If you are a budding cybercriminal, here is a piece of free advice that could save you a world of trouble: when you steal a quarter of a billion dollars in cryptocurrency, do not immediately blast photos of your new Lamborghini across a group chat. Do not drop half a million dollars on a single night at a nightclub. And certainly do not rent a fleet of private jets and a team of security guards before you have even laundered the money. Malone Lam, a 22-year-old Singaporean, learned this lesson the hard way after he pleaded guilty to masterminding a racketeering enterprise that stole more than US $245 million in cryptocurrency from victims across the United States. His spectacular fall from a life of supercar dealerships and champagne-fueled parties to a federal prison cell is a textbook case of how not to run a criminal operation — and a stark warning for anyone who thinks digital crime is invisible.
The Ringleader Who Couldn’t Keep a Secret: Malone Lam’s Stolen Millions
Malone Lam, who used online aliases including “Anne Hathaway,” “$$$,” and “King Greavy,” operated his criminal enterprise from October 2023 until May 2025. He recruited accomplices through online gaming platforms, building a network that functioned like a well-oiled — albeit immensely reckless — corporate hierarchy. The group included database hackers who identified potential victims, callers who posed as customer support agents, money launderers who shuffled the stolen funds, and even physical burglars who broke into homes to steal hardware cryptocurrency wallets. One of those charged in a related indictment in May 2025 was memorably found to have stuffed approximately US $25,000 in cash inside Squishmallow plush toys to move the money around. It was a bizarre detail in a case already overflowing with excess and poor judgment.
The Mechanics of the Heist: Social Engineering, Not High-Tech Hacking
At the core of Lam’s success was not a sophisticated exploit of blockchain vulnerabilities or a clever smart-contract attack. It was old-fashioned social engineering, executed with chilling precision. Lam and his crew would impersonate Google Support representatives, contacting victims and convincing them that their accounts had been compromised. Using spoofed phone numbers and persuasive scripts, they would talk targets into sharing their screens, providing two-factor authentication codes, or even transferring funds to supposedly secure wallets controlled by the criminals. The method was simple, yet devastatingly effective. In one instance, Lam tricked a single victim out of US $230 million worth of Bitcoin — a heist that led to his arrest in October 2024. That arrest, however, did not immediately shut down the entire network. The Department of Justice later charged additional members in May 2025, revealing that the conspiracy continued to operate even after its leader was in custody.
How Did Malone Lam Steal $245 Million in Cryptocurrency?
Malone Lam stole $245 million by leading a racketeering enterprise that used social engineering tactics — primarily fake tech support calls from individuals impersonating Google Support — to trick victims into revealing sensitive login credentials, sharing screens, or transferring cryptocurrency to wallets controlled by the gang. He recruited accomplices through online gaming platforms, assigning them roles such as target identification, phone calls, money laundering, and physical theft of hardware wallets. The operation ran from October 2023 to May 2025, targeting victims across the United States.
The Spending Spree That Became a Confession
What makes the Lam case especially striking is not the scale of the theft — though $245 million is certainly staggering — but the breathtaking conspicuousness of the spending that followed. Lam and his associates ran up nightclub tabs of half a million dollars per evening. They purchased luxury cars worth up to $3.8 million each, including multiple Lamborghinis. They rented mansions in Los Angeles, the Hamptons, and Miami. They hired private jets and a team of private security guards. For a young man barely out of his teens, such opulence attracted precisely the kind of attention that a cooler-thinking criminal would have worked hard to avoid. Law enforcement investigators, naturally, took notice. The group chat messages in which Lam bragged about his purchases became key evidence in the case. It is a cautionary tale in operational security: if you steal $245 million, the world’s most sophisticated blockchain tracing tools are not the only things you need to worry about. Your own Instagram account can be just as dangerous.
A Conspirator Sentenced: Evan Tangeman’s Five-Year Term
Fellow conspirator Evan Tangeman, also 22, was sentenced in April 2026 to more than five years in prison for laundering stolen funds. Tangeman’s role in the operation involved converting cryptocurrency into cash and other assets, often through complex layering techniques designed to obscure the origin of the money. But even his efforts could not hide the trail of luxury cars and high-end real estate. Other members of the gang are still working their way through the courts, and the full extent of the conspiracy may take years to unravel. For Lam, the party is definitively over. He faces up to 20 years in prison when he is eventually sentenced.
The Bigger Picture: Why Social Engineering Remains the Greatest Threat to Crypto Holders
The Lam case underscores a truth that the cryptocurrency industry has known for years but never quite managed to adequately address: the easiest way to separate a crypto holder from their fortune is not to hack the blockchain, but to hack the human. Fake tech support calls, spoofed numbers, and screen-sharing requests have become the standard toolkit for a new generation of cybercriminals who find it far simpler to talk a victim out of their private keys than to break the cryptography itself. The rise of decentralized finance and the growing value of individual wallets has made social engineering the most efficient attack vector in the digital asset space. For every victim who loses their crypto to a sophisticated smart-contract exploit, dozens more lose it to a convincing phone call.
What Can Crypto Holders Learn from the Lam Case?
If you hold a significant amount of cryptocurrency — whether for investment, trading, or legitimate use — the lessons from this case are straightforward. Never share your screen during a support call from an unsolicited contact. Never provide a two-factor authentication code to anyone who calls you, no matter how official they sound. Use a hardware cold wallet for long-term storage, keeping the bulk of your assets offline and disconnected from the internet. And be deeply suspicious of any urgent request to move funds, especially one that comes with a sense of panic or a threat of account closure. The best defense against social engineering is not technology; it is skepticism. The criminals who stole $245 million from Lam’s victims did not break the laws of mathematics. They broke the law of common sense — and they found victims who did the same.
The End of a Crime Spree — And a New Era of Scrutiny for Crypto
The Lam case is also likely to accelerate the regulatory and law enforcement focus on cryptocurrency-related crime. The Department of Justice has demonstrated that it can and will pursue complex, multi-jurisdictional investigations into crypto theft, even when the perpetrators hide behind online aliases and operate across borders. The involvement of physical burglaries, stuffed-animal cash concealments, and extravagant spending has made this case particularly media-friendly, but it also sends a message: the era of anonymity in crypto crime is fading. Blockchain tracing, cooperation between international law enforcement agencies, and old-fashioned detective work are making it harder for criminals to enjoy their spoils without leaving a trail. For honest investors, this growing scrutiny is ultimately good news: it signals that the ecosystem is maturing and that the wild west days are drawing to a close.
The story of Malone Lam is, at its core, a story of human frailty — the greed that drives a person to steal, the vanity that makes him flaunt his ill-gotten gains, and the hubris that convinces him he will never get caught. It is also a story of resilience: the victims who lost their life savings to a well-spoken con artist, the investigators who pieced together a sprawling conspiracy from a few group chat messages, and the justice system that is slowly but surely bringing the perpetrators to account. For anyone lucky enough to own a large amount of cryptocurrency, the most important takeaway is this: your security is not in the strength of the blockchain, but in the strength of your own judgment. No hardware wallet, no matter how cold, can protect you if you give away your keys over the phone. And no nightclub tab, no matter how extravagant, can buy you freedom once the authorities have your number.
