{"investigation":{"slug":"malone","entity_name":"Malone Lam","trust_score":0,"severity_base":null,"score_modifier":-5,"confidence":1,"status":"published","content_type":"investigation","summary":"Malone Lam Yu Xuan (born July 19, 2004), a Singaporean national residing in Miami and Los Angeles, is the alleged ringleader of a crypto theft and money laundering enterprise responsible for stealing over $263 million across multiple victims between 2023 and 2025. He was arrested by the FBI on September 18, 2024, and faces RICO conspiracy charges in what prosecutors describe as the first Bitcoin-related RICO prosecution in U.S. history. As of early 2026, he remains in pretrial detention while negotiating a plea deal.","sections":[{"content":"Malone Lam's full legal name is Malone Lam Yu Xuan. He was born on July 19, 2004, making him 20 years old at the time of his arrest. A citizen of Singapore, Lam maintained residences in both Miami, Florida, and Los Angeles, California. He operated under multiple online aliases across gaming platforms and social media, including 'Greavys,' 'Anne Hathaway,' '$$$,' 'SSS,' and 'King Greavys.' He and his co-conspirators first met via online gaming platforms before forming the criminal enterprise prosecutors call the 'Social Engineering Enterprise.'","heading":"Identity and Aliases","sources":[],"severity":"medium"},{"content":"On August 18, 2024, Lam and co-conspirators Jeandiel Serrano (alias 'Box') and Veer Chetal (alias 'Wiz') allegedly conducted a sophisticated social engineering attack against a single victim in Washington, D.C. — a creditor of the bankrupt Genesis cryptocurrency lending platform. The attackers posed as support personnel from Google and Gemini exchange, tricking the victim into resetting two-factor authentication (2FA) and transferring funds to a compromised wallet. The group allegedly exploited remote access software AnyDesk to reveal private keys stored in the victim's Bitcoin Core installation. More than 4,100 Bitcoin — worth approximately $230–243 million at the time of theft and $384.5 million by the time of the subsequent indictment — were stolen in what authorities describe as the largest known single-victim cryptocurrency heist in U.S. history. Blockchain investigator ZachXBT identified the three perpetrators and shared forensic findings with U.S. law enforcement, directly contributing to the arrests.","heading":"Primary Criminal Conduct: $243M Genesis Creditor Theft","sources":[],"severity":"medium"},{"content":"Federal prosecutors allege the criminal enterprise operated from approximately October 2023 through at least March 2025. The organization grew from two roommates in Texas to a network of at least 14 members spanning multiple U.S. states and abroad. Roles within the enterprise included database hackers, organizers, target identifiers, phone callers, money launderers, and physical burglars who broke into victims' homes to steal hardware cryptocurrency wallets. A second victim was targeted in New Mexico in July 2024 in an incident that included armed burglary. A superseding indictment unsealed in May 2025 expanded charges to 17 total defendants. The case is formally styled United States v. LAM, 1:24-cr-00417 (D.D.C.). In addition to the primary August 2024 theft, the enterprise is alleged to have committed additional thefts bringing total losses across all victims to over $263 million. Charges include RICO conspiracy, conspiracy to commit wire fraud, money laundering conspiracy, and obstruction of justice. Prosecutors describe this as the first Bitcoin-related RICO prosecution in U.S. history.","heading":"Broader Criminal Enterprise and RICO Charges","sources":[],"severity":"medium"},{"content":"The criminal enterprise employed multiple sophisticated on-chain laundering techniques to obscure the origin of stolen funds. Peel chains were used extensively: large amounts of cryptocurrency were moved through long sequences of transactions in which small portions were 'peeled off' at each step to exchanges or cold wallets while the remainder moved to a new address, creating a web of transactions designed to overwhelm manual analysis. Stolen Bitcoin was converted across multiple assets including Litecoin, Ethereum, and Monero, with Monero conversion specifically cited for its enhanced privacy properties. DeFi bridging platforms were used to convert Bitcoin to Ethereum. Cryptocurrency mixers were employed alongside pass-through wallets and VPNs to mask participant identities. Asia-based high-risk exchanges were used for final cash conversion. Co-conspirator Kunal Mehta (alias 'Papa,' 'The Accountant,' 'Shrek') created multiple shell companies in 2024 to give laundering an appearance of legitimacy, charging a 10% fee for crypto-to-cash conversion and for purchasing luxury vehicles through straw signers. Mehta admitted to personally laundering at least $25 million. ZachXBT's initial tracing showed $243M rapidly peeled to 15 or more exchanges immediately after the theft, swapping back and forth between Bitcoin, Litecoin, Ethereum, and Monero. No specific on-chain wallet addresses have been publicly identified in court documents available at time of writing.","heading":"On-Chain Laundering Techniques","sources":[],"severity":"medium"},{"content":"Prosecutors allege the enterprise spent approximately $13 million of stolen proceeds on luxury goods and entertainment within weeks of the August 2024 theft. Lam personally allegedly purchased more than 30 exotic vehicles including Ferraris, Lamborghinis, a Rolls Royce, a McLaren, a Pagani, and customized Mercedes G-Wagons, as well as a $2 million watch. A single nightclub receipt documented $569,528.39 spent in one evening, including $38,500 for 55 bottles of Grey Goose vodka and $72,000 for 48 bottles of Ace of Spades champagne; separate reports indicate evenings of up to $665,000. Social media videos showed Lam gifting Hermes Birkin bags to models and influencers. After his September 2024 arrest and while in pretrial detention, Lam is alleged to have continued directing enterprise members to purchase luxury Hermes Birkin bags and hand-deliver them to his girlfriend in Miami, Florida — a fact cited by prosecutors in obstruction-related proceedings. Stolen funds were also used to rent multiple luxury properties across the U.S.","heading":"Luxury Spending and Asset Dissipation","sources":[],"severity":"medium"},{"content":"Blockchain investigator ZachXBT (pseudonym; identity: Zachary Wolk) played a documented role in identifying the perpetrators. ZachXBT identified three primary suspects — Malone Lam, Veer Chetal, and Jeandiel Serrano — and shared findings with U.S. law enforcement. ZachXBT's analysis traced the initial flow of $243M as it was split among the conspirators and rapidly peeled to more than 15 exchanges. ZachXBT also identified a connection between Lam's alleged device indicators and a separate June 23, 2024, social engineering attack against billionaire Mark Cuban's public wallet markcuban.eth. In a May 2026 post, ZachXBT disclosed that a British threat actor allegedly connected to the Genesis creditor theft was 'likely arrested.' ZachXBT also collaborated with cryptoforensic investigators zeroShadow and Binance Security, resulting in the freezing of more than $9 million in stolen assets and the return of over $500,000 to the victim.","heading":"ZachXBT Investigation","sources":[],"severity":"medium"},{"content":"Malone Lam was arrested by the FBI on September 18, 2024, in Miami, Florida. He discarded his mobile phone into Biscayne Bay before being apprehended, having allegedly been tipped off by an off-duty police officer. Co-conspirator Jeandiel Serrano was arrested the same day in Los Angeles. Veer Chetal was arrested in March 2025 following a related violent kidnapping attempt targeting his parents in Danbury, Connecticut. Danish Zulfiqar, a fourth suspect identified by ZachXBT, was reportedly taken into custody in Dubai in December 2025. As of early 2026, at least nine co-defendants had pleaded guilty to RICO conspiracy, including Kunal Mehta, Evan Tangeman (sentenced to 70 months in April 2026), Hamza Doost, and Joel Cortez. Lam himself remained in pretrial detention as of December 2025, with plea negotiations ongoing. The case is prosecuted by the U.S. Attorney's Office for the District of Columbia, with investigation by the IRS-Criminal Investigation Washington D.C. Field Office and the FBI Washington Field Office. The investigation remains active.","heading":"Arrests, Co-Defendants, and Legal Status","sources":[],"severity":"medium"}],"timeline":[{"date":"2023-10","event":"Criminal enterprise allegedly begins operating, targeting cryptocurrency holders using hacked databases and social engineering.","source":"","source_url":"https://www.justice.gov/usao-dc/pr/additional-12-defendants-charged-rico-conspiracy-over-263-million-cryptocurrency-thefts","date_original":"2023-10-01"},{"date":"2024-06-23","event":"Mark Cuban's wallet markcuban.eth is allegedly targeted in a social engineering attack linked by ZachXBT to the same device indicators later found in the $243M theft.","source":"","source_url":"https://x.com/zachxbt/status/1923465312529416702"},{"date":"2024-07","event":"Second victim in New Mexico targeted in an armed home invasion burglary of a hardware cryptocurrency wallet.","source":"","source_url":"https://www.justice.gov/usao-dc/pr/additional-12-defendants-charged-rico-conspiracy-over-263-million-cryptocurrency-thefts","date_original":"2024-07-01"},{"date":"2024-08-18","event":"Malone Lam and co-conspirators steal 4,100+ Bitcoin (approx. $230–243M) from a Genesis creditor in Washington, D.C., via social engineering impersonating Google and Gemini support.","source":"","source_url":"https://www.coindesk.com/business/2024/09/19/police-arrests-two-people-related-to-243m-crypto-heist-targeting-genesis-creditor"},{"date":"2024-09-18","event":"Malone Lam arrested by FBI in Miami after discarding phone in Biscayne Bay; Jeandiel Serrano arrested in Los Angeles the same day.","source":"","source_url":"https://therecord.media/doj-charges-hackers-for-230-million-crypto-heist"},{"date":"2024-09-19","event":"Initial federal indictment unsealed against Lam and Serrano, charging conspiracy to steal and launder cryptocurrency.","source":"","source_url":"https://www.justice.gov/usao-dc/pr/indictment-charges-two-230-million-cryptocurrency-scam"},{"date":"2025-03","event":"Veer Chetal arrested; separately, Chetal's parents are targeted in a violent kidnapping attempt in Danbury, Connecticut, connected to the stolen funds.","source":"","source_url":"https://therecord.media/california-man-pleads-guilty-rico-charges-crypto-theft","date_original":"2025-03-01"},{"date":"2025-05","event":"Superseding indictment unsealed against 12 additional defendants (17 total) expanding the RICO conspiracy charges and adding new theft incidents. Total alleged stolen value revised to over $263 million.","source":"","source_url":"https://www.justice.gov/usao-dc/pr/additional-12-defendants-charged-rico-conspiracy-over-263-million-cryptocurrency-thefts","date_original":"2025-05-01"},{"date":"2025-12","event":"Danish Zulfiqar, identified by ZachXBT as a British co-conspirator, reportedly arrested in Dubai.","source":"","source_url":"https://www.theblock.co/post/381481/crypto-sleuth-zachxbt-claims-british-threat-actor-tied-to-243-million-genesis-creditor-theft-likely-arrested","date_original":"2025-12-01"},{"date":"2025-12-17","event":"Status hearing in D.C. federal court; Lam's attorney reports ongoing plea negotiations with the U.S. government.","source":"","source_url":"https://www.gate.com/news/detail/17190206"},{"date":"2026-04-27","event":"Co-defendant Evan Tangeman, 22, sentenced to 70 months in federal prison for money laundering tied to the $263M RICO enterprise.","source":"","source_url":"https://www.theblock.co/post/398899/22-year-old-sentenced-to-70-months-for-money-laundering-tied-to-263-million-crypto-syndicate"}],"sources_used":[],"source_tags":["etherscan","zachxbt"],"addresses":[],"reviewed":false,"reviewed_by":null,"model_used":"claude-sonnet","created_at":"2026-05-04T16:04:59.487834+00:00","updated_at":"2026-08-29T01:35:59.74+00:00"}}