Cryptocurrency heist ringleader pleads guilty to $245M theft after recruiting crew on Minecraft

Malone Lam, a 22-year-old Singaporean national living in Miami, pleaded guilty to one count of racketeering conspiracy after leading a crew of at least 12 individuals who stole hundreds of millions of dollars in cryptocurrency. The operation ran from October 2023 to May 2025, with individual thefts ranging from roughly $800,000 to a single victim losing more than $245 million. Lam's principal roles were victim selection and social engineering support, including obtaining databases of high-net-worth individuals with cryptocurrency holdings. He also triggered account access notifications on victims' devices to make them believe their accounts were under attack, priming them for the next stage.

The attack architecture was a hybrid of remote social engineering and physical intrusion. Other crew members posed as representatives of Google, Yahoo, Coinbase, Gemini, and other platforms to convince victims to surrender personal information and access codes. Once inside, they searched for cryptocurrency accounts, seed phrases, and passwords. In one case where a victim stored holdings in a hardware wallet, the crew escalated beyond digital methods and had Marlon Ferro physically break into the house to steal it, demonstrating that offline storage alone did not stop a determined attacker willing to cross into physical crime.

Laundering relied on exchanges with lax KYC requirements, according to court documents. The proceeds funded extravagant spending, including up to $500,000 in a single nightclub evening, watches priced between $100,000 and $500,000, exotic cars worth up to $3.8 million, and rented properties in Miami, Los Angeles, and the Hamptons. The scale of spending illustrates how weak compliance at certain exchange endpoints allowed large volumes of stolen cryptocurrency to be converted into tangible assets over nearly two years.

For engineers building authentication or custody systems, the case underscores that social engineering remains the primary entry vector and that platform impersonation is effective enough to bypass technical controls entirely. The escalation to physical burglary also shows that attackers will move past digital defenses when the target value justifies it. The laundering path through low-KYC exchanges points to compliance infrastructure as a choke point that failed to detect or stop the flow of hundreds of millions in stolen funds.