Accused $245 Million Bitcoin Thief Set to Plead Guilty in Washington

WASHINGTON — One of the largest single-victim bitcoin thefts on record was not a hack of the blockchain. It was a phone call. On Tuesday, Malone Lam, a 22-year-old Singaporean national whom prosecutors describe as an organizer of the crew behind it, is due in federal court here for a plea-agreement hearing.

The victim, named in court filings only as Victim-7, was at home when callers claiming to be from Google and the exchange Gemini warned that his accounts were under attack. They talked him into installing remote-desktop software and surrendering his security codes. Then they moved more than $245 million in bitcoin out of his wallets.

An enterprise, not a lone hacker

The indictment charges 18 people as a racketeering group it calls the Social Engineering Enterprise, with a division of labor that reads like an org chart: database hackers who assembled lists of likely crypto holders, callers who ran the scripts, and launderers who broke the coins across a web of wallets, exchanges and shell purchases.

The group grew out of friendships formed in online gaming, prosecutors say, and worked from stolen databases to pick targets. When a mark was known to keep coins on a hardware wallet — the offline device that makes remote theft nearly impossible — members allegedly flew to the person’s house and broke in.

Ten of the eighteen defendants have already entered guilty pleas to conspiracy and racketeering. Lam’s hearing suggests he may become the eleventh.

The spree that unraveled it

What drew investigators was not on-chain wizardry but conspicuous spending. The proceeds funded a run of exotic cars, private-jet travel and six-figure nights out that left a paper trail far easier to follow than the coins themselves. The blockchain hid the money; the Lamborghinis did not.

The lesson self-custody can’t teach

For bitcoiners the case is a hard reminder about the limits of the movement’s central creed. “Not your keys, not your coins” is true, and Victim-7’s loss began the moment he surrendered control of his. But the flip side is that holding your own keys moves the attack from the exchange to you. Self-custody defeats the remote hack. It does not defeat a convincing phone call, and it does not defeat a stranger at the door.

Self-custody protects the keys. It does not protect the person holding them.

The defenses are unglamorous and old: never install software a caller asks you to, never read a code aloud, treat any “support” that contacts you first as a fraud, and keep the size of your holdings off the internet. For a large holder the threat model is no longer only cryptographic. It is social, and increasingly physical.

Why it matters: as more wealth moves into bitcoin, the weakest link is not the code — it is the human being who can be called, fooled or found.

Charges are allegations; a plea hearing is not a conviction. Figures and case details per court filings and reporting as of September 8, 2026. Informational only — not financial advice.