Verify a decision

{"actor":"system:backfill","investigation_id":"ee791a47-4cb1-4c0f-bf0c-5991b3b4e0c8","kind":"publish","page_slug":"marlon-ferro-gothferrari","published_at":"2026-06-03T23:04:18.387Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"Marlon Ferro (GothFerrari)","sections":[{"content":"Marlon Ferro, residing in Santa Ana, California and known online as 'GothFerrari,' was sentenced on May 6, 2026 by U.S. District Judge Colleen Kollar-Kotelly in the U.S. District Court for the District of Columbia. He received 78 months (approximately 6.5 years) in federal prison, three years of supervised release, and was ordered to pay $2.5 million in restitution. Ferro had pleaded guilty on October 17, 2025 to one count of conspiracy to participate in a racketeer influenced and corrupt organization (RICO). The case is described by prosecutors as the first Bitcoin-related RICO prosecution in history. The sentencing was announced by U.S. Attorney Jeanine Ferris Pirro. The investigation was conducted by the FBI and IRS Criminal Investigation Division.","heading":"Criminal Conviction and Sentence","severity":"critical","sources":[{"credibility":1,"name":"DOJ USAO-DC: GothFerrari Sentenced 78 Months in Prison","type":"regulatory","url":"https://www.justice.gov/usao-dc/pr/gothferrari-sentenced-78-months-prison-role-massive-cryptocurrency-heist"},{"credibility":2,"name":"The Block: California man gets 78 months in $250M crypto theft case","type":"news_article","url":"https://www.theblock.co/post/400337/california-man-78-months-crypto-theft"},{"credibility":2,"name":"Washington Times: GothFerrari gets 6.5 years role in $250M crypto theft conspiracy","type":"news_article","url":"https://www.washingtontimes.com/news/2026/may/7/gothferrari-gets-65-years-role-250m-crypto-theft-conspiracy/"}]},{"content":"Ferro served as what prosecutors described as the enterprise's 'instrument of last resort.' When co-conspirators failed to deceive victims through social engineering or gain access via hacking, Ferro was dispatched to physically break into victims' homes and steal hardware wallets containing cryptocurrency. According to the DOJ, Ferro also laundered stolen funds by using fraudulent foreign identification documents to open digital payment accounts. He personally spent over $255,000 in stolen funds on designer clothing for co-conspirators. Ferro continued to assist the operation even after its primary organizer, Malone Lam, was arrested in September 2024 — including converting stolen cryptocurrency to cash and paying Lam's legal fees while Lam remained in pretrial detention.","heading":"Role in the Criminal Enterprise","severity":"critical","sources":[{"credibility":1,"name":"DOJ USAO-DC: GothFerrari Sentenced 78 Months in Prison","type":"regulatory","url":"https://www.justice.gov/usao-dc/pr/gothferrari-sentenced-78-months-prison-role-massive-cryptocurrency-heist"},{"credibility":2,"name":"CryptoTimes: GothFerrari Sentenced to 78 Months in Prison Over $250M Crypto Theft Scheme","type":"news_article","url":"https://www.cryptotimes.io/2026/05/07/gothferrari-sentenced-to-78-months-in-prison-over-250m-crypto-theft-scheme/"},{"credibility":2,"name":"Help Net Security: $250 million cryptocurrency heist funded luxury fashion, nightclub parties, and private jets","type":"news_article","url":"https://www.helpnetsecurity.com/2026/05/07/crypto-theft-home-burglary-scheme/"}]},{"content":"Two documented residential burglaries are attributed to Ferro. In February 2024, Ferro traveled to Winnsboro, Texas, broke into a victim's home, and stole a hardware wallet containing approximately 100 Bitcoin, then valued at over $5 million. In July 2024, Ferro traveled to New Mexico, where he monitored a victim's residence for several days using a strategically placed cell phone — while ringleader Malone Lam remotely tracked the victim's location via iCloud access. Ferro then broke a window with a brick and burglarized the home to steal hardware wallets. Ferro was captured on the victim's home surveillance system during the New Mexico incident, which contributed to his identification and eventual arrest.","heading":"Key Incidents: Home Burglaries","severity":"critical","sources":[{"credibility":1,"name":"DOJ USAO-DC: GothFerrari Sentenced 78 Months in Prison","type":"regulatory","url":"https://www.justice.gov/usao-dc/pr/gothferrari-sentenced-78-months-prison-role-massive-cryptocurrency-heist"},{"credibility":2,"name":"TRM Labs: DOJ Uses Organized Crime Statute in $263 Million Cryptocurrency Theft Case","type":"research","url":"https://www.trmlabs.com/resources/blog/doj-uses-organized-crime-statute-in-263-million-cryptocurrency-theft-money-laundering-and-home-invasion-conspiracy"},{"credibility":2,"name":"Coin Edition: Marlon Ferro Sentenced to 78 Months in $250M Crypto Theft Network Case","type":"news_article","url":"https://coinedition.com/marlon-ferro-sentenced-to-78-months-in-250m-crypto-theft-network-case/"}]},{"content":"Ferro was one of at least 14 defendants charged across two sets of indictments filed in September 2024 and May 2025 in connection with the criminal network prosecutors called the Social Engineering Enterprise (SEE). The enterprise operated from October 2023 through March 2025 and stole over $263 million in cryptocurrency from victims across the United States. Members were recruited primarily through online gaming platforms including Minecraft and Discord. The operation's largest single theft occurred on August 18, 2024, when ringleader Malone Lam and co-conspirator Jeandiel Serrano executed a social engineering attack on a Washington, D.C. victim — a Genesis bankruptcy creditor — draining more than 4,100 Bitcoin worth approximately $230 million at the time. The enterprise's methods included database hacking, impersonating support representatives from companies such as Google, fraudulent phone calls, residential burglary, and elaborate money laundering through luxury goods, exotic vehicles, private jets, and nightclub spending. Other named co-defendants include Jeandiel Serrano, Conor Flansburg (alleged database hacker), Kunal Mehta, Hamza Doost, Joel Cortez, and Evan Tangeman (alleged money launderers). On-chain investigator ZachXBT publicly identified Lam and Serrano in August 2024 and coordinated with blockchain security firms to freeze a portion of the stolen assets.","heading":"The Broader Criminal Enterprise (Social Engineering Enterprise / SEE)","severity":"critical","sources":[{"credibility":1,"name":"DOJ USAO-DC: Additional 12 Defendants Charged in RICO Conspiracy","type":"regulatory","url":"https://www.justice.gov/usao-dc/pr/additional-12-defendants-charged-rico-conspiracy-over-263-million-cryptocurrency-thefts"},{"credibility":1,"name":"DOJ USAO-DC: Guilty Plea and Superseding Indictment — $263 Million Social Engineering Scheme","type":"regulatory","url":"https://www.justice.gov/usao-dc/pr/guilty-plea-and-superseding-indictment-announced-social-engineering-scheme-stole-263"},{"credibility":2,"name":"Recorded Future News: Feds charge 12 more suspects in RICO case over crypto crime spree","type":"news_article","url":"https://therecord.media/feds-charge-12-suspects-in-rico-crypto-heist"},{"credibility":1,"name":"CoinDesk: Police arrest two people related to $243M crypto heist targeting Genesis creditor","type":"news_article","url":"https://www.coindesk.com/business/2024/09/19/police-arrests-two-people-related-to-243m-crypto-heist-targeting-genesis-creditor"},{"credibility":2,"name":"TRM Labs: DOJ Uses Organized Crime Statute in $263 Million Cryptocurrency Theft Case","type":"research","url":"https://www.trmlabs.com/resources/blog/doj-uses-organized-crime-statute-in-263-million-cryptocurrency-theft-money-laundering-and-home-invasion-conspiracy"}]},{"content":"Ferro was arrested on May 13, 2025. At the time of his arrest, authorities found him in possession of two firearms and a fake identification document. He had been identified in part through home surveillance footage from the July 2024 New Mexico burglary. Ferro was 19 years old at the time of his arrest and turned 20 during the period between arrest and sentencing.","heading":"Arrest and Evidence Seized","severity":"high","sources":[{"credibility":2,"name":"CryptoTimes: GothFerrari Sentenced to 78 Months in Prison Over $250M Crypto Theft Scheme","type":"news_article","url":"https://www.cryptotimes.io/2026/05/07/gothferrari-sentenced-to-78-months-in-prison-over-250m-crypto-theft-scheme/"},{"credibility":2,"name":"Coin Edition: Marlon Ferro Sentenced to 78 Months in $250M Crypto Theft Network Case","type":"news_article","url":"https://coinedition.com/marlon-ferro-sentenced-to-78-months-in-250m-crypto-theft-network-case/"}]},{"content":"The enterprise employed multiple methods to launder proceeds. Ferro personally used fraudulent foreign identification documents to open digital payment accounts through which stolen cryptocurrency was converted to cash. Enterprise members collectively laundered proceeds through purchases of luxury goods including watches valued up to $500,000, exotic vehicles (Lamborghinis, Ferraris, Porsches, Rolls-Royces), private jet charters, designer clothing, and nightclub spending of up to $500,000 per evening. Bulk cash was also allegedly hidden inside stuffed animals and sent through U.S. mail. The enterprise's total laundering footprint spanned California, Connecticut, New York, Florida, and international locations.","heading":"Money Laundering Methods","severity":"high","sources":[{"credibility":2,"name":"Help Net Security: $250 million cryptocurrency heist funded luxury fashion, nightclub parties, and private jets","type":"news_article","url":"https://www.helpnetsecurity.com/2026/05/07/crypto-theft-home-burglary-scheme/"},{"credibility":2,"name":"AOL/AP: GothFerrari cybercriminal sentenced in $263 million crypto case","type":"news_article","url":"https://www.aol.com/articles/gothferrari-cybercriminal-sentenced-263-million-020726995.html"}]}],"sources_used":[{"credibility":1,"name":"DOJ USAO-DC: GothFerrari Sentenced 78 Months in Prison for Role in Massive Cryptocurrency Heist","type":"regulatory","url":"https://www.justice.gov/usao-dc/pr/gothferrari-sentenced-78-months-prison-role-massive-cryptocurrency-heist"},{"credibility":1,"name":"DOJ USAO-DC: Additional 12 Defendants Charged in RICO Conspiracy for over $263 Million Cryptocurrency Thefts","type":"regulatory","url":"https://www.justice.gov/usao-dc/pr/additional-12-defendants-charged-rico-conspiracy-over-263-million-cryptocurrency-thefts"},{"credibility":1,"name":"DOJ USAO-DC: Guilty Plea and Superseding Indictment Announced in Social Engineering Scheme that Stole $263 Million in Cryptocurrency","type":"regulatory","url":"https://www.justice.gov/usao-dc/pr/guilty-plea-and-superseding-indictment-announced-social-engineering-scheme-stole-263"},{"credibility":2,"name":"The Block: California man gets 78 months in $250M crypto theft case","type":"news_article","url":"https://www.theblock.co/post/400337/california-man-78-months-crypto-theft"},{"credibility":1,"name":"CoinDesk: Police arrest two people related to $243M crypto heist targeting Genesis creditor","type":"news_article","url":"https://www.coindesk.com/business/2024/09/19/police-arrests-two-people-related-to-243m-crypto-heist-targeting-genesis-creditor"},{"credibility":2,"name":"CryptoTimes: GothFerrari Sentenced to 78 Months in Prison Over $250M Crypto Theft Scheme","type":"news_article","url":"https://www.cryptotimes.io/2026/05/07/gothferrari-sentenced-to-78-months-in-prison-over-250m-crypto-theft-scheme/"},{"credibility":2,"name":"Help Net Security: $250 million cryptocurrency heist funded luxury fashion, nightclub parties, and private jets","type":"news_article","url":"https://www.helpnetsecurity.com/2026/05/07/crypto-theft-home-burglary-scheme/"},{"credibility":2,"name":"TRM Labs: DOJ Uses Organized Crime Statute in $263 Million Cryptocurrency Theft, Money Laundering and Home Invasion Conspiracy","type":"research","url":"https://www.trmlabs.com/resources/blog/doj-uses-organized-crime-statute-in-263-million-cryptocurrency-theft-money-laundering-and-home-invasion-conspiracy"},{"credibility":2,"name":"Recorded Future News: Feds charge 12 more suspects in RICO case over crypto crime spree","type":"news_article","url":"https://therecord.media/feds-charge-12-suspects-in-rico-crypto-heist"},{"credibility":2,"name":"AOL/AP: GothFerrari cybercriminal sentenced in $263 million crypto case","type":"news_article","url":"https://www.aol.com/articles/gothferrari-cybercriminal-sentenced-263-million-020726995.html"},{"credibility":2,"name":"Washington Times: GothFerrari gets 6.5 years for role in $250M crypto theft conspiracy","type":"news_article","url":"https://www.washingtontimes.com/news/2026/may/7/gothferrari-gets-65-years-role-250m-crypto-theft-conspiracy/"},{"credibility":2,"name":"Coin Edition: Marlon Ferro Sentenced to 78 Months in $250M Crypto Theft Network Case","type":"news_article","url":"https://coinedition.com/marlon-ferro-sentenced-to-78-months-in-250m-crypto-theft-network-case/"}],"summary":"Marlon Ferro, 20, of Santa Ana, California, known online as 'GothFerrari,' was sentenced on May 6, 2026 to 78 months in federal prison for his role as a physical burglar in a multi-state cryptocurrency theft enterprise that stole over $263 million between October 2023 and March 2025. Ferro pleaded guilty on October 17, 2025 to one count of conspiracy to participate in a racketeer influenced and corrupt organization (RICO) and was ordered to pay $2.5 million in restitution and serve three years of supervised release.","timeline":[{"date":"2023-10-01","event":"The Social Engineering Enterprise (SEE) begins operations, recruiting members through online gaming platforms including Minecraft and Discord.","source":"DOJ USAO-DC press release","source_url":"https://www.justice.gov/usao-dc/pr/gothferrari-sentenced-78-months-prison-role-massive-cryptocurrency-heist"},{"date":"2024-02-01","event":"Ferro travels to Winnsboro, Texas and burglarizes a victim's home, stealing a hardware wallet containing approximately 100 Bitcoin (valued at over $5 million at the time).","source":"DOJ USAO-DC press release / CryptoTimes","source_url":"https://www.cryptotimes.io/2026/05/07/gothferrari-sentenced-to-78-months-in-prison-over-250m-crypto-theft-scheme/"},{"date":"2024-07-01","event":"Ferro travels to New Mexico, surveils a victim's home for several days, then breaks in and burglarizes the property while ringleader Malone Lam remotely tracks the victim's location. Ferro is captured on home surveillance footage.","source":"TRM Labs / DOJ USAO-DC","source_url":"https://www.trmlabs.com/resources/blog/doj-uses-organized-crime-statute-in-263-million-cryptocurrency-theft-money-laundering-and-home-invasion-conspiracy"},{"date":"2024-08-18","event":"The enterprise's largest single theft: ringleader Malone Lam and co-conspirator Jeandiel Serrano execute a social engineering attack on a Genesis bankruptcy creditor in Washington, D.C., stealing over 4,100 Bitcoin (approximately $230 million at the time).","source":"CoinDesk / DOJ USAO-DC","source_url":"https://www.coindesk.com/business/2024/09/19/police-arrests-two-people-related-to-243m-crypto-heist-targeting-genesis-creditor"},{"date":"2024-09-18","event":"On-chain investigator ZachXBT publicly identifies Malone Lam and Jeandiel Serrano. Lam and Serrano are arrested. A federal indictment is unsealed in U.S. District Court for the District of Columbia.","source":"CoinDesk","source_url":"https://www.coindesk.com/business/2024/09/19/police-arrests-two-people-related-to-243m-crypto-heist-targeting-genesis-creditor"},{"date":"2025-05-01","event":"A superseding indictment charges 12 additional defendants, including Marlon Ferro, in connection with the RICO conspiracy. A second set of indictments brings the total number of charged defendants to 14.","source":"DOJ USAO-DC","source_url":"https://www.justice.gov/usao-dc/pr/additional-12-defendants-charged-rico-conspiracy-over-263-million-cryptocurrency-thefts"},{"date":"2025-05-13","event":"Marlon Ferro is arrested. He is found in possession of two firearms and a fraudulent identification document.","source":"CryptoTimes / Coin Edition","source_url":"https://www.cryptotimes.io/2026/05/07/gothferrari-sentenced-to-78-months-in-prison-over-250m-crypto-theft-scheme/"},{"date":"2025-10-17","event":"Ferro pleads guilty to one count of conspiracy to participate in a racketeer influenced and corrupt organization (RICO).","source":"DOJ USAO-DC press release","source_url":"https://www.justice.gov/usao-dc/pr/gothferrari-sentenced-78-months-prison-role-massive-cryptocurrency-heist"},{"date":"2026-05-06","event":"Ferro is sentenced by Judge Colleen Kollar-Kotelly in U.S. District Court for the District of Columbia to 78 months in federal prison, 3 years of supervised release, and $2.5 million in restitution.","source":"DOJ USAO-DC press release","source_url":"https://www.justice.gov/usao-dc/pr/gothferrari-sentenced-78-months-prison-role-massive-cryptocurrency-heist"}]},"v":1}