- The Bitcoin theft case centers on more than 4,100 BTC taken from a Washington investor through impersonation calls.
- Prosecutors say fake Google and Gemini support calls secured account access and security codes.
- Malone Lam allegedly spent $569,000 at one nightclub and bought a $2 million watch plus over 30 vehicles.
A $240 million Bitcoin theft that funded cars, mansions, and nightclub bills is moving toward a central defendant’s guilty plea.
Malone Lam, 22, is scheduled for a plea agreement hearing Tuesday in Washington. Prosecutors describe him as an alleged organizer.
Impersonation Calls Opened the Investor’s Accounts
Court filings say a Washington investor received two calls on August 18, 2024. One caller claimed to represent Google.
Another posed as a Gemini exchange employee and warned about malware affecting the investor’s cryptocurrency wallet. Both stories created urgency.
Prosecutors say the callers gained access to Google Drive and obtained security codes. Those details allowed the group to transfer 4,100 BTC.
The Bitcoin theft relied on social engineering, rather than a technical breach of Bitcoin. Members allegedly targeted an experienced, wealthy investor.
Several participants met through online gaming forums. Investigators say the network had used similar methods in earlier multimillion-dollar thefts.
Laundering Routes Failed to Hide Digital Evidence
Prosecutors say the group moved cryptocurrency through mixers, exchanges, and pass-through wallets. Peel chains divided balances across repeated transactions.
Virtual private networks and money laundering specialists also helped convert cryptocurrency into cash. Still, one account exposed a crucial lead.
Jeandiel Serrano allegedly created an exchange account holding nearly $30 million without hiding his IP address. Investigators traced it to Encino.
He rented the California property for $47,500 monthly. That link connected a digital transfer with a physical address used by investigators.
The Bitcoin theft case widened after agents arrested Serrano at Los Angeles Airport on September 18, 2024.
Lam was arrested the same day at a Miami mansion, ending the group’s month-long spending spree.
The Bitcoin theft probe also reached Veer Chetal’s New Jersey apartment. FBI agents found $37 million in stolen cryptocurrency there.
Chetal later agreed to cooperate and pleaded guilty to conspiracy charges. Serrano’s charges are pending, and he retains the presumption of innocence.
Cars and Nightclub Bills Expanded the Trail
Authorities say Lam and his associates spent about $4 million at Los Angeles nightclubs within one month. One evening cost over $569,000.
Lam allegedly purchased a $2 million watch and more than 30 cars. The collection included customized Porsches, Lamborghinis, and Ferraris.
Other spending covered private jets, guards, designer handbags, and costly homes. Properties in Miami and the Hamptons supported the group’s public lifestyle.
Luxury purchases created records involving dealers, landlords, and payment providers. Those transactions gave investigators another trail beyond blockchain transfers.
The Bitcoin theft also triggered violence around the group. Masked captors allegedly targeted Chetal’s parents to demand his stolen cryptocurrency.
Witnesses contacted police, and officers stopped the abduction attempt. The episode showed how stolen digital assets produced risks beyond online accounts.
Guilty Pleas Move the Federal Case Forward
Federal prosecutors have charged 18 defendants across the broader enterprise. Lam would become the eleventh defendant to plead guilty in the case.
An early prosecution estimate placed Lam’s recommended prison range at 14 years or more. Any sentence would come from the federal judge.
Evan Tangeman received 70 months for laundering at least $3.5 million. Marlon Ferro received 78 months and $2.5 million restitution.
The Bitcoin theft investigation involved the FBI, IRS Criminal Investigation, and federal prosecutors. Chetal awaits sentencing, while several cases are pending.
FBI data recorded $7.2 billion in reported cryptocurrency investment fraud losses during 2025. That category differs from this account-takeover case.
Cybersecurity researcher Allison Nixon has called for faster investigations and greater enforcement resources. She warned that similar networks could keep spreading.
Related: IRS Affirms Crypto is Property, Not Currency: How Does This Affect Users?
Disclaimer: The information presented in this article is for informational and educational purposes only. The article does not constitute financial advice or advice of any kind. Coin Edition is not responsible for any losses incurred as a result of the utilization of content, products, or services mentioned. Readers are advised to exercise caution before taking any action related to the company.
