Audit log

Every state-changing event for Malone Lam Crypto Syndicate: moderation decisions on community submissions, plus corrections and updates from the news pipeline. URL-based decisions carry three independent witnesses — the original source, an Internet Archive snapshot taken at submission time, and a Solana memo signed by our publicly-disclosed publisher key.

1. #1publishby system:backfill

   2026-06-15 23:27:22Z
   Score: ? → ? (no score change)
   anchoranchored

   chain

   ●mainnet-betaslot 426,733,851

   sig

   4DGtC5bh3ZLD…XrZSYu1Kcopyexplorer ↗

   hash

   7JNJDsbqertY…3xKj3Mptcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (33178 B) ▸

   {"actor":"system:backfill","investigation_id":"77f1bc76-abe9-4d92-8447-2baa6f8c9f17","kind":"publish","page_slug":"malone-lam-crypto-syndicate","published_at":"2026-06-15T23:27:22.046Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"Malone Lam Crypto Syndicate","sections":[{"content":"The Social Engineering Enterprise (SEE) was an alleged criminal organization founded approximately October 2023 by Malone Lam Yu Xuan, a Singaporean national born July 19, 2004, who resided in Miami and Los Angeles. Lam operated under the online aliases 'Anne Hathaway', 'Greavys', and '$$$'. The enterprise grew from a network of individuals connected through online gaming platforms including Minecraft and Discord, eventually encompassing at least 14 members based across California, Connecticut, New York, Florida, and internationally.\n\nMembers operated in specialized roles: database hackers who acquired victim information from dark web data purchases; 'callers' who impersonated support staff at Google, Gemini, and other cryptocurrency platforms; target identifiers; money launderers who funneled proceeds through mixers, peel chains, and cross-chain swaps; and physical burglars who conducted residential home invasions to steal hardware wallets when digital methods were insufficient. The DOJ charged the organization under the Racketeer Influenced and Corrupt Organizations Act (RICO), treating the network as a cohesive organized crime enterprise — a historically rare application of the statute to cryptocurrency theft.","heading":"Overview and Criminal Enterprise Structure","severity":"critical","sources":[{"credibility":1,"name":"DOJ: Additional 12 Defendants Charged in RICO Conspiracy for over $263 Million Cryptocurrency Thefts","type":"regulatory","url":"https://www.justice.gov/usao-dc/pr/additional-12-defendants-charged-rico-conspiracy-over-263-million-cryptocurrency-thefts"},{"credibility":2,"name":"TRM Labs: DOJ Uses Organized Crime Statute in $263 Million Cryptocurrency Theft, Money Laundering and Home Invasion Conspiracy","type":"research","url":"https://www.trmlabs.com/resources/blog/doj-uses-organized-crime-statute-in-263-million-cryptocurrency-theft-money-laundering-and-home-invasion-conspiracy"},{"credibility":1,"name":"IRS Criminal Investigation: Cryptocurrency money launderer pleads guilty to RICO conspiracy","type":"regulatory","url":"https://www.irs.gov/compliance/criminal-investigation/cryptocurrency-money-launderer-pleads-guilty-to-rico-conspiracy-in-scheme-that-stole-263-million-in-crypto"}]},{"content":"The enterprise's largest alleged theft occurred on August 18–19, 2024, when Lam and co-conspirator Jeandiel Serrano allegedly stole over 4,100 Bitcoin — valued at approximately $230–243 million at the time — from a single victim in Washington, D.C., who was a creditor of the defunct Genesis crypto trading firm.\n\nThe attack employed a multi-stage social engineering scheme. Attackers first called the victim using a spoofed telephone number impersonating Google Support, claiming the victim's account had been compromised. They then called again impersonating Gemini cryptocurrency exchange support, instructing the victim to reset two-factor authentication settings and install remote-access software (AnyDesk). Through the screen-sharing session, attackers obtained the victim's Bitcoin private keys and drained the wallet. The stolen funds were split across multiple wallets and routed through more than 15 exchanges using peel chains, pass-through wallets, cryptocurrency mixers, and VPNs to obscure the money trail.\n\nOn-chain investigator ZachXBT, collaborating with CFInvestigators, zeroshadow, and Binance Security, identified the primary suspects through blockchain tracing and activity correlation, ultimately helping law enforcement freeze more than $9 million in stolen assets and return approximately $500,000 to the victim. ZachXBT published a thread identifying the perpetrators by their online aliases — 'Greavys' (Lam), 'Wiz' (Veer Chetal), and 'Box' (Serrano) — based in part on operational security errors including an exposed address used to purchase luxury clothing. Lam was further identified because his girlfriend shared location photographs on Instagram each night.","heading":"The $230 Million Bitcoin Theft (August 2024)","severity":"critical","sources":[{"credibility":1,"name":"DOJ: Indictment Charges Two in $230 Million Cryptocurrency Scam","type":"regulatory","url":"https://www.justice.gov/usao-dc/pr/indictment-charges-two-230-million-cryptocurrency-scam"},{"credibility":2,"name":"CoinDesk: Police Arrests Two People Related to $243M Crypto Heist Targeting Genesis Creditor","type":"news_article","url":"https://www.coindesk.com/business/2024/09/19/police-arrests-two-people-related-to-243m-crypto-heist-targeting-genesis-creditor"},{"credibility":2,"name":"The Record: DOJ charges hackers for stealing $230 million in crypto from individual","type":"news_article","url":"https://therecord.media/doj-charges-hackers-for-230-million-crypto-heist"},{"credibility":2,"name":"Cyber Insider: Two Arrested for $230M Crypto Heist Based on ZachXBT's Investigation","type":"news_article","url":"https://cyberinsider.com/two-arrested-for-230-crypto-heist-based-on-zachxbts-investigation/"},{"credibility":2,"name":"CBS Miami: 2 men from Miami and Los Angeles charged in $230 million cryptocurrency scam","type":"news_article","url":"https://www.cbsnews.com/miami/news/2-men-from-miami-and-los-angeles-charged-in-230-million-cryptocurrency-scam-fbi-says/"}]},{"content":"Alongside digital social engineering, the enterprise allegedly conducted physical home invasions to steal hardware wallets when online methods were insufficient. Marlon Ferro (alias 'GothFerrari'), aged 19–20 of Santa Ana, California, served as the syndicate's 'physical-access operator.' In February 2024, Ferro allegedly broke into a home in Winnsboro, Texas, stealing approximately 100 Bitcoin worth over $5 million at the time.\n\nIn July 2024, Ferro traveled to New Mexico where he allegedly conducted surveillance on a victim's home and then broke in using a brick through a window — captured on surveillance footage — while Lam allegedly monitored the victim's location in real time by logging into the victim's iCloud account. This operation allegedly yielded over $14 million in cryptocurrency from a second victim. Ferro was arrested on May 13, 2025, in possession of two firearms and false identification documents.\n\nIn a separate incident tied to the August 2024 Bitcoin theft, co-conspirator Veer Chetal's parents were allegedly carjacked in Connecticut one week after the heist, in what prosecutors allege was a botched kidnapping-for-ransom scheme executed by six Florida-based associates targeting proceeds from the theft.","heading":"Home Invasions and Physical Theft Operations","severity":"critical","sources":[{"credibility":2,"name":"Coin Edition: Marlon Ferro Sentenced to 78 Months in $250M Crypto Theft Network Case","type":"news_article","url":"https://coinedition.com/marlon-ferro-sentenced-to-78-months-in-250m-crypto-theft-network-case/"},{"credibility":2,"name":"The Register: $250M crypto-robbing gang's dirty work guy sentenced to 6.5 years behind bars","type":"news_article","url":"https://www.theregister.com/cyber-crime/2026/05/07/250m-crypto-robbing-gangs-dirty-work-guy-sentenced-to-65-years-behind-bars/5234787"},{"credibility":1,"name":"CNBC: Historic bitcoin theft tied to Connecticut kidnapping, luxury cars, $500K bar bills","type":"news_article","url":"https://www.cnbc.com/2024/10/17/cryptocurrency-theft-google-kidnapping-lamborghi-bar-.html"},{"credibility":2,"name":"TRM Labs: DOJ Uses Organized Crime Statute","type":"research","url":"https://www.trmlabs.com/resources/blog/doj-uses-organized-crime-statute-in-263-million-cryptocurrency-theft-money-laundering-and-home-invasion-conspiracy"}]},{"content":"The enterprise allegedly laundered stolen cryptocurrency through a multi-layered scheme involving peel chains, pass-through wallets, cryptocurrency mixers, cross-chain swaps, and cash-outs at high-risk exchanges. Multiple defendants served specialized money laundering roles.\n\nKunal Mehta (aliases 'Papa', 'The Accountant', 'Shrek') of Irvine, California, the eighth defendant to plead guilty (November 18, 2025), allegedly laundered at least $25 million and created shell companies to facilitate cryptocurrency-to-cash conversions, charging a 10% fee. He also purchased exotic vehicles through shell companies to obscure true ownership.\n\nEvan Tangeman, 22, of California, the ninth defendant to plead guilty (December 2025), laundered at least $3.5 million, secured luxury rental homes across California and Florida using false identities, and after the September 2024 arrests of Lam and Serrano, allegedly directed other members to destroy digital devices to obstruct the investigation. Law enforcement recovered a Rolls Royce Ghost (valued over $300,000) and Porsche GT3 RS from his properties.\n\nThe group's spending patterns were alleged to be extravagant: members reportedly spent approximately $4 million at Los Angeles nightclubs over a three-week period, up to $500,000 in a single night, chartered private jets, purchased designer clothing (over $255,000 on record), luxury watches, jewelry, and rented mansions using fraudulent documents. Bulk cash was allegedly concealed for transport inside stuffed animals (Squishmallows toys). Proceeds were also allegedly distributed as Hermes bags as gifts.","heading":"Money Laundering and Proceeds","severity":"critical","sources":[{"credibility":1,"name":"IRS Criminal Investigation: Cryptocurrency money launderer pleads guilty to RICO conspiracy (Kunal Mehta)","type":"regulatory","url":"https://www.irs.gov/compliance/criminal-investigation/cryptocurrency-money-launderer-pleads-guilty-to-rico-conspiracy-in-scheme-that-stole-263-million-in-crypto"},{"credibility":2,"name":"The Record: Money launderer for crypto thieves given 5-year sentence (Evan Tangeman)","type":"news_article","url":"https://therecord.media/cryptocurrency-launderer-sentenced-californai"},{"credibility":2,"name":"DL News: First they met as teen gamers, then they ran $263m Bitcoin racket, feds say","type":"news_article","url":"https://www.dlnews.com/articles/people-culture/bitcoin-thieves-smuggled-bulk-cash-in-squishmallows-toys/"},{"credibility":2,"name":"KTLA: SoCal man who laundered $263M in stolen crypto, lived 'fantastically extravagant' lifestyle, sentenced to prison","type":"news_article","url":"https://ktla.com/news/local-news/socal-man-who-laundered-263-million-in-stolen-cryptocurrency-lived-fantastically-extravagant-lifestyle-sentenced-to-prison/"}]},{"content":"Malone Lam and Jeandiel Serrano were arrested in September 2024 and charged with conspiracy to steal and launder cryptocurrency. Lam appeared in the U.S. District Court for the Southern District of Florida; Serrano appeared in the Central District of California. The initial indictment charged the pair in connection with the $230 million August 2024 theft.\n\nIn May 2025, a superseding indictment charged 12 additional defendants — including Kunal Mehta, Hamza Doost, Joel Cortez, Evan Tangeman, Marlon Ferro, Conor Flansburg, Nicholas Dellecave, Mustafa Ibrahim, Danish Zulfiqar, and others — under RICO conspiracy, conspiracy to commit wire fraud, money laundering, and obstruction of justice. Two defendants remain at large, reportedly in Dubai.\n\nThe DOJ's invocation of the RICO statute, traditionally reserved for organized crime, was a significant escalation. Prosecutors treated the SEE as a cohesive criminal enterprise with defined roles and structure, rather than a collection of individual offenders. The case is reported to be among the first Bitcoin-related RICO prosecutions in U.S. history, and represents what prosecutors have described as one of the most aggressive crypto theft charge sets ever filed.\n\nAs of June 2026, nine defendants have pleaded guilty. Lam pleaded not guilty on May 19, 2025, and as of January 2026, plea negotiations were still ongoing, with a status conference scheduled for January 12, 2026. The case docket is United States v. LAM, 1:24-cr-00417 (D.D.C.).","heading":"Charges, Indictments, and RICO Application","severity":"critical","sources":[{"credibility":1,"name":"DOJ: Guilty Plea and Superseding Indictment Announced in Social Engineering Scheme that Stole $263 Million","type":"regulatory","url":"https://www.justice.gov/usao-dc/pr/guilty-plea-and-superseding-indictment-announced-social-engineering-scheme-stole-263"},{"credibility":1,"name":"DOJ: Additional 12 Defendants Charged in RICO Conspiracy","type":"regulatory","url":"https://www.justice.gov/usao-dc/pr/additional-12-defendants-charged-rico-conspiracy-over-263-million-cryptocurrency-thefts"},{"credibility":1,"name":"CourtListener: United States v. LAM, 1:24-cr-00417","type":"court_filing","url":"https://www.courtlistener.com/docket/69343233/united-states-v-lam/"},{"credibility":2,"name":"The Record: California man pleads guilty to RICO charges as DOJ indicts crypto theft gang","type":"news_article","url":"https://therecord.media/california-man-pleads-guilty-rico-charges-crypto-theft"},{"credibility":2,"name":"Bank Info Security: Cryptohack Roundup: 12 Charged in $263M Theft Case","type":"news_article","url":"https://www.bankinfosecurity.com/cryptohack-roundup-12-charged-in-263m-theft-case-a-28459"}]},{"content":"As of June 2026, nine co-defendants have pleaded guilty to RICO conspiracy and related charges. Sentences issued to date range from 70 to 78 months in federal prison.\n\nEvan Tangeman (22, California) — ninth to plead guilty (December 2025); sentenced to 70 months plus 3 years supervised release for laundering at least $3.5 million and facilitating evidence destruction.\n\nMarlon Ferro (20, Santa Ana, California; alias 'GothFerrari') — pleaded guilty October 17, 2025; sentenced to 78 months plus 3 years supervised release and $2.5 million restitution for conducting physical home invasions to steal hardware wallets.\n\nKunal Mehta (Irvine, California; aliases 'Papa', 'The Accountant', 'Shrek') — pleaded guilty November 18, 2025, to RICO conspiracy for laundering at least $25 million, creating shell companies, and purchasing exotic vehicles to conceal proceeds.\n\nConor Flansburg — pleaded guilty to RICO conspiracy for his role as a database hacker and group organizer.\n\nAdditional defendants — Hamza Doost, Joel Cortez, and others — have also pleaded guilty per DOJ records.\n\nMalone Lam and Jeandiel Serrano remain in pre-trial proceedings as of June 2026. If convicted, Lam faces a potential minimum 20-year sentence. All defendants are being prosecuted in the U.S. District Court for the District of Columbia, with U.S. Attorney Jeanine Ferris Pirro and Assistant U.S. Attorney Kevin Rosenberg leading the prosecution.","heading":"Guilty Pleas and Sentencing","severity":"high","sources":[{"credibility":2,"name":"The Block: 22-year-old sentenced to 70 months for money laundering tied to $263 million crypto syndicate","type":"news_article","url":"https://www.theblock.co/post/398899/22-year-old-sentenced-to-70-months-for-money-laundering-tied-to-263-million-crypto-syndicate"},{"credibility":2,"name":"Coin Edition: Marlon Ferro Sentenced to 78 Months","type":"news_article","url":"https://coinedition.com/marlon-ferro-sentenced-to-78-months-in-250m-crypto-theft-network-case/"},{"credibility":1,"name":"IRS Criminal Investigation: Kunal Mehta pleads guilty","type":"regulatory","url":"https://www.irs.gov/compliance/criminal-investigation/cryptocurrency-money-launderer-pleads-guilty-to-rico-conspiracy-in-scheme-that-stole-263-million-in-crypto"},{"credibility":2,"name":"Decrypt: Ninth Defendant Pleads Guilty in $263M Crypto Social-Engineering Scheme","type":"news_article","url":"https://decrypt.co/351576/ninth-defendant-pleads-guilty-263m-crypto-scheme"},{"credibility":2,"name":"The Record: Money launderer for crypto thieves given 5-year sentence","type":"news_article","url":"https://therecord.media/cryptocurrency-launderer-sentenced-californai"}]},{"content":"The initial identification of Lam and Serrano was significantly aided by independent blockchain investigator ZachXBT, who published a detailed analysis thread shortly after the August 2024 theft. Working with collaborators CFInvestigators, zeroshadow, and Binance Security, ZachXBT traced the stolen funds through more than 15 exchanges and constructed an activity/identity correlation diagram linking the suspects' online aliases to their real identities.\n\nThe perpetrators made several operational security errors that facilitated identification: a slip-up on a Windows start page, an address used to purchase luxury clothing that was inadvertently shared, and Instagram posts by Lam's girlfriend that revealed his nightly location. ZachXBT identified the three primary aliases as 'Greavys' (Lam), 'Wiz' (Veer Chetal), and 'Box' (Serrano) before law enforcement arrests.\n\nThe collaborative investigation resulted in the freezing of more than $9 million in stolen assets, with approximately $500,000 returned to the victim. The stolen Bitcoin — over 4,100 BTC — was valued at approximately $230–243 million at the time of theft; as of late 2025, that quantity of Bitcoin is estimated to be worth approximately $384 million.","heading":"On-Chain Investigation and Asset Recovery","severity":"medium","sources":[{"credibility":2,"name":"CoinDesk: Police Arrests Two People Related to $243M Crypto Heist Targeting Genesis Creditor","type":"news_article","url":"https://www.coindesk.com/business/2024/09/19/police-arrests-two-people-related-to-243m-crypto-heist-targeting-genesis-creditor"},{"credibility":2,"name":"The Block: Crypto sleuth ZachXBT claims British threat actor tied to $243 million Genesis creditor theft 'likely arrested'","type":"news_article","url":"https://www.theblock.co/post/381481/crypto-sleuth-zachxbt-claims-british-threat-actor-tied-to-243-million-genesis-creditor-theft-likely-arrested"},{"credibility":2,"name":"Cyber Insider: Two Arrested for $230 Crypto Heist Based on ZachXBT's Investigation","type":"news_article","url":"https://cyberinsider.com/two-arrested-for-230-crypto-heist-based-on-zachxbts-investigation/"}]},{"content":"The Social Engineering Enterprise's methods represent a well-documented threat model for high-value cryptocurrency holders. The syndicate specifically targeted individuals known to hold large amounts of Bitcoin, including creditors from high-profile bankruptcies such as Genesis. Victim identification relied on leaked databases purchased from dark web markets, combined with open-source intelligence to map target wealth.\n\nThe attack methodology — spoofed phone calls impersonating major platform support, followed by requests to reset two-factor authentication and install remote access software — exploited victims' trust in branded customer support infrastructure. The use of iCloud account access to surveil victims' physical locations prior to home invasions adds a physical-world dimension to the threat.\n\nSecurity researchers and law enforcement have highlighted that the case underscores risks for holders of large self-custodied crypto positions, particularly those identified through public blockchain data or exchange bankruptcy proceedings. The case also illustrates the risk of remote access software installation in response to unsolicited support calls — a vector that bypasses hardware wallet protections if private keys are handled on a screen-share session.","heading":"Threat to Cryptocurrency Holders and Security Implications","severity":"high","sources":[{"credibility":2,"name":"TRM Labs: DOJ Uses Organized Crime Statute in $263 Million Cryptocurrency Theft","type":"research","url":"https://www.trmlabs.com/resources/blog/doj-uses-organized-crime-statute-in-263-million-cryptocurrency-theft-money-laundering-and-home-invasion-conspiracy"},{"credibility":2,"name":"Bleeping Computer: US charges 12 more suspects linked to $230 million crypto theft","type":"news_article","url":"https://www.bleepingcomputer.com/news/security/us-charges-12-more-suspects-linked-to-230-million-crypto-theft/"}]}],"sources_used":[{"credibility":1,"name":"DOJ: Indictment Charges Two in $230 Million Cryptocurrency Scam","type":"regulatory","url":"https://www.justice.gov/usao-dc/pr/indictment-charges-two-230-million-cryptocurrency-scam"},{"credibility":1,"name":"DOJ: Guilty Plea and Superseding Indictment Announced in Social Engineering Scheme that Stole $263 Million","type":"regulatory","url":"https://www.justice.gov/usao-dc/pr/guilty-plea-and-superseding-indictment-announced-social-engineering-scheme-stole-263"},{"credibility":1,"name":"DOJ: Additional 12 Defendants Charged in RICO Conspiracy for over $263 Million Cryptocurrency Thefts","type":"regulatory","url":"https://www.justice.gov/usao-dc/pr/additional-12-defendants-charged-rico-conspiracy-over-263-million-cryptocurrency-thefts"},{"credibility":1,"name":"DOJ USAO-DC: California Money Launderer Sentenced in D.C. to 70 Months","type":"regulatory","url":"https://www.justice.gov/usao-dc/pr/california-money-launderer-sentenced-dc-70-months-role-scheme-stole-263-million"},{"credibility":1,"name":"IRS Criminal Investigation: Cryptocurrency money launderer pleads guilty to RICO conspiracy (Kunal Mehta)","type":"regulatory","url":"https://www.irs.gov/compliance/criminal-investigation/cryptocurrency-money-launderer-pleads-guilty-to-rico-conspiracy-in-scheme-that-stole-263-million-in-crypto"},{"credibility":1,"name":"IRS Criminal Investigation: Guilty plea and superseding indictment announced in social engineering scheme","type":"regulatory","url":"https://www.irs.gov/compliance/criminal-investigation/guilty-plea-and-superseding-indictment-announced-in-social-engineering-scheme-that-stole-263-million-in-cryptocurrency"},{"credibility":1,"name":"CourtListener: United States v. LAM, 1:24-cr-00417 (D.D.C.)","type":"court_filing","url":"https://www.courtlistener.com/docket/69343233/united-states-v-lam/"},{"credibility":2,"name":"TRM Labs: DOJ Uses Organized Crime Statute in $263 Million Cryptocurrency Theft, Money Laundering and Home Invasion Conspiracy","type":"research","url":"https://www.trmlabs.com/resources/blog/doj-uses-organized-crime-statute-in-263-million-cryptocurrency-theft-money-laundering-and-home-invasion-conspiracy"},{"credibility":2,"name":"The Block: 22-year-old sentenced to 70 months for money laundering tied to $263 million crypto syndicate","type":"news_article","url":"https://www.theblock.co/post/398899/22-year-old-sentenced-to-70-months-for-money-laundering-tied-to-263-million-crypto-syndicate"},{"credibility":2,"name":"The Register: $250M crypto-robbing gang's dirty work guy sentenced to 6.5 years behind bars","type":"news_article","url":"https://www.theregister.com/cyber-crime/2026/05/07/250m-crypto-robbing-gangs-dirty-work-guy-sentenced-to-65-years-behind-bars/5234787"},{"credibility":2,"name":"The Record: California man pleads guilty to RICO charges as DOJ indicts crypto theft gang","type":"news_article","url":"https://therecord.media/california-man-pleads-guilty-rico-charges-crypto-theft"},{"credibility":2,"name":"The Record: Money launderer for crypto thieves given 5-year sentence","type":"news_article","url":"https://therecord.media/cryptocurrency-launderer-sentenced-californai"},{"credibility":2,"name":"The Record: Feds charge 12 more suspects in RICO case over crypto crime spree","type":"news_article","url":"https://therecord.media/feds-charge-12-suspects-in-rico-crypto-heist"},{"credibility":2,"name":"CoinDesk: Police Arrests Two People Related to $243M Crypto Heist Targeting Genesis Creditor","type":"news_article","url":"https://www.coindesk.com/business/2024/09/19/police-arrests-two-people-related-to-243m-crypto-heist-targeting-genesis-creditor"},{"credibility":2,"name":"Decrypt: Ninth Defendant Pleads Guilty in $263M Crypto Social-Engineering Scheme","type":"news_article","url":"https://decrypt.co/351576/ninth-defendant-pleads-guilty-263m-crypto-scheme"},{"credibility":2,"name":"Coin Edition: Marlon Ferro Sentenced to 78 Months in $250M Crypto Theft Network Case","type":"news_article","url":"https://coinedition.com/marlon-ferro-sentenced-to-78-months-in-250m-crypto-theft-network-case/"},{"credibility":1,"name":"CNBC: Historic bitcoin theft tied to Connecticut kidnapping, luxury cars, $500K bar bills","type":"news_article","url":"https://www.cnbc.com/2024/10/17/cryptocurrency-theft-google-kidnapping-lamborghi-bar-.html"},{"credibility":2,"name":"Bleeping Computer: US charges 12 more suspects linked to $230 million crypto theft","type":"news_article","url":"https://www.bleepingcomputer.com/news/security/us-charges-12-more-suspects-linked-to-230-million-crypto-theft/"},{"credibility":2,"name":"Cyber Insider: Two Arrested for $230 Crypto Heist Based on ZachXBT's Investigation","type":"news_article","url":"https://cyberinsider.com/two-arrested-for-230-crypto-heist-based-on-zachxbts-investigation/"},{"credibility":2,"name":"CBS Miami: 2 men from Miami and Los Angeles charged in $230 million cryptocurrency scam","type":"news_article","url":"https://www.cbsnews.com/miami/news/2-men-from-miami-and-los-angeles-charged-in-230-million-cryptocurrency-scam-fbi-says/"},{"credibility":2,"name":"KTLA: SoCal man who laundered $263M in stolen crypto sentenced to prison","type":"news_article","url":"https://ktla.com/news/local-news/socal-man-who-laundered-263-million-in-stolen-cryptocurrency-lived-fantastically-extravagant-lifestyle-sentenced-to-prison/"},{"credibility":2,"name":"DL News: First they met as teen gamers, then they ran $263m Bitcoin racket, feds say","type":"news_article","url":"https://www.dlnews.com/articles/people-culture/bitcoin-thieves-smuggled-bulk-cash-in-squishmallows-toys/"},{"credibility":2,"name":"Bank Info Security: Cryptohack Roundup: 12 Charged in $263M Theft Case","type":"news_article","url":"https://www.bankinfosecurity.com/cryptohack-roundup-12-charged-in-263m-theft-case-a-28459"},{"credibility":2,"name":"KrebsOnSecurity tag: Malone 'Greavys' Lam","type":"news_article","url":"https://krebsonsecurity.com/tag/malone-greavys-lam/"},{"credibility":2,"name":"The Block: Crypto sleuth ZachXBT claims British threat actor tied to $243 million Genesis creditor theft 'likely arrested'","type":"news_article","url":"https://www.theblock.co/post/381481/crypto-sleuth-zachxbt-claims-british-threat-actor-tied-to-243-million-genesis-creditor-theft-likely-arrested"}],"summary":"The Malone Lam Crypto Syndicate, also known as the Social Engineering Enterprise (SEE), is an alleged multi-state criminal organization that stole approximately $263 million in cryptocurrency between October 2023 and May 2025 through social engineering, residential home invasions, and hardware wallet theft. Led by Singaporean national Malone Lam (alias 'Anne Hathaway', 'Greavys'), the enterprise comprised at least 14 members recruited through online gaming platforms and operated specialized roles including database hackers, social engineering callers, money launderers, and physical burglars. The DOJ charged the organization under the RICO statute — one of the most aggressive crypto theft prosecutions ever filed — and as of June 2026, nine co-defendants have pleaded guilty and been sentenced to 70–78 months, while Lam and co-lead Jeandiel Serrano remain in pre-trial proceedings.","timeline":[{"date":"2023-10","event":"Malone Lam and initial co-conspirators begin the Social Engineering Enterprise while residing together in Texas, recruiting members through online gaming networks.","source":"TRM Labs analysis; DOJ superseding indictment","source_url":"https://www.trmlabs.com/resources/blog/doj-uses-organized-crime-statute-in-263-million-cryptocurrency-theft-money-laundering-and-home-invasion-conspiracy"},{"date":"2024-02","event":"Marlon Ferro ('GothFerrari') allegedly breaks into a home in Winnsboro, Texas, stealing approximately 100 Bitcoin worth over $5 million.","source":"Coin Edition: Marlon Ferro Sentenced","source_url":"https://coinedition.com/marlon-ferro-sentenced-to-78-months-in-250m-crypto-theft-network-case/"},{"date":"2024-07","event":"Marlon Ferro allegedly conducts a home invasion in New Mexico while Lam monitors the victim's location via iCloud, resulting in theft of over $14 million in cryptocurrency from a second victim.","source":"TRM Labs analysis; DOJ indictment","source_url":"https://www.trmlabs.com/resources/blog/doj-uses-organized-crime-statute-in-263-million-cryptocurrency-theft-money-laundering-and-home-invasion-conspiracy"},{"date":"2024-08-18","event":"Malone Lam and Jeandiel Serrano execute a social engineering attack against a Genesis creditor in Washington, D.C., stealing over 4,100 Bitcoin valued at approximately $230–243 million — the largest single cryptocurrency theft from an individual victim on record at the time.","source":"DOJ indictment; CoinDesk","source_url":"https://www.justice.gov/usao-dc/pr/indictment-charges-two-230-million-cryptocurrency-scam"},{"date":"2024-09","event":"ZachXBT publishes blockchain analysis identifying 'Greavys' (Lam), 'Box' (Serrano), and 'Wiz' (Chetal) as the primary suspects. Over $9 million in stolen assets are frozen.","source":"CoinDesk; Cyber Insider","source_url":"https://www.coindesk.com/business/2024/09/19/police-arrests-two-people-related-to-243m-crypto-heist-targeting-genesis-creditor"},{"date":"2024-09","event":"Malone Lam arrested in Miami; Jeandiel Serrano arrested in Los Angeles. Both charged with conspiracy to steal and launder cryptocurrency. Initial indictment filed in U.S. District Court for the District of Columbia.","source":"DOJ; CBS Miami","source_url":"https://www.justice.gov/usao-dc/pr/indictment-charges-two-230-million-cryptocurrency-scam"},{"date":"2024-10","event":"CNBC reports that co-conspirator Veer Chetal's parents were carjacked in Connecticut in a botched kidnapping-for-ransom scheme allegedly connected to the August 2024 Bitcoin theft proceeds.","source":"CNBC","source_url":"https://www.cnbc.com/2024/10/17/cryptocurrency-theft-google-kidnapping-lamborghi-bar-.html"},{"date":"2025-05-13","event":"Marlon Ferro arrested with two firearms and false identification documents.","source":"Coin Edition: Marlon Ferro Sentenced","source_url":"https://coinedition.com/marlon-ferro-sentenced-to-78-months-in-250m-crypto-theft-network-case/"},{"date":"2025-05-15","event":"Superseding indictment unsealed adding 12 additional defendants including Kunal Mehta, Hamza Doost, Joel Cortez, Evan Tangeman, Marlon Ferro, Conor Flansburg, Nicholas Dellecave, Mustafa Ibrahim, and Danish Zulfiqar. Charges include RICO conspiracy, wire fraud conspiracy, money laundering, and obstruction of justice.","source":"DOJ: Additional 12 Defendants Charged","source_url":"https://www.justice.gov/usao-dc/pr/additional-12-defendants-charged-rico-conspiracy-over-263-million-cryptocurrency-thefts"},{"date":"2025-05-19","event":"Malone Lam appears in Washington, D.C., federal court and pleads not guilty to the superseding indictment.","source":"99Bitcoins; Gate News","source_url":"https://99bitcoins.com/news/who-is-malone-lam-13-indicted-in-263m-rico-conspiracy/"},{"date":"2025-10-17","event":"Marlon Ferro pleads guilty to RICO conspiracy.","source":"Coin Edition: Marlon Ferro Sentenced","source_url":"https://coinedition.com/marlon-ferro-sentenced-to-78-months-in-250m-crypto-theft-network-case/"},{"date":"2025-11-18","event":"Kunal Mehta ('Papa', 'The Accountant', 'Shrek') pleads guilty to RICO conspiracy; eighth defendant to plead guilty.","source":"IRS Criminal Investigation press release","source_url":"https://www.irs.gov/compliance/criminal-investigation/cryptocurrency-money-launderer-pleads-guilty-to-rico-conspiracy-in-scheme-that-stole-263-million-in-crypto"},{"date":"2025-12","event":"Evan Tangeman pleads guilty to RICO conspiracy; ninth defendant to plead guilty.","source":"Decrypt; The Record","source_url":"https://decrypt.co/351576/ninth-defendant-pleads-guilty-263m-crypto-scheme"},{"date":"2026-01-12","event":"Status conference held in U.S. District Court for D.C. regarding plea negotiations for Malone Lam and Jeandiel Serrano. Both remain in pre-trial detention.","source":"CourtListener docket; Gate News","source_url":"https://www.courtlistener.com/docket/69343233/united-states-v-lam/"},{"date":"2026-04-24","event":"Evan Tangeman sentenced to 70 months in federal prison plus 3 years supervised release for his role in laundering stolen funds and obstructing justice.","source":"The Record; The Block","source_url":"https://therecord.media/cryptocurrency-launderer-sentenced-californai"},{"date":"2026-05","event":"Marlon Ferro sentenced to 78 months in federal prison, 3 years supervised release, and $2.5 million restitution for conducting home invasions to steal hardware wallets.","source":"The Register; Coin Edition","source_url":"https://www.theregister.com/cyber-crime/2026/05/07/250m-crypto-robbing-gangs-dirty-work-guy-sentenced-to-65-years-behind-bars/5234787"}]},"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 474f38fc-565a-4a1b-ab5e-0232cb76423bcopy