Malone Lam, a 22-year-old Singaporean who recently settled in Miami, has pleaded guilty to his involvement in a cryptocurrency conspiracy that allegedly stole and laundered more than $245 million in Bitcoin and other digital assets.

Lam admitted to one count of RICO conspiracy in federal court in Washington, D.C., and faces a potential maximum sentence of 20 years. U.S. District Judge Colleen Kollar-Kotelly presided over the proceedings.

The prosecution focuses on an August 2024 attack in which more than 4,100 BTC was taken from a victim in the Washington region. Investigators say the criminals did not exploit a weakness in Bitcoin’s blockchain or use sophisticated methods to defeat its cryptographic protections.

Instead, the alleged theft relied on social engineering.

Prosecutors say two suspected accomplices impersonated representatives of Google and Gemini. By posing as trusted service providers, they allegedly persuaded the victim to provide access to a Google Drive account and disclose security codes. The information was then allegedly used to gain access to the victim’s cryptocurrency and transfer the Bitcoin.

The case demonstrates that the attackers did not need to break into the Bitcoin network or recover a private key through technical means. Manipulating the account holder provided a much simpler route to the funds.

Lam is one of 18 people charged in the investigation and the 11th defendant to plead guilty. Prosecutors have accused him of helping coordinate a group that allegedly conducted cryptocurrency scams beginning in 2023.

Millions in Crypto Turned Into Luxury Spending

After the alleged theft, authorities say Lam helped move and convert the cryptocurrency into cash.

The proceeds were reportedly used to finance an extravagant lifestyle, including a collection of more than 30 vehicles. The cars allegedly included customized Porsche, Lamborghini and Ferrari models.

Investigators also tied the money to a $2 million watch and luxury mansion rentals in Miami. Prosecutors say the group spent another $569,000 at a Los Angeles nightclub during a single evening.

According to the indictment, the spending spree lasted around a month before federal agents arrested Lam in Miami.

An off-duty law enforcement officer allegedly alerted Lam that investigators were approaching, according to prosecutors. The warning, however, did not stop the FBI from carrying out the arrest.

The indictment also refers to a recorded conversation from jail in which Lam allegedly told associates that the consequences of the investigation had been worse than they expected.

Social Engineering Emerges as the Critical Weakness

The case highlights an important distinction in cryptocurrency security: stealing digital assets does not always require compromising the technology that secures them.

Bitcoin’s blockchain was not reportedly attacked. The alleged perpetrators instead focused on the human and account-management layer surrounding the victim’s holdings.

By impersonating trusted organizations and obtaining sensitive access information, the attackers were allegedly able to bypass protections that would have been difficult to defeat through a direct technical attack.

The incident serves as a warning for crypto holders who rely on cloud accounts, recovery systems and customer-support channels to protect access to large balances. A compromised recovery method can potentially undermine otherwise strong wallet security.

Sentencing Remains Ahead

Lam had not been given a sentencing date when he entered his guilty plea. His RICO conspiracy conviction carries a maximum possible sentence of 20 years in prison.

The other defendants named in the 18-person case continue to face their respective legal proceedings.

For cryptocurrency investors, the case reinforces the importance of securing authentication methods and recovery accounts. Avoiding reused security codes and remaining cautious about unsolicited communications from supposed exchanges or technology providers can reduce exposure to impersonation attacks.

Bitcoin transactions also present a unique challenge after a theft because completed transfers generally cannot be reversed through the network itself. Recovering stolen funds typically requires authorities to trace the assets and pursue them through legal channels.

The alleged $245 million theft ultimately illustrates that the strongest part of a crypto system can still be undermined by its weakest human component. In this case, social manipulation reportedly proved more effective than attacking Bitcoin’s underlying technology.