← 263M RICO Social Engineering Crypto Theft Gang (DC — 2024-2026 Prosecutions)reviewed 2026-09-06 · 31 claims checked
Fact-check findings
What an automated fact-checker found when it re-read 263M RICO Social Engineering Crypto Theft Gang (DC — 2024-2026 Prosecutions) against the sources the page cites. Only the most recent review is shown.
Read this first
These findings are produced by an automated reviewer, and its results vary between runs: the same page, checked three times on the same day, came back with 15%, 20% and 34% of its claims disputed, mostly because each run extracted a different number of claims. Treat what follows as leads, not rulings.
“Disputed” means the reviewer could not reconcile the claim with the evidence it cited. It does not mean the claim is false. “Unverifiable” means no reachable source settled it either way.
Nothing here changes the page on its own. A proposed correction is applied only after a human moderator approves it; until then the page reads as it did when reviewed.
disputed
1 claimThe reviewer could not reconcile the claim with the evidence it cited. This is a lead, not a ruling that the claim is false.
- #29[disputed][awaiting moderator]in the timeline
“DOJ unseals superseding indictment charging 12 additional defendants with RICO conspiracy, wire fraud, money laundering, and obstruction. Total number of charged defendants rises to 17.”
reviewerThe May 16, 2025 superseding indictment brought the total number of charged defendants to 17The '17' figure is real but belongs to December 2025 (as correctly stated in sections[2] and the summary), not to the May 16, 2025 event described in this timeline entry, which multiple sources — including the page's own cited WUSA9 article — put at 14.Proposed correction (not yet applied)DOJ unseals superseding indictment charging 12 additional defendants with RICO conspiracy, wire fraud, money laundering, and obstruction. Total number of charged defendants rises to 14.
unverifiable
3 claimsNo source the reviewer could reach confirms or contradicts the claim.
- #6[unverifiable][awaiting moderator]in section: Primary Theft: August 18, 2024 — Washington, D.C. Victim
“Bitcoin was then rapidly laundered through more than 15 exchanges, converted across multiple asset types including Monero, routed through cryptocurrency mixers, and split among enterprise members.”
reviewerBitcoin was rapidly laundered through more than 15 exchangesThe general laundering methodology (mixers, exchanges, Monero conversion) is well corroborated, but the specific figure of 'more than 15 exchanges' could not be independently confirmed in any source consulted. - #10[unverifiable][awaiting moderator]in section: RICO Charges and Prosecution
“The case represents one of the first known applications of the federal RICO statute to a cryptocurrency-native criminal network.”
reviewerThis case represents one of the first known applications of the federal RICO statute to a cryptocurrency-native criminal networkThe claim is appropriately hedged ('one of the first known'), but no source consulted makes this specific primacy claim, so it cannot be independently confirmed or refuted. - #12[unverifiable][awaiting moderator]in section: RICO Charges and Prosecution
“The U.S. Attorney's Office for D.C., FBI Washington Field Office (Criminal and Cyber Division), IRS Criminal Investigation, FBI Los Angeles, and FBI Miami have all participated in the investigation.”
reviewerThe U.S. Attorney's Office for D.C., FBI Washington Field Office (Criminal and Cyber Division), IRS-CI, FBI Los Angeles, and FBI Miami have all participated in the investigationIRS-CI participation and general multi-agency involvement is plausible and consistent with press-release conventions, but I could not independently verify the specific FBI division/field-office wording from a source I was able to fetch.
stale
1 claimThe claim was accurate when written but events since have overtaken it.
- #27[stale][awaiting moderator]in section: Case Status as of August 2026
“Two defendants were reported to remain at large as of December 2025, believed to be in Dubai.”
reviewerTwo defendants were reported to remain at large as of December 2025, believed to be in DubaiThis claim directly contradicts sections[3] and timeline[10] on this same page, which state Ibrahim and Zulfiqar were arrested in Dubai by December 2025. The 'at large' detail appears to be carried over unedited from the May 2025 reporting and was not updated to reflect the later arrests.Proposed correction (not yet applied)Two defendants — later identified as Mustafa Ibrahim and Danish Zulfiqar — were reported to remain at large as of the May 2025 indictment, believed to be in Dubai, before both were arrested there under the December 2025 Second Superseding Indictment.
partially supported
3 claimsThe cited evidence supports part of the claim but not all of it.
- #15[partially supported][awaiting moderator]in section: RICO Charges and Prosecution
“Malone Lam, as the alleged ringleader, remained in pre-trial detention with plea negotiations ongoing as of late 2025 and an October 2025 trial date having been set.”
reviewerMalone Lam remained in pre-trial detention with plea negotiations ongoing as of late 2025 and an October 2025 trial date having been setThe literal statement that 'a trial date having been set' is true, but omitting that this specific date was postponed risks implying the trial went forward; a reader would benefit from that context. - #23[partially supported][awaiting moderator]in section: Physical Home Invasions
“These home invasions represent, in the assessment of TRM Labs, a documented convergence of cyber-enabled digital asset theft with physical-world violence — an escalation that informed the DOJ's decision to pursue RICO charges.”
reviewerTRM Labs assessed the home invasions as a documented convergence of cyber-enabled digital asset theft with physical-world violence that informed DOJ's RICO decisionThe underlying facts (home invasions occurred, RICO was used, TRM covered both) are confirmed, but the specific causal attribution to TRM Labs could not be verified as a direct TRM claim. - #28[partially supported][awaiting moderator]in the timeline
“Malone Lam and associates allegedly steal over $14 million in cryptocurrency from a second victim. Marlon Ferro conducts a second home invasion in New Mexico to steal a hardware wallet while Lam allegedly monitors the victim's location via iCloud.”
reviewerIn July 2024, Malone Lam and associates stole over $14 million from a second victim, and in the same month Marlon Ferro conducted a second home invasion in New MexicoBoth underlying facts are independently corroborated for July 2024, but merging them into a single timeline entry risks implying they involve the same victim/incident when the source material treats them as separate.
confirmed
23 claimsThe cited evidence supports the claim as written.
- #1[confirmed][no action needed]in the summary
“The Social Engineering Enterprise (SEE) is a multi-state organized crime network that prosecutors allege stole over $263 million in cryptocurrency from multiple victims between October 2023 and May 2025”
reviewerSEE stole over $263 million in cryptocurrency from multiple victims between October 2023 and May 2025Directly corroborated by IRS-CI/DOJ press releases and multiple independent outlets. - #2[confirmed][no action needed]in the summary
“including over 4,100 Bitcoin from a single Washington, D.C. resident on August 18, 2024 — described by federal prosecutors as one of the largest single-victim cryptocurrency thefts in U.S. history”
reviewerOver 4,100 Bitcoin (~$263M) was stolen from a single Washington, D.C. resident on August 18, 2024, described as one of the largest single-victim cryptocurrency thefts in U.S. historyDate and superlative characterization both confirmed by independent reporting citing DOJ charging documents. - #3[confirmed][no action needed]in the summary
“the enterprise had 17 individuals charged as of late 2025, with 9 guilty pleas entered and at least two sentencings completed as of mid-2026”
reviewerAs of late 2025, 17 individuals had been charged, with 9 guilty pleas entered, and at least two sentencings completed as of mid-202617-defendant total is correct for late 2025 (after the December 2025 Second Superseding Indictment added Dellecave, Ibrahim and Zulfiqar to the 14 charged as of May 2025). Note this figure is misapplied elsewhere on the page — see the timeline[5] finding. - #4[confirmed][no action needed]in section: Criminal Enterprise Overview
“The network divided labor among specialized roles: database hackers who breached websites or purchased stolen data on the dark web; target identifiers who analyzed that data to locate high-net-worth cryptocurrency holders; 'callers' who impersonated customer support staff at crypto exchanges and technology companies to socially engineer victims; money launderers who converted stolen cryptocurrency to cash; and residential burglars who conducted physical home invasions to steal hardware cryptocurrency wallets.”
reviewerThe enterprise divided labor among database hackers, target identifiers, callers, money launderers, and residential burglarsRole structure is consistently described across DOJ materials and TRM Labs analysis. - #5[confirmed][no action needed]in section: Criminal Enterprise Overview
“U.S. Attorney Jeanine Ferris Pirro stated that 'this criminal enterprise was built on greed so brazen it borders on the cartoonish,'”
reviewerU.S. Attorney Jeanine Ferris Pirro stated the enterprise was 'built on greed so brazen it borders on the cartoonish'Both the quote and the full name/title attribution check out against independent reporting. - #7[confirmed][no action needed]in section: Primary Theft: August 18, 2024 — Washington, D.C. Victim
“Federal prosecutors have described the theft as 'one of the largest cryptocurrency thefts from a private individual in the history of the United States.'”
reviewerFederal prosecutors described the theft as one of the largest cryptocurrency thefts from a private individual in U.S. historyConsistent with courthouse reporting on prosecutors' framing of the case. - #8[confirmed][no action needed]in section: Primary Theft: August 18, 2024 — Washington, D.C. Victim
“As of December 2025, the stolen Bitcoin's value had appreciated to over $368 million.”
reviewerAs of December 2025, the stolen Bitcoin's value had appreciated to over $368 millionFigure and date match the December 8, 2025 DOJ press release. - #9[confirmed][no action needed]in section: Primary Theft: August 18, 2024 — Washington, D.C. Victim
“Danish Zulfiqar was also identified in the superseding indictment as a participant.”
reviewerDanish Zulfiqar was identified in the superseding indictment as a participant in the August 2024 D.C. theftName and alias match independent on-chain reporting. - #11[confirmed][no action needed]in section: RICO Charges and Prosecution
“All proceedings are in the U.S. District Court for the District of Columbia before Judge Colleen Kollar-Kotelly.”
reviewerAll proceedings are before Judge Colleen Kollar-Kotelly in the U.S. District Court for the District of ColumbiaConfirmed by independent reporting on plea and sentencing hearings. - #13[confirmed][no action needed]in section: RICO Charges and Prosecution
“On-chain investigator ZachXBT is credited by investigators with assisting in the initial tracing of stolen funds that led to the first arrests in September 2024.”
reviewerOn-chain investigator ZachXBT is credited with assisting in the initial tracing of stolen funds that led to the first arrests in September 2024Corroborated by contemporaneous September 2024 reporting. - #14[confirmed][no action needed]in section: RICO Charges and Prosecution
“As of December 2025, 17 individuals in total had been charged across initial indictments and superseding indictments. Nine had entered guilty pleas.”
reviewerAs of December 2025, 17 individuals in total had been charged, and nine had entered guilty pleasCorrectly dated and figured here, in contrast to the same '17' figure misapplied to the May 2025 event in the timeline (see separate finding). - #16[confirmed][no action needed]in section: Key Defendants and Case Status
“Malone Lam (also known as 'Anne Hathaway,' 'Greavys,' and '$$$'), a Singaporean national born July 19, 2004, is alleged to have been the ringleader of the enterprise. He was arrested in Miami on September 19, 2024, and has remained in pretrial detention.”
reviewerMalone Lam, a Singaporean national born July 19, 2004, was arrested in Miami on September 19, 2024Some contemporaneous reports describe the arrest as occurring the night of September 18, 2024 (a Wednesday), with DOJ announcing/unsealing charges on September 19; this is a minor ambiguity between 'arrest night' and 'announcement date' rather than a clear factual error, so it is not disputed here. - #17[confirmed][no action needed]in section: Key Defendants and Case Status
“He broke into a home in Winnsboro, Texas in February 2024 (stealing hardware wallets containing approximately 100 Bitcoin worth over $5 million) and conducted a second home invasion in New Mexico in July 2024, with Lam allegedly monitoring the victim's location via iCloud in real time. Ferro pleaded guilty in October 2025 to RICO conspiracy and was sentenced to 78 months in prison plus $2.5 million in restitution.”
reviewerMarlon Ferro broke into a Winnsboro, Texas home in Feb 2024 stealing ~100 BTC (~$5M), a second home in New Mexico in July 2024, pleaded guilty Oct 2025, sentenced to 78 months plus $2.5 million restitutionAll figures and dates check out across multiple independent sources. - #18[confirmed][no action needed]in section: Key Defendants and Case Status
“Kunal Mehta (also known as 'Papa,' 'The Accountant,' and 'Shrek'), age 45, of Irvine, California, was the eighth defendant to plead guilty, admitting to laundering at least $25 million in proceeds as part of the RICO conspiracy. His guilty plea was accepted in November 2025.”
reviewerKunal Mehta, age 45 of Irvine, California, was the eighth defendant to plead guilty, admitting to laundering at least $25 million; plea accepted November 2025Directly confirmed by the primary IRS-CI press release. - #19[confirmed][no action needed]in section: Key Defendants and Case Status
“Evan Tangeman (also known as 'E,' 'Tate,' and 'Evan|Exchanger'), age 22, of Newport Beach, California, was the ninth defendant to plead guilty, on December 8, 2025, to RICO conspiracy. He admitted to laundering at least $3.5 million, facilitating luxury rental properties for enterprise members in Los Angeles, Miami, and the Hamptons at $40,000 to $80,000 per month using false names, and to directing co-defendant Tucker Desmond to destroy digital devices following initial arrests. Tangeman was sentenced on April 24, 2026 to 70 months in prison plus three years of supervised release.”
reviewerEvan Tangeman, age 22 of Newport Beach, California, was the ninth defendant to plead guilty, on December 8, 2025, admitting to laundering at least $3.5 million and directing device destruction; sentenced April 24, 2026 to 70 months plus three years supervised releaseAll specific figures verified against the primary sentencing press release. - #20[confirmed][no action needed]in section: Key Defendants and Case Status
“Nicholas Dellecave (also known as 'Nic' and 'Souja') was charged in the Second Superseding Indictment unsealed in December 2025 with RICO conspiracy and arrested in Miami on December 3, 2025. Mustafa Ibrahim (also known as 'Krust') was charged in the Second Superseding Indictment and arrested in Dubai. Danish Zulfiqar (also known as 'Danny' and 'Meech') was charged in the Second Superseding Indictment and arrested in Dubai.”
reviewerNicholas Dellecave, Mustafa Ibrahim, and Danish Zulfiqar were charged in the Second Superseding Indictment (unsealed December 2025) and arrested in Miami / Dubai / Dubai respectivelyDirectly confirmed, but this same page contradicts itself elsewhere by describing 'two defendants' as still at large in Dubai as of December 2025 (see sections[9] finding). - #21[confirmed][no action needed]in section: Money Laundering and Proceeds Dissipation
“Proceeds were spent on nightclub outings reportedly reaching $500,000 per evening; luxury timepieces valued between $100,000 and $500,000; 28 exotic vehicles valued between $100,000 and $3.8 million each; private jet charters; personal security teams; and high-end rental homes in Los Angeles, Miami, and the Hamptons valued at $4 million to $9 million.”
reviewerProceeds were spent on nightclub outings up to $500,000/evening, watches $100k-$500k, 28 exotic vehicles $100k-$3.8M each, private jets, security teams, and rental homes $4M-$9M in LA/Miami/HamptonsFigures match TRM Labs' summary of the DOJ charging documents. - #22[confirmed][no action needed]in section: Money Laundering and Proceeds Dissipation
“Physical cash was transported by shipping bulk currency hidden inside Squishmallow stuffed animals through the U.S. Postal Service.”
reviewerPhysical cash was smuggled by shipping bulk currency hidden inside Squishmallow stuffed animals via USPSWidely and independently corroborated distinctive detail from the DOJ indictment. - #24[confirmed][no action needed]in section: Social Engineering Methods
“The typical attack sequence, as described by ZachXBT and confirmed in charging documents, involved: (1) placing a call falsely claiming the victim's account had been compromised; (2) sending fake security push notifications to simulate a real breach in progress; (3) directing the victim to download remote desktop access software (specifically AnyDesk) under the pretense of 'protecting' their account; and (4) using that remote access to observe private keys or seed phrases and drain the victim's cryptocurrency holdings.”
reviewerThe typical social-engineering attack sequence involved fake compromise calls, fake push notifications, AnyDesk download, and private key theftAttack methodology is consistently described across DOJ and independent sources. - #25[confirmed][no action needed]in section: On-Chain Investigation by ZachXBT
“ZachXBT subsequently alleged that a British threat actor connected to the theft was 'likely arrested' in Dubai.”
reviewerZachXBT alleged a British threat actor connected to the theft was 'likely arrested' in DubaiDirect quote match; page appropriately hedges this as ZachXBT's claim rather than a confirmed fact, noting Dubai authorities have not confirmed it. - #26[confirmed][no action needed]in section: Obstruction of Justice
“Tangeman also admitted to using access credentials to remotely monitor security camera feeds during FBI searches of Malone Lam's Miami residence while Tangeman himself was in pretrial proceedings.”
reviewerEvan Tangeman admitted to remotely monitoring security camera feeds during FBI searches of Malone Lam's Miami residenceCorroborated by independent reporting on the plea's factual basis. - #30[confirmed][no action needed]in the timeline
“Mustafa Ibrahim (aka 'Krust') and Danish Zulfiqar (aka 'Danny,' 'Meech') arrested in Dubai on RICO conspiracy charges filed in Second Superseding Indictment.”
reviewerMustafa Ibrahim and Danish Zulfiqar were arrested in Dubai on RICO conspiracy charges in the Second Superseding Indictment (December 2025)Consistent with sections[3], but directly contradicts the 'two defendants remain at large in Dubai' claim in sections[9] (flagged separately). - #31[confirmed][no action needed]in the timeline
“Evan Tangeman sentenced to 70 months in federal prison plus three years supervised release by U.S. District Court for the District of Columbia.”
reviewerEvan Tangeman was sentenced on April 24, 2026 to 70 months in federal prison plus three years of supervised releaseDate field (2026-04-24) matches independent reporting.
How this fits together. The reviewer reads the published page and its cited sources and records one finding per claim. A human moderator decides whether each proposed correction is applied; those decisions, and the score changes they cause, appear in the audit log. Earlier review runs are not shown here; only the latest reflects the page as it stands.