12 more individuals have been charged in a RICO crypto theft case that allegedly netted over $263 million.
A four-count superseding indictment unsealed this week in the U.S. District Court have added twelve new defendants to the RICO (Racketeer Influenced and Corrupt Organizations) case, expanding charges against ringleader Malone Lam and others involved in the cyber-enabled criminal ring that operated across U.S. and internationally from October 2023 through March 2025.
The indictment charges the group with RICO conspiracy, wire fraud, money laundering, and obstruction of justice. Several suspects were arrested this week in California, while two remain at large and are believed to be in Dubai.
According to the indictment, the enterprise grew out friendships formed on online gaming platforms and evolved into a coordinated network of hackers, organizers, social engineers, burglars, and money launderers.
The group allegedly targeted victims by purchasing stolen databases to identify owners of large crypto holdings. They then used social engineering tactics, including cold calls pretending to be from cybersecurity teams, to trick victims into disclosing sensitive access information. Once they had control, members stole victims’ crypto, often transferring it through crypto mixers, peel chains, and VPNs to obscure their tracks. In some cases, they even physically burglarized victims’ homes to steal hardware crypto wallets.
The group allegedly used their illicit proceeds to fund a lavish lifestyle that included nightclub services costing up to $500K per evening, luxury handbags and watches valued in the hundreds of thousands, designer clothing, private jet charters, bodyguards, and a fleet of at least 28 exotic cars worth between $100K and $3.8 million. They also rented luxury homes in Los Angeles, Miami, and the Hamptons.
Malone Lam, arrested in September last year, was at the center of the operation. In one incident, he allegedly contacted a victim in Washington, D.C., posing as a cybersecurity expert and manipulated them into granting access to their digital wallet. He then drained over 4,100 Bitcoin (BTC) from their wallet—valued at more than $230 million at the time—accounting for the vast majority of the group’s $263 million total haul.
Even after his arrest and while in pretrial detention, Lam is accused of continuing to run the operation from jail. On one occasion, he hacked into a victim’s iCloud account to track their location, while Marlon Ferro, one of the ring’s members, broke into the victim’s home to steal their hardware crypto wallet.
Other key figures include Kunal Mehta, Hamza Doost, Joel Cortez, and Evan Tangeman, who were charged with laundering the stolen crypto and other offences.
