Bitcoin Heist Confession on the Table: A $245 Million Ransom, One Typo, and a Las Vegas Penthouse

Malone Lam, the 22-year-old Singaporean, is scheduled to appear in federal court in Washington on Tuesday. The hearing concerns a plea agreement, with the government’s indictment identifying him as an organizer of a crew that took $245 million in Bitcoin from a single investor. Court filings in the District of Columbia list a man identified only as Victim-7, who was at his home in Washington when callers claiming to be from Google and Gemini warned him his accounts were under attack. The callers talked him into installing remote desktop software and surrendering his security codes, then moved more than 4,100 Bitcoin out of his wallets. Lam’s arrest in Los Angeles in September came after a traffic stop, during which police found him in a Lamborghini with a key to a penthouse apartment in Las Vegas. Authorities have not disclosed the value of the recovered assets, but a separate civil forfeiture complaint from the U.S. Attorney’s Office for the District of Columbia lists 11 accounts holding a total of more than $2.8 billion in cryptocurrency and stablecoins, including roughly $30 million in Tether and $8 million in Ether. A forensic review of Lam’s iCloud account, according to the complaint, uncovered a voice memo in which a man says, “bro, this is crazy, I’m literally holding 4,400 Bitcoin.” The same iCloud review found a photo of a man posing next to a Bentley with a custom “MALONE” license plate, alongside a note that read, “If Wealth is a crime, let God be the judge.” Lam has been held without bond since his arrest, and his attorneys have not commented on the plea hearing. The Social Engineering Enterprise, as the indictment names the racketeering group, operated with a division of labor that included database hackers, callers, and money launderers. A member known as “Wiz” and another called “Box” are named as leaders; a co-defendant, Jeandiel Serrano, 21, of Los Angeles, was arrested the same day as Lam. The group’s origins trace to friendships formed in online gaming, and its members used stolen crypto databases to select targets. On Aug. 17, 2024, the day after the Bitcoin was taken, a co-conspirator sent a message to a third party, according to the court filing: “1000 btc??? from a single person? damn wtf.” The message was followed by a request for help converting the funds, and the third party declined. When a victim kept coins in a hardware wallet, the group resorted to home invasions. In November 2024, two members in their early 20s were arrested after a violent home invasion in North Carolina; one of them, Greavys, had previously been involved in a similar robbery in Texas. The indictment describes an attempt to steal another victim’s cryptocurrency in April 2024, when a group member traveled to Miami and posed as a courier for a Bitcoin exchange. The courier was handed a hardware wallet, but the suspects failed to crack its passphrase, and the victim later moved the funds. An earlier attack on a victim in Massachusetts involved a SIM swap, in which the attackers took over the victim’s phone number and drained a wallet holding $1.3 million. The Washington victim’s identity remains protected under court seal, and the plea hearing for Lam is listed on the docket as a change of plea, indicating he may enter a guilty plea to one or more charges. A status conference for the other 17 defendants is set for later this month. The case is assigned to Judge Tanya S. Chutkan, who has not yet ruled on a motion by the defense to suppress evidence obtained from the iCloud search. Prosecutors have submitted a letter to the court summarizing the plea negotiations, but the terms have not been made public.