4,100 BTC Stolen in $245M US Heist: 11th Guilty Plea

For bitcoin holders and Web3 users, this case is a warning about self-custody risk beyond private keys. The victim did not lose bitcoin through an exchange breach or smart-contract exploit; he was socially engineered into disclosing Google Drive access and security codes after callers posed as Google and Gemini. The $245 million theft and 11th guilty plea highlight how targeted social engineering against large individual holders remains a more direct threat than many protocol-level vulnerabilities.

Malone Lam, a 22-year-old eighth-grade dropout who moved to the US from Singapore, pleaded guilty on September 8, 2026, to a federal racketeering conspiracy charge for organizing a network that stole more than $245 million in bitcoin from a single Washington, DC resident. US District Judge Colleen Kollar-Kotelly accepted the plea but did not immediately schedule sentencing. Lam faces a statutory maximum of 20 years in prison and is the 11th of 18 defendants charged in the case to admit guilt. The plea marks a major breakthrough for the Department of Justice, which has spent more than two years unraveling what prosecutors describe as a string of crypto scams that began in 2023 and escalated into one of the largest cryptocurrency thefts in American history.

“

That access allowed Lam to siphon off more than 4,100 bitcoin, then worth more than $245 million.

The underlying crime was not a protocol-level or exchange breach, but a targeted social engineering operation. In August 2024, two of Lam's alleged co-conspirators posed as representatives of Google and the Gemini crypto exchange to manipulate the Washington man into granting access to his Google Drive and revealing security codes. That access allowed Lam to siphon off more than 4,100 bitcoin, then worth more than $245 million. The choice to impersonate trusted technology and exchange brands is significant because it highlights the human element as the critical vulnerability in even sophisticated cryptocurrency security. The victim's private keys or wallet may never have been directly compromised; instead, attackers obtained enough account and identity material to move funds through trusted entry points.

The laundering phase is equally important to financial and law-enforcement audiences. Lam allegedly converted stolen crypto into cash and then spent it on a month-long spree that included more than 30 cars, custom Porsches, a $2 million watch, rented mansions in Miami, and millions of dollars at nightclubs. Authorities said $569,000 was spent in a single evening at a Los Angeles club. An off-duty law enforcement officer tipped Lam off that authorities were on their way to arrest him, according to the indictment, adding an insider-corruption element to an already sprawling case. FBI agents ultimately arrested Lam in Miami after the roughly month-long spree. From jail, Lam was recorded saying, 'We always talked about what it would be like if I were to go down, but never thought it would be this crazy,' a line that prosecutors used to underscore the group's awareness of the seriousness of their conduct.

Legal observers should note the Justice Department's use of racketeering conspiracy rather than a narrow computer fraud or theft count. The racketeering statute allows prosecutors to aggregate conduct across multiple victims, schemes, and co-conspirators, and it carries a 20-year maximum. The fact that 11 of 18 defendants have now pleaded guilty suggests that the evidence and cooperation dynamics are strongly in the government's favor. Each additional guilty plea narrows the field of remaining defendants and can produce testimony against organized leaders. Lam's role as an organizer makes his plea particularly valuable: it establishes the scheme's structure and intent, which may be used to resolve the remaining cases or proceed to trial against holdouts.