Malone Lam, the Singaporean national accused of organizing one of the largest single-victim cryptocurrency thefts ever prosecuted in the United States, is set to enter a guilty plea in Washington federal court on September 8. The plea, if accepted by the court, would resolve the case against the alleged organizer without trial, though sentencing would follow at a later hearing under federal guidelines and any terms negotiated in the plea agreement.

Lam and other members of the group fraudulently obtained more than 4,100 BTC from a Washington, D.C. investor on August 18, 2024. Federal prosecutors later valued the stolen Bitcoin at approximately $263 million at the time of the theft. Lam, 22, who operated online under aliases including "King Greavys," "$$" and "Anne Hathaway," has been in custody since his arrest in September 2024.

Fake Google and Gemini Calls Opened Access to 4,100 BTC

The theft was carried out through social engineering rather than any blockchain or exchange vulnerability. Members of the group contacted the victim while impersonating Google and Gemini support personnel, convincing him that his accounts were under attack. The operation ultimately gained access to his Google Drive and security credentials before the Bitcoin was transferred out. The case is a high-profile example of a broader pattern in which criminals target the human layer — account credentials and personal information — rather than exploiting flaws in cryptocurrency protocols themselves, leaving victims of legitimate transfers with fewer recovery options than traditional financial fraud.

The wider racketeering case stems from an online network that assigned specialized roles to database hackers, target identifiers, callers, money launderers and organizers. According to the Department of Justice, stolen cryptocurrency moved through exchanges, mixers, pass-through wallets and peel chains before portions were converted into cash. The use of the RICO statute — a framework originally developed to prosecute organized crime — in this case reflects how federal prosecutors have increasingly applied racketeering charges to loosely coordinated online criminal networks, enabling them to reach every role in the operation rather than only those who executed the theft directly.

The attack method remains active across the crypto industry. Two defendants in a separate support impersonation scheme pleaded guilty this year after fake support calls helped them obtain access to cryptocurrency worth about $13 million.

Stolen Bitcoin Funded Cars, Jets and a $569K Night Out

The group converted part of the stolen cryptocurrency into an unusually visible luxury-spending operation. Enterprise members rented mansions in Los Angeles, Miami and the Hamptons, chartered private jets and acquired a fleet of exotic vehicles valued as high as $3.8 million each. Luxury watches, designer clothing and nightclub spending consumed millions more. That spending pattern — high-value, traceable assets purchased soon after the theft — is the kind of activity blockchain analytics and financial investigators can use to follow laundered funds, and prosecutors have cited the group's expenditures as evidence in the racketeering case.

Lam personally spent more than $569,000 during a single Los Angeles nightclub visit following the August theft. Other members purchased nightclub packages approaching $500,000 per evening and watches worth hundreds of thousands of dollars.

The same Bitcoin theft later spilled over into physical crime. Adam Iza pleaded guilty in a case tied to an attempted robbery and kidnapping targeting relatives of an individual connected to the stolen BTC. Three additional men were later charged over another robbery plot involving the same underlying fortune.

RICO Case Has Already Produced Prison Sentences

Multiple members of the enterprise have already pleaded guilty to racketeering, fraud or money-laundering charges. Evan Tangeman was sentenced to 70 months in federal prison in April after admitting he helped launder at least $3.5 million for the organization. He also obtained luxury properties for the group and directed another member to destroy digital devices after Lam's arrest. His device-destruction admission figures in the case as an obstruction-related detail, illustrating the additional liability participants face for actions taken after an arrest.

Lam's plea-agreement hearing is scheduled before U.S. District Judge Colleen Kollar-Kotelly on September 8, nearly two years after the 4,100 BTC theft that became the centerpiece of the federal racketeering prosecution. Beyond the outcome for Lam, the sentencing of already-convicted members provides an early indicator of the prison terms courts have imposed in this case, which remains one of the most significant single-victim crypto theft prosecutions brought by the U.S. government to date.