Malone Lam $245M Bitcoin Heist: How It Worked And Plea (2026)
Malone Lam, a 22-year-old Singapore citizen, pleaded guilty in September 2026 to a federal racketeering conspiracy charge tied to a cryptocurrency theft worth more than $245 million.
Prosecutors say the crew drained a Washington, D.C. victim’s wallets in August 2024 by posing as Google and Gemini support staff.
This article explains how the scam worked, where the money went and what has happened in court so far.
The Malone Lam case at a glance
| Item | Fact |
|---|---|
| Defendant | Malone Lam, 22, Singapore citizen |
| Charge | One count of participating in a RICO conspiracy |
| Plea date | September 8, 2026 |
| Court | U.S. District Court, District of Columbia, Judge Colleen Kollar-Kotelly |
| Amount stolen and laundered | More than $245 million in cryptocurrency |
| Biggest single theft | More than 4,100 bitcoin from one victim, August 2024 |
| Next court date | Status hearing December 8, 2026 (no sentencing date set) |
The figures come from the U.S. Attorney’s Office for D.C. and Associated Press reporting, and the older $230 million figure was an estimate of the bitcoin’s value at the time.
How did the social engineering attack work?
Prosecutors say two people posed as a Google representative and a Gemini exchange representative and told the victim his accounts were under attack.
They used that pressure to get access to his Google Drive and security codes, according to AP reporting.
Cointelegraph’s timeline adds that the victim was guided to use the AnyDesk screen-sharing tool, which exposed a bitcoin private key.
The coins were drained in the early hours of August 19, 2024, in Cointelegraph’s account, while AP gives the date of the theft as August 18, so the exact day varies by source.
What is the timeline of the case?
AP’s September 2026 report, carried by SecurityWeek, gives the main dates.
| Date | Event |
|---|---|
| Aug. 18, 2024 | Callers posing as Google and Gemini staff get a victim’s Google Drive access and security codes; over 4,100 bitcoin taken |
| About a week later | Masked men carjack Veer Chetal’s parents in Danbury, Connecticut |
| Sept. 9, 2024 | FBI agents search Chetal’s New Jersey apartment and find $37 million in stolen crypto |
| Sept. 18, 2024 | Serrano arrested at Los Angeles airport; Lam arrested at a Miami mansion |
| Nov. 2024 | Chetal pleads guilty to conspiracy |
| Mar. 2026 | Tucker Desmond sentenced to probation |
| Sept. 8, 2026 | Lam pleads guilty |
| Dec. 8, 2026 | Status hearing set |
Who was behind the crew?
The Justice Department says Lam organized the enterprise, identified targets and coordinated the other conspirators.
It says the group began no later than October 2023, ran through at least May 2025, and grew out of connections made on online gaming platforms.
Members used social engineering and occasional home break-ins to get information that let them drain victims’ wallets.
How was the stolen bitcoin laundered?
Cointelegraph reports the funds were split among three people and sent to more than 15 exchanges.
The crypto was swapped repeatedly among bitcoin, litecoin, ether and Monero, a privacy-focused coin.
AP says money launderers also converted the proceeds into government-issued cash.
What did they spend the money on?
| Item | Reported detail | Source |
|---|---|---|
| Cars | More than 30, including custom Porsches, Lamborghinis and Ferraris | AP |
| Watch | $2 million | AP |
| One nightclub evening | $569,000 in Los Angeles | AP |
| Housing | Rentals in Los Angeles, the Hamptons and Miami | Justice Department |
| Other | Private jets, a private security team and designer goods | Justice Department |
The spending spree lasted about a month, per AP.
What did investigators find and seize?
AP reports the FBI found large amounts of stolen crypto and cash at the defendants’ homes.
| Person | Reported find |
|---|---|
| Veer Chetal | $37 million in stolen crypto and $500,000 in cash in a laundry machine |
| Jeandiel Serrano | A $500,000 watch and a rented Encino house at $47,500 a month; he admitted holding roughly $20 million of the stolen crypto |
| Malone Lam | A $2 million watch and more than 30 cars, per the FBI |
The Justice Department’s plea announcement describes cars valued from $100,000 to $3.8 million and watches valued from $100,000 to more than $500,000.
The same announcement says nightclub services cost up to $500,000 per evening, and AP reports the group spent $4 million at nightclubs in one month.
None of the sources I checked state how much of the stolen bitcoin has been recovered, or any forfeiture or restitution amounts.
How did investigators catch them?
AP reports that Jeandiel Serrano failed to hide his IP address when opening an exchange account holding nearly $30 million, which traced to a rented house in Encino, California.
Blockchain investigator ZachXBT tracked the transactions and published a private recording of the group reacting to the haul, according to Cointelegraph.
FBI agents arrested Serrano at Los Angeles International Airport and arrested Lam at a Miami mansion in September 2024.
AP says an off-duty officer had tipped Lam off before the arrest.
Which agencies and courts handled the case?
| Item | Detail |
|---|---|
| Lead prosecutors’ office | U.S. Attorney’s Office for D.C. |
| Lead investigators | FBI Washington Field Office and IRS Criminal Investigation |
| Support | FBI Los Angeles and Miami offices, plus U.S. Attorney’s Offices in Central California, Southern Florida and New Jersey |
| Case number | 24cr417 |
| Where participants were based | California, Connecticut, New York, Florida and abroad |
The Justice Department says the scheme ran from no later than October 2023 through at least May 2025.
What happened to the other defendants?
| Person | Status reported by AP in September 2026 |
|---|---|
| Veer Chetal | Pleaded guilty to conspiracy in November 2024, cooperating, awaiting sentencing |
| Jeandiel Serrano | Charges still pending |
| Tucker Desmond | Pleaded guilty to destroying evidence, sentenced to probation |
| Other defendants | 18 charged in total, and Lam was the 11th to plead guilty |
AP also reported that Judge Kollar-Kotelly had sentenced three co-conspirators, including two money launderers who each received about six years.
AP says another defendant, identified as Ferro, pleaded guilty to racketeering conspiracy and used stolen funds to pay Lam’s legal expenses.
His lawyer called the defendants “young kids,” and AP reports the judge rejected that description.
Was there violence connected to the case?
About a week after the theft, masked men from Miami carjacked Chetal’s parents in Connecticut and beat his father, AP reports.
Prosecutors said the plan was to extort Chetal over his share, and the carjackers were arrested after witnesses alerted police.
What happens next for Lam?
No sentencing date has been announced, and the judge set a status hearing for December 8, 2026.
AP reported that Lam faces up to 20 years in prison, while at his first court appearance a prosecutor estimated sentencing guidelines of at least 14 years.
Anyone not yet convicted, including Serrano, is presumed innocent unless and until a court rules otherwise.
What can everyday users learn from this case?
- Callers can be spoofed: a call claiming to be Google or an exchange is not proof of identity.
- Remote access tools hand over control: do not install screen-sharing software at a caller’s request.
- Hang up and verify: contact the company through its official website or app.
For related reading, see how to block robocalls and spam calls and the BitGrail breach.
Sources: the U.S. Attorney’s Office for D.C. plea announcement, SecurityWeek (AP) and Cointelegraph.