Audit log

Every state-changing event for 263M RICO Social Engineering Crypto Theft Gang (DC — 2024-2026 Prosecutions): moderation decisions on community submissions, plus corrections and updates from the news pipeline. URL-based decisions are designed to carry three independent witnesses — the original source, an Internet Archive snapshot, and a Solana memo signed by our publicly-disclosed publisher key. Archive coverage is still being backfilled, so each decision below reports its own snapshot status rather than assuming one exists.

1. #1publishby system:backfill

   2026-08-13 17:13:03Z
   Score: ? → ? (no score change)
   anchorpending

   chain

   ●—

   hash

   veSHNiZaR549…woug5bnFcopysha256 → base58

   verifying row…

   canonical bytes (36706 B) ▸

   {"actor":"system:backfill","investigation_id":"6fbfea24-1ca0-4a70-93c0-6957bd54d09b","kind":"publish","page_slug":"263m-rico-social-engineering-crypto-theft-gang-dc-2024-2026-prosecutions","published_at":"2026-08-13T17:13:03.070Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"263M RICO Social Engineering Crypto Theft Gang (DC — 2024-2026 Prosecutions)","sections":[{"content":"Federal prosecutors have charged members of an organized criminal network, internally referred to as the 'Social Engineering Enterprise' (SEE), with racketeering conspiracy under the Racketeer Influenced and Corrupt Organizations (RICO) Act. According to the U.S. Attorney's Office for the District of Columbia, the enterprise began no later than October 2023 and continued through at least May 2025. Participants are alleged to have been based in California, Connecticut, New York, Florida, and abroad, with the enterprise growing from friendships developed on online gaming platforms. The network divided labor among specialized roles: database hackers who breached websites or purchased stolen data on the dark web; target identifiers who analyzed that data to locate high-net-worth cryptocurrency holders; 'callers' who impersonated customer support staff at crypto exchanges and technology companies to socially engineer victims; money launderers who converted stolen cryptocurrency to cash; and residential burglars who conducted physical home invasions to steal hardware cryptocurrency wallets. U.S. Attorney Jeanine Ferris Pirro stated that 'this criminal enterprise was built on greed so brazen it borders on the cartoonish,' referencing the defendants' documented spending on luxury goods, nightclub outings reportedly reaching $500,000 per evening, exotic automobiles, and high-end rental properties.","heading":"Criminal Enterprise Overview","severity":"critical","sources":[{"credibility":1,"name":"IRS-CI: Guilty plea and superseding indictment announced in social engineering scheme that stole $263 million in cryptocurrency","type":"regulatory","url":"https://www.irs.gov/compliance/criminal-investigation/guilty-plea-and-superseding-indictment-announced-in-social-engineering-scheme-that-stole-263-million-in-cryptocurrency"},{"credibility":2,"name":"TRM Labs: DOJ Uses Organized Crime Statute in $263 Million Cryptocurrency Theft, Money Laundering and Home Invasion Conspiracy","type":"research","url":"https://www.trmlabs.com/resources/blog/doj-uses-organized-crime-statute-in-263-million-cryptocurrency-theft-money-laundering-and-home-invasion-conspiracy"},{"credibility":1,"name":"IRS-CI: California money launderer sentenced in DC to 70 months for role in scheme that stole $263 million","type":"regulatory","url":"https://www.irs.gov/compliance/criminal-investigation/california-money-launderer-sentenced-in-dc-to-70-months-for-role-in-scheme-that-stole-263-million"}]},{"content":"On August 18, 2024, members of the enterprise allegedly contacted a victim in Washington, D.C. — later identified in reporting as a creditor in the Genesis Capital bankruptcy proceedings — and through a phone-based social engineering attack obtained over 4,100 Bitcoin, valued at approximately $263 million at the time of the theft. As reported by on-chain investigator ZachXBT and confirmed in subsequent DOJ charging documents, the attackers impersonated support staff from Google and the Gemini cryptocurrency exchange, falsely claiming the victim's accounts had been compromised. They persuaded the victim to download AnyDesk remote desktop software, allowing the attackers to view the victim's screen, steal private keys to a Bitcoin Core wallet, and drain the funds. Bitcoin was then rapidly laundered through more than 15 exchanges, converted across multiple asset types including Monero, routed through cryptocurrency mixers, and split among enterprise members. Federal prosecutors have described the theft as 'one of the largest cryptocurrency thefts from a private individual in the history of the United States.' As of December 2025, the stolen Bitcoin's value had appreciated to over $368 million. Malone Lam, the alleged ringleader, and Jeandiel Serrano, who conducted the initial call, were the primary actors in this specific theft. Danish Zulfiqar was also identified in the superseding indictment as a participant.","heading":"Primary Theft: August 18, 2024 — Washington, D.C. Victim","severity":"critical","sources":[{"credibility":1,"name":"IRS-CI: Guilty plea and superseding indictment announced in social engineering scheme that stole $263 million in cryptocurrency","type":"regulatory","url":"https://www.irs.gov/compliance/criminal-investigation/guilty-plea-and-superseding-indictment-announced-in-social-engineering-scheme-that-stole-263-million-in-cryptocurrency"},{"credibility":2,"name":"Courthouse News: $230 million crypto scam one of largest single victim thefts in history, prosecutors say","type":"news_article","url":"https://www.courthousenews.com/230-million-crypto-scam-one-of-largest-single-victim-thefts-in-history-prosecutors-say/"},{"credibility":2,"name":"CoinDesk: U.S. DOJ Charges 12 With $263M Crypto Theft Linked to Genesis Creditor","type":"news_article","url":"https://www.coindesk.com/policy/2025/05/16/doj-charges-12-with-263m-crypto-theft-linked-to-genesis-creditor"},{"credibility":1,"name":"NBC News: Miami man among 2 charged in $230 million cryptocurrency theft and laundering scam","type":"news_article","url":"https://www.nbcnews.com/news/us-news/miami-man-2-charged-230-million-cryptocurrency-theft-laundering-scam-rcna171952"}]},{"content":"The case represents one of the first known applications of the federal RICO statute to a cryptocurrency-native criminal network. The superseding indictment charges defendants with: (1) racketeering conspiracy under 18 U.S.C. § 1962(d); (2) wire fraud conspiracy; (3) money laundering; and (4) obstruction of justice. All proceedings are in the U.S. District Court for the District of Columbia before Judge Colleen Kollar-Kotelly. The U.S. Attorney's Office for D.C., FBI Washington Field Office (Criminal and Cyber Division), IRS Criminal Investigation, FBI Los Angeles, and FBI Miami have all participated in the investigation. On-chain investigator ZachXBT is credited by investigators with assisting in the initial tracing of stolen funds that led to the first arrests in September 2024. As of December 2025, 17 individuals in total had been charged across initial indictments and superseding indictments. Nine had entered guilty pleas. Malone Lam, as the alleged ringleader, remained in pre-trial detention with plea negotiations ongoing as of late 2025 and an October 2025 trial date having been set.","heading":"RICO Charges and Prosecution","severity":"critical","sources":[{"credibility":1,"name":"DOJ USAO-DC: Additional 12 Defendants Charged in RICO Conspiracy for over $263 Million Cryptocurrency Thefts","type":"court_filing","url":"https://www.justice.gov/usao-dc/pr/additional-12-defendants-charged-rico-conspiracy-over-263-million-cryptocurrency-thefts"},{"credibility":2,"name":"TRM Labs: DOJ Uses Organized Crime Statute in $263 Million Cryptocurrency Theft, Money Laundering and Home Invasion Conspiracy","type":"research","url":"https://www.trmlabs.com/resources/blog/doj-uses-organized-crime-statute-in-263-million-cryptocurrency-theft-money-laundering-and-home-invasion-conspiracy"},{"credibility":2,"name":"The Record: California man pleads guilty to RICO charges as DOJ indicts crypto theft gang","type":"news_article","url":"https://therecord.media/california-man-pleads-guilty-rico-charges-crypto-theft"}]},{"content":"Malone Lam (also known as 'Anne Hathaway,' 'Greavys,' and '$$$'), a Singaporean national born July 19, 2004, is alleged to have been the ringleader of the enterprise. He was arrested in Miami on September 19, 2024, and has remained in pretrial detention. As of late 2025, plea negotiations were ongoing; a January 2026 hearing was scheduled. Jeandiel Serrano (also known as 'Box'), age 21, was the alleged co-caller in the August 2024 Washington D.C. theft, impersonating Google and Gemini support staff. He was charged with conspiracy to commit wire fraud and conspiracy to launder monetary instruments. His attorney confirmed plea negotiations with the DOJ. Veer Chetal (also known as 'Wiz'), age 19, pleaded guilty to conspiracy charges involving fraud and money laundering and agreed to testify against Malone Lam. Marlon Ferro (also known as 'GothFerrari'), age 20, of Santa Ana, California, served as the enterprise's physical burglar. He broke into a home in Winnsboro, Texas in February 2024 (stealing hardware wallets containing approximately 100 Bitcoin worth over $5 million) and conducted a second home invasion in New Mexico in July 2024, with Lam allegedly monitoring the victim's location via iCloud in real time. Ferro pleaded guilty in October 2025 to RICO conspiracy and was sentenced to 78 months in prison plus $2.5 million in restitution. Kunal Mehta (also known as 'Papa,' 'The Accountant,' and 'Shrek'), age 45, of Irvine, California, was the eighth defendant to plead guilty, admitting to laundering at least $25 million in proceeds as part of the RICO conspiracy. His guilty plea was accepted in November 2025. Evan Tangeman (also known as 'E,' 'Tate,' and 'Evan|Exchanger'), age 22, of Newport Beach, California, was the ninth defendant to plead guilty, on December 8, 2025, to RICO conspiracy. He admitted to laundering at least $3.5 million, facilitating luxury rental properties for enterprise members in Los Angeles, Miami, and the Hamptons at $40,000 to $80,000 per month using false names, and to directing co-defendant Tucker Desmond to destroy digital devices following initial arrests. Tangeman was sentenced on April 24, 2026 to 70 months in prison plus three years of supervised release. Hamza Doost and Joel Cortez, both age 21, are alleged to have operated unlicensed crypto-to-cash conversion services for the enterprise. Tucker Desmond was directed by Tangeman to destroy digital devices belonging to enterprise members. Nicholas Dellecave (also known as 'Nic' and 'Souja') was charged in the Second Superseding Indictment unsealed in December 2025 with RICO conspiracy and arrested in Miami on December 3, 2025. Mustafa Ibrahim (also known as 'Krust') was charged in the Second Superseding Indictment and arrested in Dubai. Danish Zulfiqar (also known as 'Danny' and 'Meech') was charged in the Second Superseding Indictment and arrested in Dubai. All charges against defendants who have not entered guilty pleas are allegations; no finding of guilt has been made for those individuals.","heading":"Key Defendants and Case Status","severity":"critical","sources":[{"credibility":1,"name":"IRS-CI: California money launderer sentenced in DC to 70 months for role in scheme that stole $263 million","type":"regulatory","url":"https://www.irs.gov/compliance/criminal-investigation/california-money-launderer-sentenced-in-dc-to-70-months-for-role-in-scheme-that-stole-263-million"},{"credibility":1,"name":"IRS-CI: GothFerrari sentenced to 78 months in prison for role in massive cryptocurrency heist","type":"regulatory","url":"https://www.irs.gov/compliance/criminal-investigation/gothferrari-sentenced-to-78-months-in-prison-for-role-in-massive-cryptocurrency-heist"},{"credibility":1,"name":"IRS-CI: Cryptocurrency money launderer pleads guilty to RICO conspiracy in scheme that stole $263 million in crypto","type":"regulatory","url":"https://www.irs.gov/compliance/criminal-investigation/cryptocurrency-money-launderer-pleads-guilty-to-rico-conspiracy-in-scheme-that-stole-263-million-in-crypto"},{"credibility":1,"name":"IRS-CI: Guilty plea and superseding indictment announced in social engineering scheme that stole $263 million in cryptocurrency","type":"regulatory","url":"https://www.irs.gov/compliance/criminal-investigation/guilty-plea-and-superseding-indictment-announced-in-social-engineering-scheme-that-stole-263-million-in-cryptocurrency"},{"credibility":2,"name":"CoinTelegraph: Crypto Burglar Who Broke into Homes to Steal Hardware Wallets Gets 78 Months","type":"news_article","url":"https://cointelegraph.com/news/california-man-sentenced-to-78-months-in-250m-crypto-theft-conspiracy"},{"credibility":2,"name":"Decrypt: Ninth Defendant Pleads Guilty in $263M Crypto Social-Engineering Scheme","type":"news_article","url":"https://decrypt.co/351576/ninth-defendant-pleads-guilty-263m-crypto-scheme"},{"credibility":2,"name":"DL News: Shrek pleads guilty over role in $263m crypto theft","type":"news_article","url":"https://www.dlnews.com/articles/regulation/shrek-pleads-guilty-ove-role-in-263-million-usd-crypto-theft/"},{"credibility":2,"name":"Crypto Times: California Man Gets 70 Months for $263M Cartoonish Crypto RICO Fraud","type":"news_article","url":"https://www.cryptotimes.io/2026/04/27/california-man-gets-70-months-for-263m-cartoonish-crypto-rico-fraud/"}]},{"content":"According to charging documents and guilty plea admissions, the enterprise employed sophisticated layering techniques to launder stolen cryptocurrency. Methods included: cryptocurrency mixers; peel chains (rapid sequential transfers across wallets); cross-chain swaps converting Bitcoin to Ethereum and other assets via decentralized finance platforms; conversion to privacy coin Monero to obscure transaction trails; cash-out via high-risk, Asia-based exchanges; and the use of unlicensed crypto-to-cash brokers operating within the enterprise. Physical cash was transported by shipping bulk currency hidden inside Squishmallow stuffed animals through the U.S. Postal Service. Defendants also registered exotic vehicles in shell company names to conceal ownership, and obtained luxury rental properties using false or stolen identity documents. Kunal Mehta admitted to laundering at least $25 million; Evan Tangeman admitted to laundering at least $3.5 million. Proceeds were spent on nightclub outings reportedly reaching $500,000 per evening; luxury timepieces valued between $100,000 and $500,000; 28 exotic vehicles valued between $100,000 and $3.8 million each; private jet charters; personal security teams; and high-end rental homes in Los Angeles, Miami, and the Hamptons valued at $4 million to $9 million.","heading":"Money Laundering and Proceeds Dissipation","severity":"critical","sources":[{"credibility":2,"name":"TRM Labs: DOJ Uses Organized Crime Statute in $263 Million Cryptocurrency Theft, Money Laundering and Home Invasion Conspiracy","type":"research","url":"https://www.trmlabs.com/resources/blog/doj-uses-organized-crime-statute-in-263-million-cryptocurrency-theft-money-laundering-and-home-invasion-conspiracy"},{"credibility":1,"name":"IRS-CI: California money launderer sentenced in DC to 70 months for role in scheme that stole $263 million","type":"regulatory","url":"https://www.irs.gov/compliance/criminal-investigation/california-money-launderer-sentenced-in-dc-to-70-months-for-role-in-scheme-that-stole-263-million"},{"credibility":2,"name":"WUSA9: Crypto theft ring indicted stealing $263M, DC US attorney says","type":"news_article","url":"https://www.wusa9.com/article/news/crime/rico-conspiracy-cryptocurrency-bitcoin-scheme-criminal-enterprise-luxury-squishmallow/65-7f94ba2b-5a32-4bd9-87ad-a9ef77ec76d8"}]},{"content":"The enterprise is alleged to have conducted physical home invasions when remote social engineering failed to obtain cryptocurrency. According to DOJ charging documents, Marlon Ferro was the enterprise's designated burglar. In February 2024, Ferro traveled to Winnsboro, Texas and broke into a victim's home, stealing a hardware cryptocurrency wallet containing approximately 100 Bitcoin worth over $5 million at the time. In July 2024, Ferro traveled to New Mexico, spent multiple days surveilling a residence, and broke in using a brick while accomplices remotely monitored the victim's location through the victim's iCloud account — with Malone Lam allegedly logging in to track the victim's movements in real time. Ferro pleaded guilty to RICO conspiracy in October 2025 and was sentenced to 78 months in prison plus $2.5 million in restitution. These home invasions represent, in the assessment of TRM Labs, a documented convergence of cyber-enabled digital asset theft with physical-world violence — an escalation that informed the DOJ's decision to pursue RICO charges.","heading":"Physical Home Invasions","severity":"critical","sources":[{"credibility":1,"name":"IRS-CI: GothFerrari sentenced to 78 months in prison for role in massive cryptocurrency heist","type":"regulatory","url":"https://www.irs.gov/compliance/criminal-investigation/gothferrari-sentenced-to-78-months-in-prison-for-role-in-massive-cryptocurrency-heist"},{"credibility":2,"name":"CoinTelegraph: Crypto Burglar Who Broke into Homes to Steal Hardware Wallets Gets 78 Months","type":"news_article","url":"https://cointelegraph.com/news/california-man-sentenced-to-78-months-in-250m-crypto-theft-conspiracy"},{"credibility":2,"name":"TRM Labs: DOJ Uses Organized Crime Statute in $263 Million Cryptocurrency Theft, Money Laundering and Home Invasion Conspiracy","type":"research","url":"https://www.trmlabs.com/resources/blog/doj-uses-organized-crime-statute-in-263-million-cryptocurrency-theft-money-laundering-and-home-invasion-conspiracy"}]},{"content":"According to DOJ charging documents and published reporting, enterprise members impersonated customer support staff at major technology and cryptocurrency companies — specifically Google and the Gemini cryptocurrency exchange — to manipulate victims by phone. The typical attack sequence, as described by ZachXBT and confirmed in charging documents, involved: (1) placing a call falsely claiming the victim's account had been compromised; (2) sending fake security push notifications to simulate a real breach in progress; (3) directing the victim to download remote desktop access software (specifically AnyDesk) under the pretense of 'protecting' their account; and (4) using that remote access to observe private keys or seed phrases and drain the victim's cryptocurrency holdings. Enterprise members used databases obtained via dark web markets or through hacking to identify high-net-worth cryptocurrency holders as targets. Communications among members were conducted via Telegram and Signal, with frequent alias changes to impede investigation.","heading":"Social Engineering Methods","severity":"critical","sources":[{"credibility":1,"name":"NBC News: Miami man among 2 charged in $230 million cryptocurrency theft and laundering scam","type":"news_article","url":"https://www.nbcnews.com/news/us-news/miami-man-2-charged-230-million-cryptocurrency-theft-laundering-scam-rcna171952"},{"credibility":2,"name":"TRM Labs: DOJ Uses Organized Crime Statute in $263 Million Cryptocurrency Theft, Money Laundering and Home Invasion Conspiracy","type":"research","url":"https://www.trmlabs.com/resources/blog/doj-uses-organized-crime-statute-in-263-million-cryptocurrency-theft-money-laundering-and-home-invasion-conspiracy"},{"credibility":2,"name":"HackRead: Hackers Posed as Google Support to Steal $243 Million in Crypto","type":"news_article","url":"https://hackread.com/hackers-posed-google-support-steal-243m-crypto/"}]},{"content":"Independent on-chain investigator ZachXBT publicly identified the August 2024 Washington D.C. theft as affecting a Genesis bankruptcy creditor and traced stolen funds through exchanges, mixers, and peel chains, identifying aliases for the primary perpetrators (Greavys, Wiz, Box) before law enforcement made arrests. ZachXBT's work was credited by investigators as assisting in the rapid September 2024 arrests of Malone Lam and Jeandiel Serrano. ZachXBT subsequently alleged that a British threat actor connected to the theft was 'likely arrested' in Dubai. ZachXBT's investigation was published on The Block and is cited in broader reporting on the case; the DOJ has not formally attributed its investigative leads to ZachXBT in any public charging document, though multiple media reports confirm law enforcement acknowledged the on-chain tracing assistance.","heading":"On-Chain Investigation by ZachXBT","severity":"high","sources":[{"credibility":2,"name":"The Block: Blockchain sleuth ZachXBT alleges three attackers involved in $243 million theft of single Genesis creditor","type":"research","url":"https://www.theblock.co/post/317349/blockchain-sleuth-zachxbt-alleges-three-perps-involved-in-243-million-theft-of-single-genesis-creditor"},{"credibility":2,"name":"The Block: Crypto sleuth ZachXBT claims British threat actor tied to $243 million Genesis creditor theft likely arrested","type":"news_article","url":"https://www.theblock.co/post/381481/crypto-sleuth-zachxbt-claims-british-threat-actor-tied-to-243-million-genesis-creditor-theft-likely-arrested"},{"credibility":2,"name":"ChainCatcher: ZachXBT: Genesis creditors fall victim to $243 million cryptocurrency theft, two suspects have been arrested","type":"news_article","url":"https://www.chaincatcher.com/en/article/2143882"}]},{"content":"Multiple defendants face obstruction of justice charges stemming from actions taken after the initial September 2024 arrests. Evan Tangeman admitted to directing co-defendant Tucker Desmond to destroy digital devices belonging to enterprise members after early arrests were made — conduct he admitted to in his December 2025 guilty plea. Tangeman also admitted to using access credentials to remotely monitor security camera feeds during FBI searches of Malone Lam's Miami residence while Tangeman himself was in pretrial proceedings. Malone Lam allegedly destroyed his phone following his September 2024 arrest. These obstruction admissions are part of the factual basis for accepted guilty pleas and are not merely allegations in the cases of defendants who have pleaded guilty.","heading":"Obstruction of Justice","severity":"high","sources":[{"credibility":1,"name":"IRS-CI: California money launderer sentenced in DC to 70 months for role in scheme that stole $263 million","type":"regulatory","url":"https://www.irs.gov/compliance/criminal-investigation/california-money-launderer-sentenced-in-dc-to-70-months-for-role-in-scheme-that-stole-263-million"},{"credibility":2,"name":"Decrypt: Ninth Defendant Pleads Guilty in $263M Crypto Social-Engineering Scheme","type":"news_article","url":"https://decrypt.co/351576/ninth-defendant-pleads-guilty-263m-crypto-scheme"}]},{"content":"As of the publication date of this page, the following sentencings have been confirmed: Marlon Ferro ('GothFerrari') sentenced to 78 months and $2.5 million restitution (date confirmed, specific month in 2025-2026 per IRS-CI reporting); Evan Tangeman sentenced to 70 months plus three years supervised release on April 24, 2026. Kunal Mehta pleaded guilty in November 2025 and was pending sentencing as of that date. Veer Chetal pleaded guilty and agreed to cooperate. Eight other defendants entered guilty pleas; individual sentencing dates were not confirmed in available public sources as of this writing. Malone Lam, as alleged ringleader, remained in pretrial detention with plea negotiations reported ongoing through late 2025; no sentencing or trial verdict has been publicly reported. Jeandiel Serrano's plea negotiations were ongoing as of available reporting. Nicholas Dellecave, Mustafa Ibrahim, and Danish Zulfiqar — charged in the Second Superseding Indictment — were arrested in late 2025 (Miami and Dubai respectively) and face RICO conspiracy charges; no plea or trial outcome has been reported. Two defendants were reported to remain at large as of December 2025, believed to be in Dubai. The investigation remains active.","heading":"Case Status as of August 2026","severity":"high","sources":[{"credibility":1,"name":"IRS-CI: California money launderer sentenced in DC to 70 months for role in scheme that stole $263 million","type":"regulatory","url":"https://www.irs.gov/compliance/criminal-investigation/california-money-launderer-sentenced-in-dc-to-70-months-for-role-in-scheme-that-stole-263-million"},{"credibility":1,"name":"IRS-CI: GothFerrari sentenced to 78 months in prison for role in massive cryptocurrency heist","type":"regulatory","url":"https://www.irs.gov/compliance/criminal-investigation/gothferrari-sentenced-to-78-months-in-prison-for-role-in-massive-cryptocurrency-heist"},{"credibility":2,"name":"Gate News: Malone Lam Sentence Update — $230M Crypto Thief Faces Decades in Prison","type":"news_article","url":"https://www.gate.com/news/detail/17190206"},{"credibility":1,"name":"IRS-CI: Guilty plea and superseding indictment announced in social engineering scheme that stole $263 million in cryptocurrency","type":"regulatory","url":"https://www.irs.gov/compliance/criminal-investigation/guilty-plea-and-superseding-indictment-announced-in-social-engineering-scheme-that-stole-263-million-in-cryptocurrency"}]}],"sources_used":[{"credibility":1,"name":"DOJ USAO-DC: Guilty Plea and Superseding Indictment Announced in Social Engineering Scheme that Stole $263 Million in Cryptocurrency","type":"court_filing","url":"https://www.justice.gov/usao-dc/pr/guilty-plea-and-superseding-indictment-announced-social-engineering-scheme-stole-263"},{"credibility":1,"name":"DOJ USAO-DC: Additional 12 Defendants Charged in RICO Conspiracy for over $263 Million Cryptocurrency Thefts","type":"court_filing","url":"https://www.justice.gov/usao-dc/pr/additional-12-defendants-charged-rico-conspiracy-over-263-million-cryptocurrency-thefts"},{"credibility":1,"name":"IRS-CI: California money launderer sentenced in DC to 70 months for role in scheme that stole $263 million","type":"regulatory","url":"https://www.irs.gov/compliance/criminal-investigation/california-money-launderer-sentenced-in-dc-to-70-months-for-role-in-scheme-that-stole-263-million"},{"credibility":1,"name":"IRS-CI: Guilty plea and superseding indictment announced in social engineering scheme that stole $263 million in cryptocurrency","type":"regulatory","url":"https://www.irs.gov/compliance/criminal-investigation/guilty-plea-and-superseding-indictment-announced-in-social-engineering-scheme-that-stole-263-million-in-cryptocurrency"},{"credibility":1,"name":"IRS-CI: Cryptocurrency money launderer pleads guilty to RICO conspiracy in scheme that stole $263 million in crypto","type":"regulatory","url":"https://www.irs.gov/compliance/criminal-investigation/cryptocurrency-money-launderer-pleads-guilty-to-rico-conspiracy-in-scheme-that-stole-263-million-in-crypto"},{"credibility":1,"name":"IRS-CI: GothFerrari sentenced to 78 months in prison for role in massive cryptocurrency heist","type":"regulatory","url":"https://www.irs.gov/compliance/criminal-investigation/gothferrari-sentenced-to-78-months-in-prison-for-role-in-massive-cryptocurrency-heist"},{"credibility":2,"name":"TRM Labs: DOJ Uses Organized Crime Statute in $263 Million Cryptocurrency Theft, Money Laundering and Home Invasion Conspiracy","type":"research","url":"https://www.trmlabs.com/resources/blog/doj-uses-organized-crime-statute-in-263-million-cryptocurrency-theft-money-laundering-and-home-invasion-conspiracy"},{"credibility":1,"name":"NBC News: Miami man among 2 charged in $230 million cryptocurrency theft and laundering scam","type":"news_article","url":"https://www.nbcnews.com/news/us-news/miami-man-2-charged-230-million-cryptocurrency-theft-laundering-scam-rcna171952"},{"credibility":2,"name":"CoinDesk: U.S. DOJ Charges 12 With $263M Crypto Theft Linked to Genesis Creditor","type":"news_article","url":"https://www.coindesk.com/policy/2025/05/16/doj-charges-12-with-263m-crypto-theft-linked-to-genesis-creditor"},{"credibility":2,"name":"The Record: California man pleads guilty to RICO charges as DOJ indicts crypto theft gang","type":"news_article","url":"https://therecord.media/california-man-pleads-guilty-rico-charges-crypto-theft"},{"credibility":2,"name":"Decrypt: Ninth Defendant Pleads Guilty in $263M Crypto Social-Engineering Scheme","type":"news_article","url":"https://decrypt.co/351576/ninth-defendant-pleads-guilty-263m-crypto-scheme"},{"credibility":2,"name":"DL News: Shrek pleads guilty over role in $263m crypto theft","type":"news_article","url":"https://www.dlnews.com/articles/regulation/shrek-pleads-guilty-ove-role-in-263-million-usd-crypto-theft/"},{"credibility":2,"name":"CoinTelegraph: Crypto Burglar Who Broke into Homes to Steal Hardware Wallets Gets 78 Months","type":"news_article","url":"https://cointelegraph.com/news/california-man-sentenced-to-78-months-in-250m-crypto-theft-conspiracy"},{"credibility":2,"name":"Crypto Times: California Man Gets 70 Months for $263M Cartoonish Crypto RICO Fraud","type":"news_article","url":"https://www.cryptotimes.io/2026/04/27/california-man-gets-70-months-for-263m-cartoonish-crypto-rico-fraud/"},{"credibility":2,"name":"The Block: Blockchain sleuth ZachXBT alleges three attackers involved in $243 million theft of single Genesis creditor","type":"research","url":"https://www.theblock.co/post/317349/blockchain-sleuth-zachxbt-alleges-three-perps-involved-in-243-million-theft-of-single-genesis-creditor"},{"credibility":2,"name":"The Block: Crypto sleuth ZachXBT claims British threat actor tied to $243 million Genesis creditor theft likely arrested","type":"news_article","url":"https://www.theblock.co/post/381481/crypto-sleuth-zachxbt-claims-british-threat-actor-tied-to-243-million-genesis-creditor-theft-likely-arrested"},{"credibility":2,"name":"Courthouse News: $230 million crypto scam one of largest single victim thefts in history, prosecutors say","type":"news_article","url":"https://www.courthousenews.com/230-million-crypto-scam-one-of-largest-single-victim-thefts-in-history-prosecutors-say/"},{"credibility":2,"name":"KTLA: SoCal man who laundered $263 million in stolen cryptocurrency sentenced to prison","type":"news_article","url":"https://ktla.com/news/local-news/socal-man-who-laundered-263-million-in-stolen-cryptocurrency-lived-fantastically-extravagant-lifestyle-sentenced-to-prison/"},{"credibility":2,"name":"Gate News: Malone Lam Sentence Update — $230M Crypto Thief Faces Decades in Prison","type":"news_article","url":"https://www.gate.com/news/detail/17190206"},{"credibility":2,"name":"WUSA9: Crypto theft ring indicted stealing $263M, DC US attorney says","type":"news_article","url":"https://www.wusa9.com/article/news/crime/rico-conspiracy-cryptocurrency-bitcoin-scheme-criminal-enterprise-luxury-squishmallow/65-7f94ba2b-5a32-4bd9-87ad-a9ef77ec76d8"}],"summary":"The Social Engineering Enterprise (SEE) is a multi-state organized crime network that prosecutors allege stole over $263 million in cryptocurrency from multiple victims between October 2023 and May 2025, including over 4,100 Bitcoin from a single Washington, D.C. resident on August 18, 2024 — described by federal prosecutors as one of the largest single-victim cryptocurrency thefts in U.S. history. Formed through online gaming platform connections and prosecuted under the federal RICO statute in the U.S. District Court for the District of Columbia, the enterprise had 17 individuals charged as of late 2025, with 9 guilty pleas entered and at least two sentencings completed as of mid-2026.","timeline":[{"date":"2023-10-01","event":"Social Engineering Enterprise (SEE) begins operating, per DOJ charging documents (approximate date; indictment states 'no later than October 2023').","source":"DOJ / IRS-CI press release","source_url":"https://www.irs.gov/compliance/criminal-investigation/guilty-plea-and-superseding-indictment-announced-in-social-engineering-scheme-that-stole-263-million-in-cryptocurrency"},{"date":"2024-02-01","event":"Marlon Ferro (GothFerrari) breaks into a home in Winnsboro, Texas and steals a hardware cryptocurrency wallet containing approximately 100 Bitcoin (over $5 million at the time).","source":"IRS-CI: GothFerrari sentencing press release","source_url":"https://www.irs.gov/compliance/criminal-investigation/gothferrari-sentenced-to-78-months-in-prison-for-role-in-massive-cryptocurrency-heist"},{"date":"2024-07-01","event":"Malone Lam and associates allegedly steal over $14 million in cryptocurrency from a second victim. Marlon Ferro conducts a second home invasion in New Mexico to steal a hardware wallet while Lam allegedly monitors the victim's location via iCloud.","source":"TRM Labs analysis; IRS-CI sentencing press release","source_url":"https://www.trmlabs.com/resources/blog/doj-uses-organized-crime-statute-in-263-million-cryptocurrency-theft-money-laundering-and-home-invasion-conspiracy"},{"date":"2024-08-18","event":"Enterprise members including Malone Lam, Jeandiel Serrano, and Danish Zulfiqar conduct social engineering attack on a Washington, D.C. victim (identified in reporting as a Genesis bankruptcy creditor). Over 4,100 Bitcoin worth approximately $263 million is stolen in a single operation — one of the largest single-victim cryptocurrency thefts in U.S. history.","source":"DOJ / IRS-CI; NBC News; ZachXBT investigation","source_url":"https://www.irs.gov/compliance/criminal-investigation/guilty-plea-and-superseding-indictment-announced-in-social-engineering-scheme-that-stole-263-million-in-cryptocurrency"},{"date":"2024-09-19","event":"Malone Lam arrested in Miami. Jeandiel Serrano arrested. Both initially charged with conspiracy to commit wire fraud and conspiracy to launder monetary instruments. ZachXBT credited with assisting in the tracing of funds that led to the arrests.","source":"NBC News; The Record from Recorded Future News","source_url":"https://www.nbcnews.com/news/us-news/miami-man-2-charged-230-million-cryptocurrency-theft-laundering-scam-rcna171952"},{"date":"2025-05-16","event":"DOJ unseals superseding indictment charging 12 additional defendants with RICO conspiracy, wire fraud, money laundering, and obstruction. Total number of charged defendants rises to 17. Enterprise operating period described as October 2023 through March/May 2025.","source":"DOJ USAO-DC press release; CoinDesk","source_url":"https://www.justice.gov/usao-dc/pr/additional-12-defendants-charged-rico-conspiracy-over-263-million-cryptocurrency-thefts"},{"date":"2025-10-01","event":"Marlon Ferro (GothFerrari) pleads guilty to RICO conspiracy.","source":"IRS-CI: GothFerrari sentencing press release","source_url":"https://www.irs.gov/compliance/criminal-investigation/gothferrari-sentenced-to-78-months-in-prison-for-role-in-massive-cryptocurrency-heist"},{"date":"2025-11-01","event":"Kunal Mehta (aka 'Shrek,' 'Papa,' 'The Accountant'), age 45, pleads guilty to RICO conspiracy, the eighth defendant to do so. He admits to laundering at least $25 million.","source":"IRS-CI; DL News","source_url":"https://www.irs.gov/compliance/criminal-investigation/cryptocurrency-money-launderer-pleads-guilty-to-rico-conspiracy-in-scheme-that-stole-263-million-in-crypto"},{"date":"2025-12-03","event":"Nicholas Dellecave (aka 'Nic,' 'Souja') arrested in Miami on RICO conspiracy charge filed in Second Superseding Indictment.","source":"IRS-CI: Guilty plea and superseding indictment press release","source_url":"https://www.irs.gov/compliance/criminal-investigation/guilty-plea-and-superseding-indictment-announced-in-social-engineering-scheme-that-stole-263-million-in-cryptocurrency"},{"date":"2025-12-08","event":"Evan Tangeman, age 22, of Newport Beach, California pleads guilty to RICO conspiracy, the ninth defendant to do so. He admits to laundering at least $3.5 million and to directing destruction of digital evidence.","source":"IRS-CI; Decrypt","source_url":"https://www.irs.gov/compliance/criminal-investigation/guilty-plea-and-superseding-indictment-announced-in-social-engineering-scheme-that-stole-263-million-in-cryptocurrency"},{"date":"2025-12-01","event":"Mustafa Ibrahim (aka 'Krust') and Danish Zulfiqar (aka 'Danny,' 'Meech') arrested in Dubai on RICO conspiracy charges filed in Second Superseding Indictment.","source":"IRS-CI: Guilty plea and superseding indictment press release","source_url":"https://www.irs.gov/compliance/criminal-investigation/guilty-plea-and-superseding-indictment-announced-in-social-engineering-scheme-that-stole-263-million-in-cryptocurrency"},{"date":"2026-04-24","event":"Evan Tangeman sentenced to 70 months in federal prison plus three years supervised release by U.S. District Court for the District of Columbia.","source":"IRS-CI: California money launderer sentenced in DC to 70 months","source_url":"https://www.irs.gov/compliance/criminal-investigation/california-money-launderer-sentenced-in-dc-to-70-months-for-role-in-scheme-that-stole-263-million"}]},"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 8378efac-c555-4f46-bb2a-48baad4bc168copy