263M RICO Social Engineering Crypto Theft Gang (DC — 2024-2026 Prosecutions)
Auto-generated score, not yet verified against the scoring model. Under review — treat as indicative, not a verdict.
anchored·2awFmF…nn39Summary
The Social Engineering Enterprise (SEE) is a multi-state organized crime network that prosecutors allege stole over $263 million in cryptocurrency from multiple victims between October 2023 and May 2025, including over 4,100 Bitcoin from a single Washington, D.C. resident on August 18, 2024 — described by federal prosecutors as one of the largest single-victim cryptocurrency thefts in U.S. history. Formed through online gaming platform connections and prosecuted under the federal RICO statute in the U.S. District Court for the District of Columbia, the enterprise had 17 individuals charged as of late 2025, with 9 guilty pleas entered and at least two sentencings completed as of mid-2026.
Connected Entities
9 entities · 60 linked investigations- Ethereum→mentioned with→Bitcoin(60%)
- 263M RICO Social Engineering Crypto Theft Gang (DC — 2024-2026 Prosecutions)→mentioned with→Monero(75%)
- 263M RICO Social Engineering Crypto Theft Gang (DC — 2024-2026 Prosecutions)→mentioned with→Malone Lam(85%)
- 263M RICO Social Engineering Crypto Theft Gang (DC — 2024-2026 Prosecutions)→mentioned with→Bitcoin(70%)
- 263M RICO Social Engineering Crypto Theft Gang (DC — 2024-2026 Prosecutions)→mentioned with→Ethereum(60%)
- 263M RICO Social Engineering Crypto Theft Gang (DC — 2024-2026 Prosecutions)→mentioned with→ZachXBT(70%)
- Monero→mentioned with→Bitcoin(60%)
- Monero→mentioned with→ZachXBT(65%)
- ZachXBT→mentioned with→Ethereum(70%)
- ZachXBT→mentioned with→Malone Lam(80%)
- + 23 more
Timeline(12 events)
October 2023
Social Engineering Enterprise (SEE) begins operating, per DOJ charging documents (approximate date; indictment states 'no later than October 2023').
DOJ / IRS-CI press releaseFebruary 2024
Marlon Ferro (GothFerrari) breaks into a home in Winnsboro, Texas and steals a hardware cryptocurrency wallet containing approximately 100 Bitcoin (over $5 million at the time).
IRS-CI: GothFerrari sentencing press releaseJuly 2024
Malone Lam and associates allegedly steal over $14 million in cryptocurrency from a second victim. Marlon Ferro conducts a second home invasion in New Mexico to steal a hardware wallet while Lam allegedly monitors the victim's location via iCloud.
TRM Labs analysis; IRS-CI sentencing press release18 August 2024
Enterprise members including Malone Lam, Jeandiel Serrano, and Danish Zulfiqar conduct social engineering attack on a Washington, D.C. victim (identified in reporting as a Genesis bankruptcy creditor). Over 4,100 Bitcoin worth approximately $263 million is stolen in a single operation — one of the largest single-victim cryptocurrency thefts in U.S. history.
DOJ / IRS-CI; NBC News; ZachXBT investigation19 September 2024
Malone Lam arrested in Miami. Jeandiel Serrano arrested. Both initially charged with conspiracy to commit wire fraud and conspiracy to launder monetary instruments. ZachXBT credited with assisting in the tracing of funds that led to the arrests.
NBC News; The Record from Recorded Future News16 May 2025
DOJ unseals superseding indictment charging 12 additional defendants with RICO conspiracy, wire fraud, money laundering, and obstruction. Total number of charged defendants rises to 17. Enterprise operating period described as October 2023 through March/May 2025.
DOJ USAO-DC press release; CoinDeskOctober 2025
Marlon Ferro (GothFerrari) pleads guilty to RICO conspiracy.
IRS-CI: GothFerrari sentencing press releaseNovember 2025
Kunal Mehta (aka 'Shrek,' 'Papa,' 'The Accountant'), age 45, pleads guilty to RICO conspiracy, the eighth defendant to do so. He admits to laundering at least $25 million.
IRS-CI; DL News3 December 2025
Nicholas Dellecave (aka 'Nic,' 'Souja') arrested in Miami on RICO conspiracy charge filed in Second Superseding Indictment.
IRS-CI: Guilty plea and superseding indictment press release8 December 2025
Evan Tangeman, age 22, of Newport Beach, California pleads guilty to RICO conspiracy, the ninth defendant to do so. He admits to laundering at least $3.5 million and to directing destruction of digital evidence.
IRS-CI; DecryptDecember 2025
Mustafa Ibrahim (aka 'Krust') and Danish Zulfiqar (aka 'Danny,' 'Meech') arrested in Dubai on RICO conspiracy charges filed in Second Superseding Indictment.
IRS-CI: Guilty plea and superseding indictment press release24 April 2026
Evan Tangeman sentenced to 70 months in federal prison plus three years supervised release by U.S. District Court for the District of Columbia.
IRS-CI: California money launderer sentenced in DC to 70 monthsDecision Log
- hash: 78AegoZ44KPsCNKowAZ8gmGPYPX8bXDQDLjXSGFodisc
- hash: DjrBKyQU9kyvDuZ1N9iwJXyRttYtmGcw39owZuQ85kGr
- hash: DaTgXtkPhqVtFE6crjiqd7jPLjTj7zx4jaQ1dEDPtNgv
- hash: veSHNiZaR549Xmi3oLdj2feTijKBHEXCJZVwoug5bnF
This investigation is cryptographically anchored to the Solana blockchain (4 events). 18 of 20 cited source URLs have an Internet Archive snapshot.
model: claude-sonnet-4-6
generated: 8/13/2026, 5:12:48 PM
last updated: 8/25/2026, 5:14:15 PM
5 viewsavoid.net — verified advice for a post-truth world