22-Year-Old Malone Lam Pleads Guilty to $245 Million Bitcoin Theft

A 22-year-old man has pleaded guilty to his role in one of the largest cryptocurrency thefts in U.S. history after more than $245 million worth of Bitcoin was stolen from a Washington, D.C., resident.

Malone Lam, a Singaporean who had dropped out of school, pleaded guilty to a federal racketeering conspiracy charge in Washington, D.C. He was accused of helping organize a network that targeted cryptocurrency holders through sophisticated social-engineering schemes.

According to prosecutors, Lam and his associates targeted the victim in August 2024 by impersonating representatives of Google and the cryptocurrency exchange Gemini.

Through the scheme, they manipulated the victim into providing access to a Google Drive account and revealing security information. This allowed the group to gain access to more than 4,100 Bitcoin, which at the time was worth over $245 million.

The stolen cryptocurrency was then moved through various transactions and converted in an effort to conceal its origins. But instead of keeping a low profile, Lam and other members of the group embarked on an extravagant spending spree.

Authorities say the stolen money was used to finance a lavish lifestyle that included more than 30 luxury cars, expensive watches, private jets, mansions and extravagant nightclub spending.

Lam reportedly spent hundreds of thousands of dollars at nightclubs, including approximately $569,000 in a single evening at a Los Angeles club. He also purchased high-end vehicles including Ferraris, Lamborghinis and Porsches.

The spending spree lasted roughly a month before investigators closed in. Lam was arrested by FBI agents in Miami in September 2024 after authorities traced activity connected to the operation.

Lam is one of 18 people charged in the wider case and the 11th defendant to plead guilty, according to prosecutors. His guilty plea represents a major development in the investigation into the cryptocurrency theft network.

He faces a maximum sentence of 20 years in federal prison. A sentencing date has not yet been set by U.S. District Judge Colleen Kollar-Kotelly.

The case highlights how criminals are increasingly using social engineering rather than traditional hacking techniques to gain access to cryptocurrency accounts — exploiting people and security procedures to obtain credentials and digital assets.