WASHINGTON, D.C. – A federal grand jury has returned a four-count superseding indictment charging 12 additional individuals, including U.S. citizens and foreign nationals, for their alleged roles in a cyber-enabled racketeering enterprise responsible for stealing over $263 million in cryptocurrency.
The charges, unsealed today in U.S. District Court for the District of Columbia, expand upon an earlier indictment against Malone Lam, originally filed in September 2024. Several defendants were arrested this week in California, while two remain at large, believed to be residing in Dubai.
The announcement was made by U.S. Attorney Jeanine Ferris Pirro, FBI Special Agent in Charge Sean Ryan, and IRS-Criminal Investigation Executive Special Agent in Charge Kareem A. Carter.
Alleged International Criminal Network
According to the indictment, the criminal conspiracy operated from at least October 2023 to March 2025, originating from connections built on online gaming platforms. The enterprise included individuals serving in roles such as:
- Hackers – obtained or purchased stolen data from dark web sources
- Organizers & Target Identifiers – compiled databases and identified high-value targets
- Callers – used social engineering to impersonate cybersecurity staff
- Money Launderers – converted stolen crypto into cash or assets
- Burglars – conducted physical break-ins to steal hardware crypto wallets
One of the most significant thefts involved the fraudulent acquisition of over 4,100 Bitcoin (worth $230 million at the time) from a victim in Washington, D.C., in August 2024. Another incident in July 2024 involved the theft of $14 million in cryptocurrency.
In some cases, enterprise members allegedly tracked victims’ locations and broke into homes to steal cryptocurrency hardware wallets. In one instance, Marlon Ferro is accused of traveling to New Mexico to commit such a burglary, while Lam monitored the victim’s movements via their iCloud account.
Lavish Spending and Concealment Efforts
Prosecutors allege the group used stolen funds to finance extravagant lifestyles, including:
- $4 million spent at nightclubs, sometimes exceeding $500,000 per evening
- $9 million on exotic cars, including vehicles worth up to $3.8 million
- Luxury goods: watches, handbags, and clothing worth hundreds of thousands
- Private jets, rental properties in Los Angeles, Miami, and the Hamptons
- Private security teams and bulk cash shipments disguised in children’s toys
Members used sophisticated laundering techniques involving crypto mixers, “peel chains”, VPNs, pass-through wallets, and shell companies to hide the origin of funds and assets.
The indictment also details how Kunal Mehta, Hamza Doost, Joel Cortez, and Evan Tangeman played key roles in laundering funds, securing fake IDs for rental properties, and transporting illegal proceeds.
Despite being in pretrial detention, Lam allegedly continued directing criminal activities, including the delivery of luxury items—such as Hermès Birkin bags—to his girlfriend in Miami.
Ongoing Investigation and Legal Proceedings
This case is part of an ongoing investigation led by the U.S. Attorney’s Office for the District of Columbia, the FBI’s Washington Field Office, and the IRS-Criminal Investigation D.C. Field Office, with support from FBI Los Angeles and Miami.
The case is being prosecuted by Assistant U.S. Attorney Kevin Rosenberg, Acting Deputy Chief of the Fraud, Public Corruption, and Civil Rights Section.
If convicted, each defendant faces potential penalties determined by the court in accordance with federal sentencing guidelines.
An indictment is merely a formal allegation. All defendants are presumed innocent unless and until proven guilty in a court of law.
