Malone Lam, a 22-year-old Singaporean national living in Miami, pleaded guilty to participating in a RICO conspiracy that netted over $245 million in stolen Bitcoin. The plea, entered in a US District Court in Washington, D.C., marks the first time federal prosecutors have applied racketeering laws to a Bitcoin-related crime.
The scheme ran from October 2023 to May 2025 and involved the theft of more than 4,100 BTC. One individual victim alone lost 4,100 BTC in a single incident in August 2024, making it one of the largest single-victim crypto heists ever recorded.
Private jets, exotic cars, and $500K nightclub tabs
Lam’s spending spree included exotic cars priced up to $3.8 million each, private jet charters, and nightclub tabs that reportedly reached $500,000 in a single evening.
The operation wasn’t a solo act. At least 12 co-defendants have been identified across multiple US states and international locations.
Lam and his associates used social engineering tactics and residential break-ins to access victims’ crypto holdings. The playbook relied heavily on impersonation, deceiving targets into revealing sensitive information or granting access to their wallets and exchange accounts.
He was arrested on September 18, 2025, at a rental home in Miami. The court has ordered restitution of approximately $245 million to address losses suffered by the victims. A status hearing is scheduled for December 8, 2026, and Lam faces a maximum sentence of 20 years in federal prison.
RICO meets crypto for the first time
The Department of Justice’s decision to bring RICO charges in a cryptocurrency case is a significant legal milestone. RICO charges carry heavier penalties and allow prosecutors to target entire criminal enterprises rather than picking off individual actors one at a time. The statute also enables broader asset seizure and restitution orders, which is exactly what happened here.
For years, crypto-related prosecutions have typically relied on wire fraud, money laundering, or computer fraud statutes. The DOJ’s willingness to reach for RICO suggests a new enforcement posture.
Lam’s operation relied on impersonating trusted entities to trick victims into handing over access. The indictment originated in September 2024, following a theft where Lam and his co-conspirators impersonated tech support and sent counterfeit notifications about unauthorized access attempts, using remote desktop tools to gather sensitive credentials and drain funds in multiple transactions.
What this means for crypto security and regulation
The restitution order of approximately $245 million raises practical questions. Given that Lam spent lavishly on depreciating assets like luxury cars and fleeting experiences like nightclub appearances, the actual recovery rate for victims could fall well short of the ordered amount.
The involvement of 12 co-defendants across multiple jurisdictions illustrates the scale of coordination involved in Lam’s network, spanning states and countries.