Invest1 publisher3 min readPublished
Malone Lam's plea hearing closes a case that started with a phone call and unravelled over a nightclub tab, at a moment when FBI crypto fraud complaints have risen nearly 50% and the DOJ's crypto unit is gone.
The Investor · Invest desk

Compiled by The InvestorSomething wrong?How this is made
Divide the 4,100-plus bitcoin prosecutors say left the Washington investor's wallet on 18 August 2024 into the $240mn-plus they say it was worth [1][2], and the implied price is roughly $58,500 a coin [1]; the loss was denominated in coins, the indictment in dollars, and those two figures separate further with every subsequent print.
The public account shows the crew tripped up by their own errors, not forensics. Serrano opened an exchange account to hold nearly $30mn of the proceeds, about an eighth of the take [7][4], and did it without masking his IP address, which investigators matched to the Encino house he was renting for $47,500 a month [7][8]. Annualise that rent and you get $570,000 [2], within about a thousand dollars of what Lam is said to have spent in one evening at a Los Angeles nightclub, $569,000 [5], itself roughly 14% of the $4mn authorities say the group ran through LA clubs in a month [6][3].
The enforcement backdrop is harder to price. Fortune reports that FBI complaints of crypto investment fraud rose by nearly 50% in 2025 while the Justice Department disbanded its dedicated crypto-crime unit the year before [9][10]; for scale on the industry's political economy, the same account puts Trump's crypto businesses at roughly $1.2bn of income in 2025, which makes this single theft about a fifth of that [11][5].
Two readings sit on that. The first is that capacity fell as volume rose, so clearance rates follow. The second, or rather the more testable version, is that complaint counts move with price and with willingness to report, and that the same department charged Lam and 17 others [4] and has a plea agreement hearing on the calendar for Tuesday [3]. Fortune gives no prosecution counts and no figure for how much of the 4,100 bitcoin was recovered, so a thinner-recourse verdict rests on one disbanded unit rather than on a measured decline.
What the record does support is narrower and less comfortable. The entry point was a caller claiming to be a Google representative and a second claiming to be from Gemini, who talked the victim into handing over Google Drive access and security codes [2]; he was picked because he was known as a wealthy, longtime holder [17]; and the proceeds went through laundering specialists and multiple exchanges into cash [15]. Allison Nixon, who has spent years tracking The Com, told Fortune that "if we don't seriously ramp up the resources to take these people down and do it faster, then it's going to spread more and more" [12]. A week after the score, masked men from Miami cut off Chetal's parents in Danbury, Connecticut, beat his father with a baseball bat and bound them in a van [13], showing that family members remain exposed to physical risk regardless of how coins are secured.
On this evidence, the enforcement input a large holder can count on is the thief's own spending.
Ranked by verification strength, evidence, and original report placement.
The scheme duped a stranger out of bitcoin worth over $240 million, described as one of the largest cryptocurrency thefts in U.S. history.
A man identified as "Victim 7" in court filings was at home in Washington on Aug. 18, 2024, when a first caller identified himself as a Google representative and a second claimed to be from the Gemini crypto exchange; prosecutors say the callers manipulated him into giving access to his Google Drive and revealing security codes that allowed Malone Lam to siphon off over 4,100 bitcoin.
Lam, a 22-year-old alleged ringleader and an eighth-grade dropout from Singapore, has a plea agreement hearing set for Tuesday; his conviction would be a capstone for the government's investigation.
Charges were brought against Lam and 17 others.
Lam spent over $569,000 in one evening at a Los Angeles night club.
Authorities say Lam and friends spent $4 million at Los Angeles nightclubs in one month.
Publishers with included, body-backed reporting in this cluster.
Follow any of these and your For You feed starts watching them — no settings page required.
security
77 years, stacked: the 764 sentence that resets what a sextortion report is worth1 publisher
invest
Washington licenses private hacking, and hands the contractor the liability1 publisher
leadership
US-UK sign joint pact to coordinate prosecution of scam-center networks1 publisher
product
White House lets vetted firms hack back and leaves liability blank for 60 days1 publisher
Evidence-backed comparisons of source perspectives and observed adoption signals. Read the methodology
Which Builder, Operator, and Investor concerns the observed source mix emphasized—not a truth score.
Evidence, demonstrated adoption, hype gap, incentives, and confidence are assessed independently, each on its own current evidence. How these are measured.
Everything routes through the prosecutors
The specifics are unusually hard for a crime story: a dated phone call, an IP address traced to a named suburb, a monthly rent, a prosecutor quoted on the record at a co-defendant's sentencing, a researcher quoted by name. They all arrive by one channel, though — investigators' filings and the FBI, relayed by a single outlet. Chetal's cooperation and Serrano's admission corroborate parts from inside the group; the $240 million headline number has no independent check and no stated valuation behind it.
Arrests and seizures already on the record
These are completed events, not allegations floating free of dates. Money moved on 18 August 2024, agents searched Chetal's apartment on 9 September and recovered $37 million, Lam and Serrano were arrested on 18 September, and 18 people now face charges. What has not happened is the disposition: Lam's plea hearing was still ahead at publication, so the conviction Fortune calls a capstone remains a scheduled event.
The headline outruns the copy
"The first Bitcoin RICO case" and the charge that the Justice Department gutted its ability to build it both live above the story; inside it, no racketeering count is named and no line connects the closed crypto unit to this prosecution's staffing or speed. The theft figures are handled more soberly than the framing around them, and the operational detail that actually matters — an unmasked IP address at signup — is treated as colour rather than as the finding it is.
Sourced to the people prosecuting it
The vivid material reaches readers via investigators who gain from a large and lurid case: the $569,000 night out, cash stuffed in a laundry machine, and word of the tip-off that came before the arrest. It lands while a plea is being negotiated. Fortune adds a second pull of its own: the $1.2 billion crypto-income figure and the abandoned crackdown belong to an argument about enforcement policy, not to the facts of the theft, and no defence voice balances either.
Firmer on the heist than on the frame
The mechanics and the arrests would survive challenge: dated, attributed, and partly admitted by participants. What weakens is everything above the facts of the theft — a single publisher, one sourcing channel, a plea not yet entered, and a racketeering characterisation that the reporting under it does not carry.