A network of young men in their late teens and early 20s pulled off one of the largest cryptocurrency thefts in U.S. history, duping a stranger out of bitcoin worth more than $240 million. After working to conceal their digital fingerprints through a sophisticated laundering scheme, the group celebrated the August 2024 heist with an extravagant spending spree: fleets of sports cars, private jet flights, hired security guards, and rented mansions in Miami and the Hamptons. Malone Lam, a 22-year-old alleged ringleader, spent over $569,000 in a single evening at a Los Angeles nightclub.

The bender lasted a month before FBI agents arrested Lam on charges that he organized a "social engineering" attack against a Washington, D.C., resident. Lam, an eighth-grade dropout from Singapore, has a plea agreement hearing set for Tuesday. His conviction would cap the government's investigation. The case is notable not only for its scale but for its legal architecture: prosecutors brought it under the Racketeer Influenced and Corrupt Organizations (RICO) Act, a statute created in 1970 to dismantle organized crime families and rarely applied to cryptocurrency theft rings before this case.

The charges against Lam and 17 others represent an extreme example of an increasingly common form of cybercrime. Complaints of cryptocurrency investment fraud to the FBI rose by nearly 50% in 2025, even as Republican President Donald Trump's administration largely abandoned the regulatory crackdown on the volatile industry. Last year, the Justice Department disbanded its unit dedicated to prosecuting crypto-related crimes. Crypto companies that complained of unfair treatment during Democratic President Joe Biden's presidency are now enjoying a hands-off approach under Trump, who took in roughly $1.2 billion from his crypto businesses in 2025.

Cybersecurity researcher Allison Nixon, who has spent years tracking The Com — an underground subculture of young hackers united by the "insane amount of money" that crypto fraud can generate — advocates for more law enforcement resources to pursue them.

"If we don't seriously ramp up the resources to take these people down and do it faster, then it's going to spread more and more," she said.

The Heist

A man identified as "Victim 7" in court filings was at home in Washington on Aug. 18, 2024, when his phone rang. The first caller identified himself as a Google representative inquiring about attempts to breach his account. A second caller, claiming to be from the Gemini crypto exchange, warned the man of a malware attack affecting his crypto wallet.

The callers manipulated the man into granting access to his Google Drive and revealing security codes that allowed Lam to siphon off more than 4,100 bitcoin, according to prosecutors. Lam and his friends on the calls — Veer Chetal and Jeandiel Serrano — had targeted the man because he was a wealthy, longtime crypto investor. The approach — impersonating trusted companies to trick victims into handing over account access — is a hallmark of social engineering, which relies on manipulating people rather than exploiting technical vulnerabilities in software.

A private recording captured the moment the friends realized how much money they had stolen, according to a video posted by ZachXBT, a well-known private investigator of cryptocurrency crimes.

"Oh, my God! Bro, bro, I'm going to spaz out!" a voice on the video said.

Once they swiped the man's savings, the group enlisted money laundering specialists to wash the funds through multiple exchange platforms and convert the virtual currency into government-issued cash.

It was not the friends' first social engineering scam. Having met in online gaming forums, they had teamed up on other multimillion-dollar thefts since late 2023 using a similar playbook, prosecutors said.

This time, however, one of them made a costly mistake. Serrano failed to conceal his IP address when creating an account on a cryptocurrency exchange to hold nearly $30 million in stolen crypto, according to prosecutors. Investigators linked the IP address to a home in Encino, California, that Serrano was renting for $47,500 a month.

Serrano was vacationing in the Maldives when investigators identified him as a suspect. Lam was in Los Angeles, where he and friends spent $4 million at nightclubs in one month, authorities say. Chetal gifted a Lamborghini to his parents and hid a duffel bag filled with $500,000 in cash in their laundry machine.

A Kidnapping and the Unraveling

Word of the windfall spread quickly in crypto scammers' circles. A week after the big score, Chetal's parents were driving in Danbury, Connecticut, when several masked men cut them off, forced them out of their new car, beat Chetal's father with a baseball bat, shoved the couple into a van, and bound their hands.

The captors, from Miami, had intended to use Chetal's parents as leverage to extort him into giving up his share of the stolen crypto. The ransom plot fell apart when witnesses notified police, who apprehended the carjackers.

The FBI searched Chetal's apartment in Brunswick, New Jersey, on Sept. 9, 2024, and found $37 million in stolen crypto in his possession. He agreed to cooperate with the investigation.

Lam was attracting attention of his own, spending hundreds of thousands of dollars a night at clubs and tossing handbags worth tens of thousands of dollars to women in the crowds. He also used stolen cryptocurrency to buy a $2 million watch and more than 30 cars, including custom Porsches, Lamborghinis, and Ferraris, according to the FBI.

"This luxury lifestyle, of which so many young men and women could only dream, was just built on a foundation of fraud," prosecutor William Hart said during a recent sentencing hearing for a money laundering co-defendant.

The Arrests

Serrano was wearing a $500,000 watch when FBI agents arrested him at Los Angeles International Airport on Sept. 18, 2024. He initially professed his innocence but soon admitted to having roughly $20 million of the D.C. man's stolen crypto, prosecutors said.

Lam was arrested at one of his Miami mansions the same day. An off-duty law enforcement officer had tipped off Lam that authorities were on the way to arrest him, according to the indictment.

"We always talked about what it would be like if I were to go down, but never thought it would be this crazy," Lam told associates from jail on a recorded call, according to his indictment.

The judge at Lam's initial court appearance in Miami sounded astonished by a prosecutor's summary of his lavish spending.

"I could only think of Ferris Bueller gone bad," U.S. Magistrate Alicia Valle said, referring to the school-skipping protagonist of the 1986 movie "Ferris Bueller's Day Off."

Lam's capture did not stop the splurging. Ferro, who pleaded guilty to a racketeering conspiracy charge last year, used stolen funds to cover Lam's legal expenses.

Where the Case Stands

Eighteen defendants have been charged, and Lam would be the 11th to plead guilty. At Lam's first court appearance, a prosecutor estimated that his sentencing guidelines would recommend a prison term of at least 14 years upon conviction.

U.S. District Judge Colleen Kollar-Kotelly, who presides over Lam's case, has already sentenced three of his co-conspirators, handing two money launderers prison terms of approximately six years each.

Chetal pleaded guilty to conspiracy charges in November 2024 and awaits sentencing. Serrano's charges remain pending.

Tucker Desmond, who pleaded guilty to destroying evidence of other plotters' crimes, was sentenced to probation. Desmond apologized at his sentencing hearing in March, saying he "got obsessed with the image of success rather than actually becoming a hard-working individual myself."

Ferro declined to address the court during his sentencing hearing in May. His attorney, Kevin Wilson, described the co-defendants as mischievous "young kids," but the judge did not accept that as an excuse.

"Being young only goes so far," Kollar-Kotelly said.

This story was originally featured on Fortune.com.