This Justice Department court filing in the case against Hamza Doost and Kunal Mehta, that includes a photo of Malone Lam, is photographed Friday, Sept. 4, 2026. (AP Photo/Jon Elswick)
Copyright 2026 The Associated Press. All rights reserved.
Twenty-two-year-old Malone Lam of Singapore recently pleaded guilty to a RICO conspiracy charge in Federal District Court in Washington DC related to his masterminding of a sophisticated cryptocurrency theft ring. Lam used the colorful aliases Anne Hathaway, King Greavy and $$$. In addition, at one of his initial hearings Judge Alicia O. Valle referred to him as the 1986 fictional movie character Ferris Bueller when she commented in court, “As I was listening to the evidence, I could only think of Ferris Bueller gone bad.”
Lam was initially arrested in September 2024 following one of the largest cryptocurrency robberies in history. Between 2023 and 2025 Lam and his associates stole and then laundered cryptocurrencies valued at more than $245 million. Lam is the 11th criminal to have been convicted in this case. Seven more defendants remain charged. In prosecuting this crime ring, the Justice Department chose to tie the individual thefts, money laundering and other crimes into a RICO criminal enterprise conspiracy.
Table of Contents
INDIVIDUAL RESPONSIBILITIES OF THE GANG MEMBERS
Lam and the other members of his gang most of whom were 18-, 19- and 20-year-olds, located in California, Connecticut, New York, Florida and overseas met on online gaming platforms. The gang quickly developed specific responsibilities for its members. Some were database hackers who hacked websites and servers to get cryptocurrency-related databases to identify their targeted victims. In other instances, they purchased relevant databases from the Dark Web, that part of the Internet where cybercriminals buy and sell goods and services. They also would identify future victims through social media and crypto community forums. Other members of the conspiracy would then organize and collate the information to determine who would be the best targets. Once they had identified their targeted victims, other coconspirators would call the victims posing as security specialists and using social engineering, which is merely a current term for psychology, to manipulate their victims into providing their passwords, private keys and seed phrases that enabled the gang to gain access to and empty their victims’ cryptocurrency wallets. Once the accounts had been emptied it became the job of other members of the gang to launder the stolen cryptocurrencies to avoid being tied to the thefts.
BURGLARY
While most of the thefts were done digitally in one instance, Marlon Ferro, one of the gang members burglarized the home of one of their victims to steal the portable hard drive containing the victim’s cryptocurrency wallet. In May of 2026 Ferro was sentenced to 78 months in prison for his role in the criminal enterprise.
MONEY LAUNDERING
The money laundering portion of the crime was infinitely more complicated than the actual thefts. Among the primary methods used by the gang to launder their stolen cryptocurrencies were mixers, exchanges, peel chains, pass-through wallets and VPNs. Mixers pool cryptocurrency funds from many accounts and redistribute them in a manner that makes blockchain tracing of specific funds difficult. They also would move their stolen cryptocurrencies in differing amounts through multiple cryptocurrency exchanges to disguise the stolen funds. Often the gang would use peel chains which is where the funds are put through a series of transactions into different cryptocurrency wallets with a small portion peeled off at each stop to further make the tracing of the stolen funds difficult. Stolen cryptocurrencies were also moved through numerous temporary pass-through wallets to move the stolen funds through multiple layers before being converted to cash. In doing these money laundering transactions the gang used virtual private networks (VPNs) to hide their actual IP addresses and geographic locations to further hide their connections to the stolen cryptocurrencies.
Money laundering also included the purchase of exotic cars worth millions of dollars bought using the names of shell companies created by the gang members. Stolen cryptocurrencies were also converted to cash and shipped in bulk stuffed in Squishmallows a brand of soft, plush stuffed animals often purchased as collectibles.
BEGINNING OF THE END
The crowning achievement of the gang’s efforts occurred in August of 2024 when they managed to steal Bitcoin valued at more than $240 million from a single victim after convincing him that they were support agents of the legitimate Gemini crypto exchange.
Ultimately, this huge theft led to the downfall of the entire scheme because following the theft Lam and his co-conspirators launched a month of extravagant spending that included trips on private jets, purchases of expensive automobiles including a fleet of expensive 28 expensive cars, diamond jewelry and luxury watches. All of this spending attracted the attention of law enforcement which soon led to the arrest in September of 2024 of Lam and two other conspirators. The FBI tracks cryptocurrency transfers through blockchain analysis and when stolen funds are converted to expensive, luxury purchases can often connect the funds to specific criminals.
Following his arrest in 2024 and while in pretrial detention Lam continued to direct the continuing efforts of his gang. Funds stolen at that time were even used to pay for Lam’s attorneys. But now Lam stands convicted and is awaiting sentence. Perhaps he can sell the movie rights to his story although Matthew Broderick is too old to play Lam.
