a template for future prosecutions of cross-border crypto theft rings.