Malone Lam
Auto-generated score, not yet verified against the scoring model. Under review — treat as indicative, not a verdict.
anchored·4Q3YVb…M7VpSummary
Malone Lam Yu Xuan (born July 19, 2004), a Singaporean national residing in Miami and Los Angeles, is the alleged ringleader of a crypto theft and money laundering enterprise responsible for stealing over $263 million across multiple victims between 2023 and 2025. He was arrested by the FBI on September 18, 2024, and faces RICO conspiracy charges in what prosecutors describe as the first Bitcoin-related RICO prosecution in U.S. history. As of early 2026, he remains in pretrial detention while negotiating a plea deal.
Connected Entities
10 entities · 60 linked investigations- Ethereum→mentioned with→Bitcoin(60%)
- Monero→mentioned with→Binance(70%)
- Monero→mentioned with→Bitcoin(60%)
- Monero→mentioned with→ZachXBT(65%)
- Litecoin→mentioned with→Bitcoin(70%)
- ZachXBT→mentioned with→Ethereum(70%)
- Litecoin→mentioned with→Monero(65%)
- ZachXBT→mentioned with→Malone Lam(80%)
- Litecoin→mentioned with→ZachXBT(70%)
- ZachXBT→mentioned with→Bitcoin(65%)
- + 24 more
Connected Through
10 shared actors · 573 investigationsDistinct actors this investigation shares with others — holders, traders, and named parties. Shared infrastructure (exchanges, pools) is excluded.
- □Ethereumorganizationalso inEleven Drainer·0Amnokgang Technology Development Company·0Q2 2026 Bridge Exploit Wave·0KelpDAO / LayerZero Bridge Exploit (April 2026) — DPRK Lazarus·0Faris Ali / UK Crypto Home Invasion Ring·0Voyager Digital·0The DAO Hack 2016·0Uniswap Google Ad Phishing Campaign (May 2026)·0A7A5 Stablecoin / Old Vector·0AI-Powered Crypto Phishing Infrastructure 2026·0Q2 2026 Record Crypto Hack Wave·0Blockchain Bandit·0Operation Economic Outcast — Iran Digital Assets Sectoral Sanctions (August 2026)·0MEV Bot Scam — YouTube AI Trading Bot Campaign (2026)·0$91M Bitcoin Social Engineering Theft — Hardware Wallet Impersonation (August 2026)·0YieldBlox Stellar Oracle Manipulation Exploit (Feb 2026)·0CryptoZoo·0TraderTraitor / UNC4899·0TrueBit Oracle Exploit (January 2026)·0Mass Ethereum Address-Poisoning Wave (Dec 2025-Jan 2026)·0DPRK IT Worker Network (Overseas Scheme)·0DOJ Pig Butchering $25M Forfeiture 2026·0Lab·0Armstrong / Chindavanh / Rucker Crypto Robbery Gang·0H2 2026 July Bridge Hack Wave — Seven Attacks, $M+ Lost·0BonkDAO Treasury Governance Attack (July 2026)·0Bitcoin Latinum·0Google Coin / Fake Gemini AI Chatbot Presale Operation·0Inferno Drainer·0OLPC Token / PancakeSwap OLPC-LABUBU Pool·0Fake Trezor Support Social Engineering — $282M Heist·0Drift Protocol DPRK Exploit (April 2026)·0Solana Blinks / Durable-Nonce Drainer Kits (2026)·0BitMart Exchange — Insolvency Claims and Frozen Withdrawals (August 2026)·0ISIS-K Crypto Funding Network (OFAC July 2026)·0DeFi Governance Attack Wave 2026·0MiningMax·0DSJEX / BG Wealth Sharing·0fake Ledger Live app·0ChainDrop / Shai-Hulud npm Worm August 2026 — Crypto Credential Harvester·0keyv / cacheable npm Supply Chain Attack — TeamPCP Mini Shai-Hulud (August 2026)·0Andean Medjedovic (KyberSwap / Indexed Finance Attacker)·0LAB / LABUSDT·0AI Agent Prompt Injection Crypto Attack Class (2026)·0OFAC Operation Economic Outcast — Iran Digital Assets Sectoral Sanctions August 2026·0H1 2026 Bridge Hack Cluster — Same-Day $35.6M Attack Wave July 22-23·0ClickFix macOS Go-Based Infostealer Crypto Wallet Drainer (August 2026)·0"Claude AI" Crypto Arbitrage Bot YouTube Tutorial Scam·0HECO Bridge & HTX Exchange Hack·1StableMagnet·2Compounder Finance·2Google Coin / Fake Gemini AI Chatbot Presale Scam·2Jonathan Spalletta·2Trenton Richard Johnston·2Donald G. Basile / Bitcoin Latinum (LTNM)·2Socket Security Malicious Browser Extension Campaign August 2026·2SudoRare·2USI-Tech·2Andean Medjedovic·2Bitpapa IC FZC LLC·2TurtleDex·2ETHTrustFund·2Robinhood Chain Scam Ecosystem·2Frosties NFT·2Andean Medjedovic — KyberSwap/Indexed Finance Fugitive, Active Laundering 2026·2Star Credit Holdings / Misam M. Abidi·2HyperVault·2Gotbit / Vortex / Contrarian / Antier Wash-Trading Ring·2Operation Token Mirrors — DOJ Crypto Market Manipulation Ring·2Bitforex·2QuadrigaCX / Gerald Cotten·2eXch·2Karatbars International·3FCoin·3M1llionz (RichMilly666)·3AudiA6 Mixing Service·3SIGMA Bot·4LAB Token (Smartliquid AI)·4zkLend (Starknet)·4CryptoJS Ill Bloom — Weak RNG Multi-Wallet Drain (CVE-2026-71851)·4DxSale·4AscendEX Exchange·4ApeMars (APRZ)·4CLS Global FZC / ZM Quant Investment·4LAB Token·47zarc·4Raidparty·4LML/USDT staking protocol·4Friend Tech·4Kalax·5Venus Protocol THE Token Flash-Loan Exploit (March 2026)·5BitClave·5Grand Base·5luna·5GANA Payment·5Cashio·5WallStreetBets·5Allbridge Core Second Flash-Loan Exploit (July 2026)·6Adform Ad-Tech Supply Chain Wallet Swap Attack·6Justin Sun·7Terra 2.0·7Nomad Bridge·8Zoth Protocol·8Rivus DAO·8Taiko L2 Bridge Exploit June 2026·8Roberto Zibert·8Truebit·8Allbridge Core — Second Flash Loan Exploit via Same Unpatched Vector·8C&M Software·8Harmony ONE (Protocol Entity)·8Rhea Finance Exploit (April 2026)·9Nobitex June 2025 Hack (Predatory Sparrow)·10Term Finance — Governance Exploit (August 2026)·10Qubit Finance·10Bunny Finance·10DEUS Finance·10Curio·10Taiko Ethereum L2 Bridge·10UwU Lend·10Inverse Finance Frontier·10Sheldon Xia (BitMart Founder)·10EasyFi·10June 2026 Cross-Chain Bridge Exploit ($127M, Three Protocols)·10BearnFi·12Bidao·12Ploutos Money·12Raft Protocol·12DeepSnitch AI·12CrossCurve (formerly EYWA) Bridge Exploit (Feb 2026)·12Popsicle Finance·12PlayDapp·12LastPass·12BarnBridge·12Masa·12Summer.fi Lazy Summer Exploit (July 2026)·12XBridge·12Allbridge Core Solana Flash Loan Exploit (July 2026)·14Terence Kwok — Humanity Protocol Staged Hack·14Ionic Money·14WEMIX / WEMIX$ Stablecoin·14Loopring DEX — Trustless Exit Disabled at Shutdown·14Garden Finance·14Voltage Finance·15BNB Chain Bridge·16Levyathan·18Bankr·18Cascade Protocol·18BounceBit L1 Exploit and Chain Shutdown (August 2026)·18OlympusDAO·18Tectonic Protocol·18MoonHacker·18FOMO Token·18Pond0x·18Humanity Protocol June 2026 Hack·18Fantasm Finance·18Dexible V2·18Noones·18Convergence·18HyPC·18Cetus CLMM·18CheeseBank·18Lodestar Finance·20ForceBridge·20Hinkal Protocol·20Verus Protocol (VRSC)·21Cork Protocol·22FEGex·22EdgeX / EDGE Token·22Gravity Bridge·22Triple-A Treasury Hack (July 2026)·22Hunter Biden ($LAPTOP token)·22DAO Maker Vesting·22ElasticSwap·22Resolv·22TAC Chain·22FutureSwap·22Lodestar V0·22Summer.fi (Lazy Summer Protocol)·22Wise Lending V1·22NowSwap·22Eclipse·22Earning.Farm·22Africoin·22Pike V1·22Term Finance·22Locus Finance·22mySwap CL Protocol (Starknet)·22RocketSwap Base·22Renzo·22Maya Protocol — August 2026 Six-Bug Exploit·22B² Network·23Aster (ASTER)·23Makina Finance·24Carrot Protocol·24Hyperbridge (Polkadot-Ethereum Bridge) — April 2026 Exploit·24zombies·25Coinsbuy·26Taiko·26Shuffle (shuffle.com)·26Frank DeGods·26BullX·27Shibarium·28Nesa (NES)·28SharedStake·28Aperture LM·28PAAL AI·28Super Sushi Samurai·28DeFiTuna·28Verus Protocol·28Superfortune AI (GUA)·28Bunni Protocol·28Orion Pools·28Pike Finance·28TAC Network·28Kinto Bridge·28Aquifer AMM·28BtcTurk·28Remitano·28JRNY Crypto·28dForce Lending·28KyberSwap Classic·28Growth DeFi·28Spartans Bet·28Zcash Orchard Counterfeit Vulnerability·28CrossCurve·28UPCX·28Mixin Network·28Typus Perp·28GeniusAI·28Florence Finance·28EraLend·28Truflation·28Team Finance·28Gnosis Pay·28Moonbeam Network (GLMR)·28Ankr & Helio Protocol Hack·28RISEx·29Lendf.me·30Evmos Network·30Tia·30Venice Token·30Symbiosis Finance BridgeV2 syBTC Exploit (September 2026)·30Tether Gold (XAUT)·31Nexera·32MANTRA Chain Upstream Exploit (August 2026)·32Vestra DAO·32Shibarium Bridge·32TempleDAO·32ChangeNOW·32Dolomite·32Blend Pools V2·32numa.·32Zinc·32LayerZero Labs·32Eleven Finance·32Roll·32Gamma Strategies·33Apyx Finance·33Revert Lend·33The Sandbox (SAND OFT Exploit)·34Hyperdrive HL·35Steadefi·35Cod3x·36Aethir·36Panoptic V1.1·370x62d5a59e0d67c0381aad53b201b4a1b8dcd2c833·37MONA (Monavale / DIGITALAX)·38Chads NFT·38CoinDCX·38Astera.fi·38Polymarket — June 2026 Supply Chain Attack·380x5a76a2830859c321a50937a22fde571fbf4810f3·38Axie Infinity·38IoTeX·38The Sandbox SAND Bridge Exploit·38Amun·38Symbiosis Finance·38THORChain GG20 MPC Vault Exploit (May 2026)·38BitoPro·38USD1 (World Liberty Financial)·38Astrid Finance·38Hemi (Genesis Drop / MerkleBox Exploit)·38MustStopMurad·38Unilend V2·38Thunder Terminal·38WazirX·38StakeDAO — vsdCRV Deployer Key Exploit (May 2026)·38Rho Markets·38Kipseli·38KAT katana-network·39M2·39Juicebox V3·40Bedrock Protocol·41Jump Trading·42Orion Protocol·42Balancer·42DGLD·42Midnight Network / NIGHT Token·42Chainflip·42Cozy V2·42Polygon (POL)·44Midnight (NIGHT Token)·44SuperRare·45Binance·45Zilliqa·46Flash Trade·48Aptos·50ZRX (0x Protocol)·50Pendle·50Sky (MakerDAO)·51PeopleDAO·52Internet Computer·52Clober Liquidity Vault·52LCX Exchange·52THORChain·52Bittensor·52SushiSwap·52Leap Wallet·52GHO·53Ethereum Foundation·53Jupiter Perps·54Robinhood Crypto·54Fuse Wallet·54SushiSwap RouteProcessor Exploit·54Celestia·54LCX·54Ethena·55Hedera·55Lulo·55Trust Wallet·55Exponent Finance·55Kevin Rose·57Gnosis Pay Zodiac Delay Module Exploit·57Famous Fox Federation·57Allo Protocol·57ZKsync·57Sui·57Trezor·57Socket Protocol·58Linea·58Sei Network·58Scroll·58Aerodrome Finance·58Gemini Exchange·58Audius·58Synthetix·58Spicenet·58Euler Finance·58Yearn Ether·58Cega·58Eigenlayer·58Ethereum Classic·58Uniswap·58Ethena·58Crypto.com·58Polkadot·58Optimism·60Convex Finance·62Curve Finance·62Starknet·62Hyperliquid·62Raydium Protocol·62PAX Gold (PAXG)·62Curve DEX·62Raydium AMM·62Cointelegraph·62Ripple USD (RLUSD)·62Phantom Wallet·63Canton Network·63Ethereum·64Rocket Pool·64Kaspa·64Chainlink·67Safe{Wallet}·68Crossmint·70Lido Finance·70USD Coin (USDC)·71Circle USYC·73Marinade Finance·79ZachXBT·82BlackRock USD Institutional Digital Liquidity Fund (BUIDL)·82
- □ZachXBTorganizationalso inDean Daghita / CMDSS (Command Services and Support)·0Gurhan Kiziloz·0Gurhan Kiziloz (BlockDAG Co-Founder)·0$91M Bitcoin Social Engineering Theft — Hardware Wallet Impersonation (August 2026)·0Blockchain Bandit·0Faris Ali / UK Crypto Home Invasion Ring·0Yelo (yelotree)·0Lab·0H2 2026 July Bridge Hack Wave — Seven Attacks, $M+ Lost·0Wojtek Kulisz aka Merry (SIM-Swap Gang)·0Ben 'BitBoy' Armstrong·0Inferno Drainer·0DSJEX / BG Wealth Sharing·0Poland SIM-Swap Crypto Theft Ring — June/July 2026·0LastPass threat actor·0Fake Trezor Support Social Engineering — $282M Heist·0LAB / LABUSDT·0Chris Larsen·0Gamer Crew $263M Social Engineering Ring (New Defendants)·0Drift Protocol DPRK Exploit (April 2026)·0fake Ledger Live app·0StableMagnet·2AnubisDAO·2SudoRare·2Jonathan Spalletta·2Aman Kesar India Crypto Scam Ring·2HQI Exchange·2Trenton Richard Johnston·2Blur Finance·2ETHTrustFund·2Gotbit·2HyperVault·2Bitforex·2Wiz Khalifa Pump Fun·2Iran War Panic Crypto Scam Network (ORAMAMA / X Account Manipulation)·2Mr. Parveen India Social Engineering Scam Ring·2Aqua·2eXch·2Malone Lam·2Vkevin·2M1llionz (RichMilly666)·3AudiA6 Mixing Service·3LAB Token (Smartliquid AI)·4AscendEX Exchange·4Brandon Michael Tardibone·4RaveDAO (RAVE Token)·4LML/USDT staking protocol·4Raidparty·4Friend Tech·47zarc·4Crypto Beast (ALT Token Influencer)·4LAB Token·4Undisclosed KOL Promo Network (ZachXBT Exposé, September 2025)·5Grand Base·5WallStreetBets·5JELLY·5GANA Payment·5Sportsbet·6Rivus DAO·8Wonderland Finance·8Axiom DEX Insider Trading (Broox Bauer)·8C&M Software·8Nobitex June 2025 Hack (Predatory Sparrow)·10Sheldon Xia (BitMart Founder)·10UwU Lend·10BearnFi·12Rain Protocol (RAIN Token)·12Meteora / Benjamin Chow·12Abracadabra Money MIM Depeg June 2026·12ZachXBT Crypto Influencer Paid-Promotion Leak (200+ Influencers, September 2025)·12Gym Network·12Popsicle Finance·12LastPass·12Masa·12Tapioca DAO·12Terence Kwok — Humanity Protocol Staged Hack·14Ionic Money·14Shawn Liu·14Garden Finance·14Austin Fine (@xmrfine)·18MoonHacker·18JUDAO·18Skyward Finance·18Cyrus Finance·18Humanity Protocol June 2026 Hack·18Kroll·18Cetus CLMM·18Noones·18Concentric·18Alpha Finance Lab·18HyPC·18OKX DEX·18Convergence·18OcelotDex·18ForceBridge·20FEGex·22EdgeX / EDGE Token·22XT Exchange·22ElasticSwap·22DeltaPrime·22Ratio Finance·22Locus Finance·22Wise Lending V1·22Axiom DEX Employee Insider Trading·22FutureSwap·22Shido·22Earning.Farm·22Eclipse·22RocketSwap Base·22Pike V1·22Renzo·22MYX Finance·22Geoffrey Woo / AntiHunter (ANTIHUNTER) Memecoin·22Shuffle (shuffle.com)·26PAAL AI·28SharedStake·28Aperture LM·28Orion Pools·28TBTFW (Beverly Hills Luxury Car Dealer — Crypto Laundering Vector)·28Kinto Bridge·28ALEX Lab·28Truflation·28Token 2049·28GeniusAI·28JRNY Crypto·28Growth DeFi·28KyberSwap Classic·28Moola Market·28OlaXBT·28UPCX·28CrossCurve·28BtcTurk·28Spartans Bet·28Arthur Hayes (Maelstrom)·30OKX NFT Aggregator·30Axiom Exchange — Employee Insider Trading Scandal·30Revolut Data Breach (Fake Government Request, September 2026)·30Nexera·32Serenity Shield·32Arena SocialFi·32PiggyBank Protocol·32Axiom·32Geoffrey Woo·32TeleSwap·32Themis Protocol·32Sentiment·32Eleven Finance·32Tropykus RSK·32LeetSwap·32Revert Lend·33Strike·34Hyperdrive HL·35Aethir·36Cod3x·36Panoptic V1.1·37Astera.fi·38Ansem / $ANSEM ("Black Bull") creator-coin controversy·38MONA (Monavale / DIGITALAX)·38Volo Vault·38Polymarket — June 2026 Supply Chain Attack·38Dogwifhat (WIF)·38CoinDCX·38PRXVT·38Amun·38Kipseli·38BitoPro·38Astrid Finance·38Thunder Terminal·38Offshore Cryptocurrency Exchanges to Avoid·38MustStopMurad·38WazirX·38four.meme·38M2·39Juicebox V3·40Nelly·40SafePal·42CoinEx Exchange Closure (September 2026)·42Tectonic·42DGLD·42Cozy V2·42SwissBorg·47PeopleDAO·52SushiSwap·52Bittensor·52Trust Wallet·55Transak·55Blast·55Trezor·57Sui·57Crypto.com·58Ethena·58Eigenlayer·58Raydium AMM·62Cointelegraph·62Phantom Wallet·63Litecoin·64Superteam·72ZachXBT·82
- ♦Bitcointokenalso inBitcoin Xchange (Syria-based, ISIS-Linked)·0Abdelhakim Boukich·0Operation Economic Outcast — Iran Digital Assets Sectoral Sanctions (August 2026)·0Mass Ethereum Address-Poisoning Wave (Dec 2025-Jan 2026)·0TraderTraitor / UNC4899·0Rathnakishore Giri·0DPRK IT Worker Network (Overseas Scheme)·0AudiA6·0JADEPUFFER·0Crypto.com Phishing Campaign — Email Domain Abuse (August 2026)·0KelpDAO / LayerZero Bridge Exploit (April 2026) — DPRK Lazarus·0Mukhtar Adamu Muhammad (ISIS-WA Nigeria Crypto Facilitator)·0Blockchain Bandit·0YieldBlox Stellar Oracle Manipulation Exploit (Feb 2026)·0Voyager Digital·0Zyaire Wilkins (Steam Malware Crypto Theft Ring)·0Crypto Dispensers / Virtual Assets LLC·0DOJ Pig Butchering $25M Forfeiture 2026·0Tudou Guarantee Telegram Marketplace·0Miloud Abderrahmane (ISIS TRON Facilitator, France)·0Courier-Based Pig Butchering Scam Network (FBI Warning June 2026)·0Rodney Burton (Bitcoin Rodney)·0$91M Bitcoin Social Engineering Theft — Hardware Wallet Impersonation (August 2026)·0Q2 2026 Record Crypto Hack Wave·0JADEPUFFER – First Fully Autonomous AI Ransomware Targeting Crypto Wallet Keys·0Chen Zhi / Prince Holding Group·0Adam Iza·0Southeast Asian Pig-Butchering Scam Compounds (276-Arrest Operation)·0WEL1DROPPER — 800 Malicious npm Packages RAT and Crypto Infostealer Campaign (August 2026)·0Fake Trezor Support Social Engineering — $282M Heist·0ClickFix macOS Go-Based Infostealer Crypto Wallet Drainer (August 2026)·0World Cup 2026 Crypto Scam Network·0H2 2026 July Bridge Hack Wave — Seven Attacks, $M+ Lost·0H1 2026 Bridge Hack Cluster — Same-Day $35.6M Attack Wave July 22-23·0Gamer Crew $263M Social Engineering Ring (New Defendants)·0Bitcoin Latinum·0FIFA World Cup 2026 Crypto Scam Infrastructure·0Prince Group Transnational Criminal Organization·0Armstrong / Chindavanh / Rucker Crypto Robbery Gang·0OFAC Operation Economic Outcast — Iran Digital Assets Sectoral Sanctions August 2026·0PGI Global·0OFAC ISIS-K 134-Address SDN Batch (July 2026)·0ChainDrop / Shai-Hulud npm Worm August 2026 — Crypto Credential Harvester·0Huione Group (Haowang Guarantee)·0BitMart Exchange — Insolvency Claims and Frozen Withdrawals (August 2026)·0Google Coin / Fake Gemini AI Chatbot Presale Operation·0BlackSuit·0ISIS-K Crypto Funding Network (OFAC July 2026)·0LastPass threat actor·0fake Ledger Live app·0Ruslan Igorevich Tkachuk·2Alexander Vladimirovich Ledenev·2USI-Tech·2Google Coin / Fake Gemini AI Chatbot Presale Scam·2Jonathan Spalletta·2Aman Kesar India Crypto Scam Ring·2Xinbi Marketplace·2Donald G. Basile / Bitcoin Latinum (LTNM)·2Hu Xiaowei (Prince Group second-in-command)·2Bitpapa IC FZC LLC·2Trenton Richard Johnston·2BTC-e·2Mr. Parveen India Social Engineering Scam Ring·2Malone Lam·2Finiko·2eXch·2BitBank (Iranian Crypto Exchange)·2Mirror Trading International·2Bitforex·2Sinbad.io·2Coldcard / Coinkite Firmware Seed-Generation Exploit (July-August 2026)·3Delio (South Korea Crypto Lender Fraud)·3AudiA6 Mixing Service·3FCoin·3M1llionz (RichMilly666)·3CryptoJS Ill Bloom — Weak RNG Multi-Wallet Drain (CVE-2026-71851)·4Paxful·4TradeOgre·4Undisclosed KOL Promo Network (ZachXBT Exposé, September 2025)·5luna·5Coldcard / Coinkite Hardware Wallet Firmware Exploit·6Adform Ad-Tech Supply Chain Wallet Swap Attack·6Sportsbet·6Justin Sun·7Huobi / HTX·7Terra 2.0·7Roberto Zibert·8C&M Software·8Ostium Protocol — Oracle Signer Key Compromise (July 2026)·8Poolin Technology·8Rhea Finance Exploit (April 2026)·9Little Boy Plus - BSC DeFi Logic Exploit·10Nobitex June 2025 Hack (Predatory Sparrow)·10BitMEX (2026 Class Action — Insider Trading and Liquidation Fraud)·10Bitfinex Hack·10EasyFi·10Abracadabra Money MIM Depeg June 2026·12LastPass·12Joaquin Diaz (Orionx Co-Founder)·12Michele Spagnuolo·12Ionic Money·14Pi Network (PI)·14Garden Finance·14Bitget VOXEL Futures Manipulation April 2025·14Coinkite·15Bitget VOXEL Futures Manipulation April 2026·16Pond0x·18BounceBit L1 Exploit and Chain Shutdown (August 2026)·18Austin Fine (@xmrfine)·18Tectonic Protocol·18Liquid Network / Elements Cache-Bug Exploit (September 2026)·18Kroll·18Noones·18Hinkal Protocol·20Rhea Lend·20Bitfinex Hack 2016·21Triple-A Treasury Hack (July 2026)·22Syscoin Bridge·22Hunter Biden ($LAPTOP token)·22Liquid Network·22CyberLeek Solana Token·22Africoin·22Maya Protocol — August 2026 Six-Bug Exploit·22B² Network·23zombies·25HTX (Huobi) Exchange·25Shuffle (shuffle.com)·26Shibarium·28TBTFW (Beverly Hills Luxury Car Dealer — Crypto Laundering Vector)·28BitMEX Exchange·28ALEX Lab·28Mixin Network·28dForce Lending·28Spartans Bet·28BtcTurk·28Lendf.me·30Evmos Network·30Arthur Hayes (Maelstrom)·30OKX NFT Aggregator·30Symbiosis Finance BridgeV2 syBTC Exploit (September 2026)·30Revolut Data Breach (Fake Government Request, September 2026)·30Venice Token·30BitClout / DeSo / Nader Al-Naji·32Blockstream Liquid Network·32ChangeNOW·32Tropykus RSK·32TeleSwap·32Apyx Finance·33Strike·34Dogwifhat (WIF)·38Volo Vault·38Coincheck·38SideSwap·38IoTeX·38Amun·38Symbiosis Finance·38THORChain GG20 MPC Vault Exploit (May 2026)·38BitoPro·38MustStopMurad·38Hemi (Genesis Drop / MerkleBox Exploit)·38M2·39Bedrock Protocol·41SafePal·42Swiss Bitcoin Pay·42DGLD·42Midnight Network / NIGHT Token·42Chainflip·42Tria·42Zapper·47Flash Trade·48Aptos·50Internet Computer·52THORChain·52Leap Wallet·52Tether·52Bittensor·52Robinhood Crypto·54Hedera·55Trust Wallet·55Kevin Rose·57Trezor·57Gemini Exchange·58Uniswap·58Bitcoin·62Starknet·62PAX Gold (PAXG)·62Phantom Wallet·63Canton Network·63Litecoin·64Kaspa·64Bitstamp·67Safe{Wallet}·68ZachXBT·82
- □Binanceorganizationalso inSiavash Kayvanpour·0Gurhan Kiziloz·0AI-Powered Crypto Phishing Infrastructure 2026·0EU MiCA Regulator Impersonation Scam Wave·0DOJ Pig Butchering $25M Forfeiture 2026·0YieldBlox Stellar Oracle Manipulation Exploit (Feb 2026)·0Q2 2026 Bridge Exploit Wave·0Blazar Token / John A. DeSalvo·0Miasma npm Supply Chain Attack (Red Hat)·0BonkDAO Treasury Governance Attack·0Indonesia Pig Butchering Syndicate — Live Model Operation (2025-2026)·0Mass Ethereum Address-Poisoning Wave (Dec 2025-Jan 2026)·0IRS Fake Digital Asset Compliance Portal Phishing Campaign 2026·0Voyager Digital·0Mastra AI npm Supply Chain Attack (June 2026)·0Lab·0Gurhan Kiziloz (BlockDAG Co-Founder)·0MEV Bot Scam — YouTube AI Trading Bot Campaign (2026)·0DSJEX / BG Wealth Sharing·0Ben 'BitBoy' Armstrong·0BitMart Exchange — Insolvency Claims and Frozen Withdrawals (August 2026)·0Huione Group (Haowang Guarantee)·0Google Coin / Fake Gemini AI Chatbot Presale Operation·0Chris Larsen·0BonkDAO Treasury Governance Attack (July 2026)·0Alameda Research·0Interpol Operation First Light 2026 — $123M Romance Scam Crypto Network·0fake Ledger Live app·0IRS Fake Digital Asset Compliance Portal Letter Campaign — 2026·0MiCA Transition Impersonation Scam Wave 2026·0MiCA Post-Deadline Impersonation Scam Cluster — ESMA/AMF Warning August 2026·0LAB / LABUSDT·0Bitcoin Latinum·0Aurum Foundation·0EU MiCA Post-Deadline Regulator Impersonation Scam Cluster·0StableMagnet·2Socket Security Malicious Browser Extension Campaign August 2026·2HQI Exchange·2Jonathan Spalletta — Uranium Finance Exploiter·2Google Coin / Fake Gemini AI Chatbot Presale Scam·2Blur Finance·2TurtleDex·2Gotbit·2FCoin·3RaveDAO (RAVE Token)·4LAB Token (Smartliquid AI)·4AscendEX Exchange·4DxSale·4LAB Token·4Crypto Beast (ALT Token Influencer)·4LML/USDT staking protocol·4SKP / Skippy Token·4Venus Protocol THE Token Flash-Loan Exploit (March 2026)·5Web3Port·5JELLY·5WallStreetBets·5Sportsbet·6Huobi / HTX·7Terra 2.0·7Roberto Zibert·8LULA Token (BSC Reserve Manipulation Exploit)·8Poolin Technology·8C&M Software·8MANTRA Chain·10BitMEX (2026 Class Action — Insider Trading and Liquidation Fraud)·10Qubit Finance·10Curio·10Bunny Finance·10Blizz Finance·10Sheldon Xia (BitMart Founder)·10EasyFi·10BearnFi·12Bidao·12Joaquin Diaz (Orionx Co-Founder)·12Masa·12Gym Network·12PlayDapp·12Popsicle Finance·12Pi Network (PI)·14Loopring DEX — Trustless Exit Disabled at Shutdown·14Garden Finance·14BNB Chain Bridge·16Levyathan·18FOMO Token·18PancakeBunny·18BounceBit L1 Exploit and Chain Shutdown (August 2026)·18MiCA EU Mass Non-Compliance — 83% Unlicensed Platform Risk·18Dexible V2·18Fantasm Finance·18Cetus CLMM·18Alpha Finance Lab·18Noones·18ForceBridge·20BurgerSwap·22EdgeX / EDGE Token·22Gravity Bridge·22DAO Maker Vesting·22Syscoin Bridge·22XT Exchange·22RocketSwap Base·22Renzo·22Africoin·22MYX Finance·22B² Network·23Aster (ASTER)·23Hyperbridge (Polkadot-Ethereum Bridge) — April 2026 Exploit·24Binance - MiCA Greece Application Withdrawal·25HTX (Huobi) Exchange·25Sirio Finance·28Orion Pools·28Superfortune AI (GUA)·28Boop (boop.fun)·28Pike Finance·28Nesa (NES)·28TAC Network·28Growth DeFi·28Mixin Network·28Moola Market·28BtcTurk·28Renzo Protocol·28Nexera·32PiggyBank Protocol·32ChangeNOW·32TempleDAO·32Blend Pools V2·32Eleven Finance·32Goose Finance·32Aethir·36Dogwifhat (WIF)·38MONA (Monavale / DIGITALAX)·38Fogo·38Astera.fi·38Axie Infinity·38Symbiosis Finance·38IoTeX·38WazirX·38THORChain GG20 MPC Vault Exploit (May 2026)·38USD1 (World Liberty Financial)·38Unilend V2·38KAT katana-network·39Jump Trading·42SafePal·42Fantom (Sonic Labs)·42Orion Protocol·42DGLD·42Midnight Network / NIGHT Token·42Polygon (POL)·44Binance·45Aptos·50Clober Liquidity Vault·52PeopleDAO·52THORChain·52Robinhood Crypto·54Celestia·54Ethena·55Trust Wallet·55Allo Protocol·57Sei Network·58Synthetix·58Linea·58Scroll·58Ethena·58Playsomo·60Convex Finance·62PAX Gold (PAXG)·62Kaspa·64Lido Finance·70BlackRock USD Institutional Digital Liquidity Fund (BUIDL)·82ZachXBT·82
- □Moneroorganizationalso inZyaire Wilkins (Steam Malware Crypto Theft Ring)·0$91M Bitcoin Social Engineering Theft — Hardware Wallet Impersonation (August 2026)·0Gamer Crew $263M Social Engineering Ring (New Defendants)·0OFAC ISIS-K 134-Address SDN Batch (July 2026)·0ISIS-K Crypto Funding Network (OFAC July 2026)·0ClickFix macOS Go-Based Infostealer Crypto Wallet Drainer (August 2026)·0Fake Trezor Support Social Engineering — $282M Heist·0WEL1DROPPER — 800 Malicious npm Packages RAT and Crypto Infostealer Campaign (August 2026)·0Trenton Richard Johnston·2Jonathan Spalletta — Uranium Finance Exploiter·2Jonathan Spalletta·2eXch·2AudiA6 Mixing Service·3M1llionz (RichMilly666)·3TradeOgre·4Nomad Bridge·8Cosmos EVM Vulnerability — August 2026 Six-Chain Exploit·18Austin Fine (@xmrfine)·18zombies·25Coinsbuy·26TBTFW (Beverly Hills Luxury Car Dealer — Crypto Laundering Vector)·28Nesa (NES)·28Mixin Network·28Revolut Data Breach (Fake Government Request, September 2026)·30ChangeNOW·32THORChain GG20 MPC Vault Exploit (May 2026)·38Midnight Network / NIGHT Token·42Midnight (NIGHT Token)·44THORChain·52Bittensor·52Gnosis Pay Zodiac Delay Module Exploit·57Monero·58Litecoin·64
- ♦Litecointokenalso inQ2 2026 Record Crypto Hack Wave·0$91M Bitcoin Social Engineering Theft — Hardware Wallet Impersonation (August 2026)·0ClickFix macOS Go-Based Infostealer Crypto Wallet Drainer (August 2026)·0WEL1DROPPER — 800 Malicious npm Packages RAT and Crypto Infostealer Campaign (August 2026)·0Fake Trezor Support Social Engineering — $282M Heist·0eXch·2AudiA6 Mixing Service·3AscendEX Exchange·4RaveDAO (RAVE Token)·4Pi Network (PI)·14zombies·25THORChain GG20 MPC Vault Exploit (May 2026)·38THORChain·52SushiSwap·52Litecoin·64Kaspa·64
- □Malone Lamorganizationalso in$91M Bitcoin Social Engineering Theft — Hardware Wallet Impersonation (August 2026)·0Gamer Crew $263M Social Engineering Ring (New Defendants)·0Fake Trezor Support Social Engineering — $282M Heist·0Austin Fine (@xmrfine)·18Kroll·18TBTFW (Beverly Hills Luxury Car Dealer — Crypto Laundering Vector)·28ZachXBT·82
- □Veer Chetalorganizationalso inVeer Chetal·2
- □Evan Tangemanorganizationalso inEvan Tangeman·2
- △Gemini Exchangeexchangealso inGemini Exchange·58
Timeline(11 events)
October 2023
Criminal enterprise allegedly begins operating, targeting cryptocurrency holders using hacked databases and social engineering.
23 June 2024
Mark Cuban's wallet markcuban.eth is allegedly targeted in a social engineering attack linked by ZachXBT to the same device indicators later found in the $243M theft.
July 2024
Second victim in New Mexico targeted in an armed home invasion burglary of a hardware cryptocurrency wallet.
18 August 2024
Malone Lam and co-conspirators steal 4,100+ Bitcoin (approx. $230–243M) from a Genesis creditor in Washington, D.C., via social engineering impersonating Google and Gemini support.
18 September 2024
Malone Lam arrested by FBI in Miami after discarding phone in Biscayne Bay; Jeandiel Serrano arrested in Los Angeles the same day.
19 September 2024
Initial federal indictment unsealed against Lam and Serrano, charging conspiracy to steal and launder cryptocurrency.
March 2025
Veer Chetal arrested; separately, Chetal's parents are targeted in a violent kidnapping attempt in Danbury, Connecticut, connected to the stolen funds.
May 2025
Superseding indictment unsealed against 12 additional defendants (17 total) expanding the RICO conspiracy charges and adding new theft incidents. Total alleged stolen value revised to over $263 million.
December 2025
Danish Zulfiqar, identified by ZachXBT as a British co-conspirator, reportedly arrested in Dubai.
Decision Log
- hash: 9EXEgZHjVzKAfGvcCXMQMQR6oBXR4MsfvDgQHkxTTvxq
- hash: Fdonvq5MXzwZJFA78YW5bzHvfnLqZgA3uTR9goHvLQkX
- hash: C4mGZqqGv2e9xnneB8jgGoQhfB8uL3Cjdf6mY8zMKztH
This investigation is cryptographically anchored to the Solana blockchain (3 events).
model: claude-sonnet
generated: 5/4/2026, 4:04:59 PM
last updated: 8/29/2026, 1:35:59 AM
10 viewsavoid.net — verified advice for a post-truth world