← News·Markets · Digital AssetsMarkets

Malone Lam faces plea hearing in $240 million Bitcoin theft case

A plea agreement hearing for Malone Lam, the 22-year-old Singapore national federal prosecutors have named as a suspected ringleader of the theft of more than 4,100 $BTC, then valued at over $240 million, from a single…

NM
NewsMV Markets Desk
3 min read
7 September 2026Markets desk
Share this dispatch

Key takeaways

  • A plea agreement hearing for Malone Lam, a 22-year-old Singapore national named by prosecutors as a suspected ringleader in the theft of more than 4,100 Bitcoin (then valued at over $240 million), is scheduled for Tuesday in federal court in Washington, D.C.
  • The August 2024 theft was carried out by posing as Google and Gemini exchange representatives to trick a single longtime investor into sharing Google Drive access and security codes, allowing the group to drain the funds in one operation.
  • The group's rapid spending drew investigators, with Lam and associates running up $4 million at Los Angeles nightclubs in about a month, including $569,000 in a single night, plus a $2 million watch and more than 30 vehicles.
  • Eighteen defendants have been charged and ten have already pleaded guilty, with co-conspirator Jeandiel Serrano and Lam both arrested on September 18, 2024.
  • A prosecutor said federal sentencing guidelines could call for at least 14 years in prison if Lam is convicted.

A plea agreement hearing for Malone Lam, the 22-year-old Singapore national federal prosecutors have named as a suspected ringleader of the theft of more than 4,100 $BTC, then valued at over $240 million, from a single victim, is scheduled for Tuesday in federal court in Washington, D.C. Prosecutors say the case ranks among the largest cryptocurrency thefts in U.S. history. The attack was carried out in August 2024.

How the stolen Bitcoin was taken

Lam, an eighth-grade dropout, and alleged co-conspirators described by prosecutors as young men in their late teens and early 20s, reached out to the victim posing as representatives of Google and the Gemini cryptocurrency exchange. They told him his accounts had been compromised, then persuaded him to share Google Drive access and hand over security codes. That access, according to prosecutors, let the group drain more than 4,100 Bitcoin from a single longtime cryptocurrency investor in one operation. The stolen cryptocurrency was then routed through multiple exchange platforms, and money laundering specialists were used to convert portions into cash.

The spending trail that surfaced the group

Prosecutors allege the group spent at a pace that drew investigators before the money could be fully obscured. Lam and associates ran up $4 million at Los Angeles nightclubs over roughly a month. In a single night, Lam allegedly spent $569,000. He also allegedly bought a $2 million watch and more than 30 vehicles, among them custom Porsches, Lamborghinis, and Ferraris. The group rented multimillion-dollar homes, flew private, and hired private security.

Alleged co-conspirator Jeandiel Serrano failed to conceal his IP address while opening an account on a cryptocurrency exchange holding nearly $30 million in stolen funds. Investigators traced the address to a home in Encino, California, where Serrano was paying $47,500 a month in rent. Serrano was arrested September 18, 2024, at Los Angeles International Airport, wearing a watch valued at roughly $500,000. Lam was taken the same day at a Miami mansion.

Eighteen defendants have been charged. Ten have already pleaded guilty. At Lam's initial court appearance in Miami, a prosecutor told the court that federal sentencing guidelines could call for at least 14 years in prison if Lam is convicted. U.S. Magistrate Judge Alicia Valle, presiding at that hearing, offered her own characterization after the spending was described: "I could only think of Ferris Bueller gone bad."

Tuesday's federal court hearing in Washington is what to watch.

Related reading

Tickers$BTC
Categorycrypto

Filed via foxnews.com

Keep reading

More from the markets desk

Frequently asked

How did the thieves gain access to the victim's Bitcoin?

They posed as representatives of Google and the Gemini cryptocurrency exchange, told the victim his accounts had been compromised, and persuaded him to share Google Drive access and hand over security codes.

How was the group ultimately traced by investigators?

Co-conspirator Jeandiel Serrano failed to conceal his IP address while opening an exchange account holding nearly $30 million in stolen funds, which investigators traced to a home in Encino, California; the group's fast spending also drew attention.

How much Bitcoin was stolen and how valuable was it?

More than 4,100 Bitcoin was stolen from a single victim, valued at over $240 million at the time, ranking among the largest cryptocurrency thefts in U.S. history.

When and where were Lam and Serrano arrested?

Both were arrested on September 18, 2024, with Serrano taken at Los Angeles International Airport wearing a roughly $500,000 watch and Lam taken at a Miami mansion.

What potential prison sentence does Lam face?

A prosecutor told the court that federal sentencing guidelines could call for at least 14 years in prison if Lam is convicted.