Malone Lam Pleads Guilty in $245M Crypto Theft Conspiracy Case

A Singaporean national, Malone Lam, has pleaded guilty in US federal court to participating in a racketeering conspiracy prosecutors say relied on social engineering and physical break-ins to steal and launder more than $245 million in cryptocurrency. The US Department of Justice said Lam helped build and run an international operation, including selecting targets and coordinating co-conspirators.

Prosecutors allege the enterprise operated from no later than October 2023 through at least May 2025, according to court documents unsealed by the DOJ. Lam entered the plea before US District Judge Colleen Kollar-Kotelly to one count of participating in a Racketeer Influenced and Corrupt Organizations (RICO) conspiracy, and the judge scheduled a status hearing for Dec. 8 without announcing a sentencing date.

Key takeaways

• Malone Lam’s guilty plea centers on participation in a DOJ-described RICO conspiracy involving over $245 million in crypto theft and laundering.
• Prosecutors say the operation used online gaming platform connections and blended digital social engineering with home break-ins.
• The case traces back to allegations that Lam helped steal more than 4,100 Bitcoin from a Washington, DC resident.
• A RICO track expanded the prosecution: a superseding indictment added 12 defendants and increased the scope to more than $263 million in alleged thefts.
• Lam’s sentencing date has not been announced, even though the plea was entered roughly two years after the original criminal charge.

How the alleged theft worked

According to the original DOJ allegations, Lam and another defendant, Jeandiel Serrano, were accused of fraudulently obtaining more than 4,100 Bitcoin from a single victim on Aug. 18, 2024. Prosecutors previously said the victim’s assets were worth more than $230 at the time of the alleged theft.

Later reporting by blockchain investigator ZachXBT identified the victim as a Genesis creditor. The alleged scheme, according to that investigative reporting, involved attackers impersonating “Google support” staff to compromise the victim’s accounts, then posing as Gemini support to pressure the victim into resetting two-factor authentication and using screen-sharing software. Prosecutors said the screen-sharing step exposed private keys, enabling attackers to gain control of the Bitcoin.

From targeted fraud to a broader racketeering conspiracy

Prosecutors arrested Lam and Serrano on Sept. 18, 2024, and unsealed an indictment the next day. In that filing, prosecutors alleged that the defendants laundered stolen proceeds through a network of methods including crypto mixers, exchanges, pass-through wallets, and virtual private networks.

The DOJ also positioned the case as more than a single theft. On May 15, 2025, prosecutors announced a superseding indictment that added 12 additional defendants and expanded the matter into an alleged RICO conspiracy tied to more than $263 million in cryptocurrency thefts. The updated charging narrative included an additional $14 million theft reported in July 2024 and an alleged home break-in targeting a hardware wallet.

In the same expanded prosecution, prosecutors also alleged Lam continued directing associates after his arrest and while he was held in pretrial detention. They claimed he coordinated the delivery of luxury items to his girlfriend as part of the broader alleged operation.

What prosecutors say the operation looked like

The guilty plea adds clarity—at least from the government’s perspective—on how prosecutors believe the enterprise functioned. In its announcement of Lam’s plea, the Justice Department said Lam organized the international operation, identified prospective victims, and coordinated other conspirators.

The DOJ further stated that court documents show the enterprise was formed through connections on online gaming platforms. Prosecutors described a hybrid approach that combined online access and manipulation with physical intimidation or intrusion, including home break-ins aimed at compromising crypto holdings.

As the case expanded, prosecutors also alleged that stolen funds were used for high-end purchases and a lifestyle involving private jets, rental properties, watches, and at least 28 exotic cars. They also pointed to nightlife expenses, including claims of nightclub bills reaching $500,000 per evening.

Why Lam’s plea matters for the crypto industry

Although the case is rooted in one defendant and one alleged victim, the RICO structure and the government’s description of tactics are significant for the broader crypto ecosystem. The allegations emphasize how social engineering attacks can be paired with operational coordination and money movement infrastructure, making them more resilient than a single compromise event.

Investors and users should take note of how the DOJ’s narrative connects account takeover techniques—such as impersonation of trusted service channels and pressure to reset authentication—directly to the longer-term laundering pipeline. The plea also underscores that prosecutors may pursue multi-defendant conspiracy theories under RICO when they view crypto thefts as part of an ongoing enterprise rather than isolated fraud.

That said, the practical impact on ongoing civil or creditor-related matters will depend on what facts are established in the case record beyond the plea itself, including how courts and prosecutors handle evidence tied to the expanded allegations.

With Lam now having pleaded guilty, attention will likely shift to what the government can prove at sentencing and what additional defendants still fighting the charges will challenge—particularly around how the alleged operation formed, how targets were selected, and how proceeds were traced and laundered. Readers should watch for updates as the status hearing approaches and for any subsequent DOJ filings that clarify the government’s remaining theory of the case.