Malone Lam Crypto Syndicate
Summary
The Malone Lam Crypto Syndicate, also known as the Social Engineering Enterprise (SEE), is an alleged multi-state criminal organization that stole approximately $263 million in cryptocurrency between October 2023 and May 2025 through social engineering, residential home invasions, and hardware wallet theft. Led by Singaporean national Malone Lam (alias 'Anne Hathaway', 'Greavys'), the enterprise comprised at least 14 members recruited through online gaming platforms and operated specialized roles including database hackers, social engineering callers, money launderers, and physical burglars. The DOJ charged the organization under the RICO statute — one of the most aggressive crypto theft prosecutions ever filed — and as of June 2026, nine co-defendants have pleaded guilty and been sentenced to 70–78 months, while Lam and co-lead Jeandiel Serrano remain in pre-trial proceedings.
Connected Entities
1 entities · 10 linked investigations- + 5 more
Timeline(16 events)
2023-10
Malone Lam and initial co-conspirators begin the Social Engineering Enterprise while residing together in Texas, recruiting members through online gaming networks.
TRM Labs analysis; DOJ superseding indictment2024-02
Marlon Ferro ('GothFerrari') allegedly breaks into a home in Winnsboro, Texas, stealing approximately 100 Bitcoin worth over $5 million.
Coin Edition: Marlon Ferro Sentenced2024-07
Marlon Ferro allegedly conducts a home invasion in New Mexico while Lam monitors the victim's location via iCloud, resulting in theft of over $14 million in cryptocurrency from a second victim.
TRM Labs analysis; DOJ indictment2024-08-18
Malone Lam and Jeandiel Serrano execute a social engineering attack against a Genesis creditor in Washington, D.C., stealing over 4,100 Bitcoin valued at approximately $230–243 million — the largest single cryptocurrency theft from an individual victim on record at the time.
DOJ indictment; CoinDesk2024-09
ZachXBT publishes blockchain analysis identifying 'Greavys' (Lam), 'Box' (Serrano), and 'Wiz' (Chetal) as the primary suspects. Over $9 million in stolen assets are frozen.
CoinDesk; Cyber Insider2024-09
Malone Lam arrested in Miami; Jeandiel Serrano arrested in Los Angeles. Both charged with conspiracy to steal and launder cryptocurrency. Initial indictment filed in U.S. District Court for the District of Columbia.
DOJ; CBS Miami2024-10
CNBC reports that co-conspirator Veer Chetal's parents were carjacked in Connecticut in a botched kidnapping-for-ransom scheme allegedly connected to the August 2024 Bitcoin theft proceeds.
CNBC2025-05-13
Marlon Ferro arrested with two firearms and false identification documents.
Coin Edition: Marlon Ferro Sentenced2025-05-15
Superseding indictment unsealed adding 12 additional defendants including Kunal Mehta, Hamza Doost, Joel Cortez, Evan Tangeman, Marlon Ferro, Conor Flansburg, Nicholas Dellecave, Mustafa Ibrahim, and Danish Zulfiqar. Charges include RICO conspiracy, wire fraud conspiracy, money laundering, and obstruction of justice.
DOJ: Additional 12 Defendants Charged2025-05-19
Malone Lam appears in Washington, D.C., federal court and pleads not guilty to the superseding indictment.
99Bitcoins; Gate News2025-11-18
Kunal Mehta ('Papa', 'The Accountant', 'Shrek') pleads guilty to RICO conspiracy; eighth defendant to plead guilty.
IRS Criminal Investigation press release2025-12
Evan Tangeman pleads guilty to RICO conspiracy; ninth defendant to plead guilty.
Decrypt; The Record2026-01-12
Status conference held in U.S. District Court for D.C. regarding plea negotiations for Malone Lam and Jeandiel Serrano. Both remain in pre-trial detention.
CourtListener docket; Gate News2026-04-24
Evan Tangeman sentenced to 70 months in federal prison plus 3 years supervised release for his role in laundering stolen funds and obstructing justice.
The Record; The Block2026-05
Marlon Ferro sentenced to 78 months in federal prison, 3 years supervised release, and $2.5 million restitution for conducting home invasions to steal hardware wallets.
The Register; Coin EditionDecision Log
- hash: 7JNJDsbqertY4jeqLFkNY3tFpfdsySQy1whR3xKj3Mpt
This investigation is cryptographically anchored to the Solana blockchain and source URLs are archived via the Internet Archive.
model: claude-sonnet-4-6
generated: 6/15/2026, 11:27:10 PM
last updated: 6/15/2026, 11:27:22 PM
avoid.net — verified advice for a post-truth world