Malone Lam
Summary
Malone Lam Yu Xuan (born July 19, 2004), a Singaporean national residing in Miami and Los Angeles, is the alleged ringleader of a crypto theft and money laundering enterprise responsible for stealing over $263 million across multiple victims between 2023 and 2025. He was arrested by the FBI on September 18, 2024, and faces RICO conspiracy charges in what prosecutors describe as the first Bitcoin-related RICO prosecution in U.S. history. As of early 2026, he remains in pretrial detention while negotiating a plea deal.
Connected Entities
1 entities- + 1 more
Timeline(11 events)
2023-10-01
Criminal enterprise allegedly begins operating, targeting cryptocurrency holders using hacked databases and social engineering.
2024-06-23
Mark Cuban's wallet markcuban.eth is allegedly targeted in a social engineering attack linked by ZachXBT to the same device indicators later found in the $243M theft.
2024-07-01
Second victim in New Mexico targeted in an armed home invasion burglary of a hardware cryptocurrency wallet.
2024-08-18
Malone Lam and co-conspirators steal 4,100+ Bitcoin (approx. $230–243M) from a Genesis creditor in Washington, D.C., via social engineering impersonating Google and Gemini support.
2024-09-18
Malone Lam arrested by FBI in Miami after discarding phone in Biscayne Bay; Jeandiel Serrano arrested in Los Angeles the same day.
2024-09-19
Initial federal indictment unsealed against Lam and Serrano, charging conspiracy to steal and launder cryptocurrency.
2025-03-01
Veer Chetal arrested; separately, Chetal's parents are targeted in a violent kidnapping attempt in Danbury, Connecticut, connected to the stolen funds.
2025-05-01
Superseding indictment unsealed against 12 additional defendants (17 total) expanding the RICO conspiracy charges and adding new theft incidents. Total alleged stolen value revised to over $263 million.
2025-12-01
Danish Zulfiqar, identified by ZachXBT as a British co-conspirator, reportedly arrested in Dubai.
Decision Log
- hash: 9EXEgZHjVzKAfGvcCXMQMQR6oBXR4MsfvDgQHkxTTvxq
- hash: Fdonvq5MXzwZJFA78YW5bzHvfnLqZgA3uTR9goHvLQkX
- hash: C4mGZqqGv2e9xnneB8jgGoQhfB8uL3Cjdf6mY8zMKztH
This investigation is cryptographically anchored to the Solana blockchain and source URLs are archived via the Internet Archive.
model: claude-sonnet
generated: 5/4/2026, 4:04:59 PM
last updated: 6/3/2026, 3:16:19 AM
avoid.net — verified advice for a post-truth world