Singaporean national Malone Lam has pleaded guilty in US federal court to participating in a racketeering conspiracy prosecutors say was used to steal and launder more than $245 million in cryptocurrency. Prosecutors allege the scheme relied on social engineering tactics and home break-ins, and that Lam helped run an international operation that targeted victims through online connections.

In a statement released Tuesday, the US Department of Justice said Lam organized the enterprise, identified prospective victims, and coordinated other conspirators. According to court documents referenced by the DOJ, the operation was formed through connections on online gaming platforms and was active from no later than October 2023 through at least May 2025. The plea was entered before US District Judge Colleen Kollar-Kotelly, and the court scheduled a status hearing for Dec. 8. The government did not announce a sentencing date.

Key takeaways

• Lam pleaded guilty to one count of a RICO conspiracy, shifting the case from a single theft allegation to an alleged broader criminal enterprise.
• US prosecutors describe a workflow combining social engineering with account takeover, then laundering proceeds through multiple crypto services.
• The DOJ says the operation linked victims via online gaming platform connections and operated for roughly a two-year window.
• The guilty plea comes nearly two years after Lam was charged over the theft of more than 4,100 Bitcoin from a Washington, DC resident.

How the alleged heist began with a 4,100-Bitcoin theft

Prosecutors initially accused Lam and Jeandiel Serrano of fraudulently obtaining more than 4,100 Bitcoin from a single victim on Aug. 18, 2024. At the time, that cache was valued at more than $230. Earlier coverage of the case noted that blockchain investigator ZachXBT identified the victim as a Genesis creditor and described an attack pattern that involved impersonation and account compromise.

According to that reporting referenced in the case background, the attackers allegedly posed as Google support staff to gain access to the victim’s accounts. Prosecutors say the operation then moved to impersonate Gemini support, urging the victim to reset two-factor authentication and to use screen-sharing software. Investigators allege the screen-sharing step exposed private keys, enabling the theft.

Following the initial allegations, Lam and Serrano were arrested on Sept. 18, 2024. The DOJ then unsealed their indictment the next day, alleging that the defendants laundered stolen proceeds through crypto mixers, exchanges, pass-through wallets, and virtual private networks.

From an alleged theft to a wider RICO conspiracy

Lam’s guilty plea is significant because it is tied to the Racketeer Influenced and Corrupt Organizations (RICO) framework—an approach prosecutors use when they argue defendants participated in a continuing criminal enterprise. In the DOJ’s description, Lam was not merely a participant in a single hack, but a coordinator who helped form and operate the network.

Earlier in the case, prosecutors expanded the scope. On May 15, 2025, the DOJ announced a superseding indictment that added 12 more defendants and broadened the allegations into an RICO conspiracy involving more than $263 million in cryptocurrency thefts. That update also included allegations of an additional $14 million theft in July 2024 and an alleged home break-in targeting a hardware wallet.

For investors and builders, the RICO structure matters because it signals prosecutors’ intent to treat these acts as part of a repeatable enterprise rather than an isolated fraud. It also affects how the court may evaluate the relationships between defendants and the operational methods—especially when investigators allege multiple tactics aimed at the same end goal: draining funds and then obscuring their origin.

Operational tactics prosecutors say were coordinated

The DOJ’s Tuesday statement describes an enterprise that allegedly recruited and identified victims using connections formed on online gaming platforms. Prosecutors say Lam organized the operation, selected targets, and worked with other conspirators to carry out the theft and laundering process.

In addition to the alleged cyber component, prosecutors say the enterprise included physical intrusion. The expanded indictment referenced an alleged home break-in targeting a hardware wallet—an allegation that, if proven, would demonstrate that the scheme was not limited to remote account compromise.

The government also alleged that Lam continued directing associates even during pretrial detention. Prosecutors claimed he arranged delivery of luxury items to his girlfriend. More broadly, the DOJ asserted that members of the group spent stolen funds on high-end purchases, including private jets, rental properties, watches, and at least 28 exotic cars. Prosecutors further alleged that nightclub expenses reached $500,000 per evening.

While these claims are part of the prosecution’s theory and not findings by the court, they help explain why prosecutors pursued a RICO case: they depict an alleged pattern of criminal activity paired with conspicuous consumption and operational coordination.

What comes next for the case

Lam’s guilty plea sets a procedural milestone, but it does not end questions that market participants may be watching. The court scheduled a status hearing for Dec. 8, yet the DOJ has not announced a sentencing date. That leaves the timing and trajectory of remaining proceedings—particularly the cases involving additional defendants—unclear.

Going forward, readers should pay attention to how the government and defense present the scope of the enterprise at sentencing, especially whether the prosecution will emphasize specific tactics such as impersonation workflows, the role of laundering infrastructure, and the alleged use of physical break-ins. Those details often determine how courts view responsibility in RICO matters and can influence outcomes for co-defendants in the expanded indictment.

ARK Investment Management has asked the U.S. Securities and Exchange Commission to approve a tokenized share class for its $562 million venture fund, allowing ownership records to be maintained using distributed ledger technology.

According to an application filed with the SEC, ARK Venture Fund wants to add a Tokenized Class alongside a new Exchange Class by amending an exemptive order the regulator granted in November 2025. The SEC published notice of the request on Aug. 24 and set Sept. 18 as the deadline for requests for a hearing.

ARK filed the original application on May 20 before submitting amendments on June 11 and Aug. 7 under file number 812-16031. The filing seeks relief under sections 6(c), 18 and 17(d) of the Investment Company Act, along with Rules 23c-3 and 17d-1.

The proposal would give the two new classes different routes for secondary trading. Exchange Class shares could list on a national securities exchange, while ownership of Tokenized Class shares would be recorded through distributed ledger technology.

Tokenized shares could trade through alternative trading systems registered under Regulation ATS, other quotation mediums or peer-to-peer transfers between approved wallets. ARK is not asking the SEC for permission to list or quote the shares on decentralized finance platforms.

ARK tokenized share class would use existing fund structure

ARK is seeking approval through the SEC’s existing exemptive application process while the agency continues working on separate rules that could govern tokenized securities.

The firm made clear that its application does not seek regulatory relief for the technology used to maintain its shareholder records. In a footnote, the applicants said they “are not seeking exemptive relief with respect to whether or how distributed ledger technology is used by a Fund to maintain a record of its shareholders.”

ARK Venture Fund operates as a continuously offered closed-end interval fund and reported $562 million in total assets as of Jan. 31. Its existing Class D, Class S and Class U shares were priced at $49.83, $49.69 and $49.70, respectively, as of May 15, with an aggregate non-affiliate market value of approximately $912.6 million.

The venture fund is separate from ARK’s better-known ARK Innovation ETF, which had $6.55 billion in assets and operates through ARK ETF Trust.

Under the proposed structure, investors would receive Tokenized Class shares through the fund’s normal subscription process at net asset value. The shares would carry no sales load and could be distributed by registered broker-dealers or directly through the fund’s transfer agent.

Costs associated specifically with the class would remain with its shareholders. The filing identifies potential transaction expenses tied to share sales, repurchases and dividend distributions.

The application would amend ARK’s November 2025 exemptive order, which allowed the fund to maintain multiple share classes. The earlier application contained a representation that fund shares would neither be listed on a securities exchange nor quoted on a quotation medium, requiring ARK to return to the SEC before introducing the proposed trading arrangements.

ARK has not selected a blockchain or tokenization provider

No blockchain, tokenization provider or new transfer agent has been identified in the application. The filing refers generally to “tokenization agents” and the fund’s transfer agent when discussing expenses associated with the proposed class.

The Bank of New York Mellon currently serves as ARK Venture Fund’s transfer agent, administrator and custodian, according to the fund’s semi-annual report.

ARK already has a financial connection to tokenization company Securitize through the venture fund. The portfolio holds Securitize equity and a $10 million convertible note carrying a 5% interest rate and maturing in September 2028. The fund acquired the note on Sept. 30, 2025.

Securitize has expanded its institutional tokenization business this year. In August, the company launched a tokenized high-yield fund with Neuberger that invests mainly in high-yield bonds while offering interests across Avalanche, Ethereum, Solana and Sui.

The company serves as the transfer agent and tokenization platform for BlackRock’s BUIDL fund and has continued adding institutional products to its infrastructure. ARK has maintained exposure to the company as its tokenization business has expanded, while Hanwha Group became its largest shareholder in July after its combined holdings reached 9.6%.

ARK’s application does not state whether Securitize would have a role in the proposed Tokenized Class.

SEC tokenization rules remain under development

The filing arrives before the SEC has completed a separate regulatory framework for tokenized securities trading.

An innovation exemption discussed by SEC Chair Paul Atkins has yet to take effect. The proposed approach is expected to let selected firms test blockchain-based securities products under defined conditions while permanent rules are developed.

As crypto.news previously reported, the SEC was preparing a regulatory route in August that could permit qualified platforms to trade tokenized U.S. stocks around the clock. Existing federal securities rules remain applicable while the exemption is unfinished.

Progress on the exemption has faced delays. Legal questions over the SEC’s authority and concerns from traditional market participants delayed the planned framework in August, with questions centered on how blockchain-based trading would interact with existing securities market rules.

Atkins separately introduced a Regulation Crypto Assets proposal on Aug. 18. The proposal addresses exemptions for crypto asset issuers but does not establish rules specifically for tokenized investment fund share classes. Public comments on the proposal are due Oct. 20.

ARK’s application therefore relies on the existing Investment Company Act process instead of requiring the unfinished innovation exemption to become effective.

SEC is rewriting transfer agent rules for blockchain records

Regulators are separately examining the infrastructure that maintains official securities ownership records.

On Sept. 1, the SEC proposed a transfer agent overhaul covering registration, recordkeeping, transfer processing and asset safeguarding. It is the agency’s first major attempt in roughly four decades to rewrite the rules governing registered transfer agents.

The proposal specifically addresses the use of blockchain technology in securities offerings and share transfers. Transfer agents using digital records would face requirements covering recordkeeping systems, cybersecurity, business continuity and the use of outside technology providers.

The rulemaking comes as firms are testing ways to connect blockchain settlement with regulated shareholder records. Injective said in July that it had sought SEC transfer agent registration to maintain tokenized securities ownership records on blockchain infrastructure, although a public SEC filing supporting the registration claim had not been located at the time.

Comments on the SEC’s proposed transfer agent overhaul are due Nov. 3. ARK’s Tokenized Class application has a separate Sept. 18 deadline for hearing requests, after which the commission can issue an order on the requested exemptive relief.

Block has applied to establish an uninsured U.S. national trust bank that would place some of its Bitcoin, stablecoin and digital asset custody operations under direct federal supervision.

Block said on Tuesday that it submitted an application to the Office of the Comptroller of the Currency to form Builders Bank & Trust, N.A., a proposed national trust bank that would operate without taking deposits or making loans.

If approved, Builders Bank would provide custody and related fiduciary services for assets including Bitcoin and stablecoins. The proposed bank would operate under OCC supervision and give Block a national regulatory framework for certain custody activities that the payments company already offers.

The application does not allow Builders Bank to begin operations. Block said the proposed institution would only launch after securing the required regulatory approvals from the OCC.

“Building on Block’s experience in the digital asset space, our history with Square Financial Services, and the deep banking expertise of the team we’ve assembled, we believe Builders Bank is well positioned to support Block’s broader vision of economic empowerment,” Lee Woolley, who would serve as president and CEO of Builders Bank, said.

Block trust bank would focus on Bitcoin and stablecoin custody

Unlike a traditional commercial bank, Builders Bank would not accept customer deposits or issue loans. Block described the planned entity as an uninsured, non-deposit-taking national trust bank focused on custody and fiduciary services.

A national trust structure can be used by digital asset companies to conduct approved custody and trust activities under federal supervision without operating as a conventional retail bank. As crypto.news previously reported, crypto trust banks can provide services such as digital asset custody and stablecoin reserve management while remaining outside the traditional deposit-taking model.

Block said a federal charter would establish consistent supervision for certain custody and related activities as those operations scale. Bitcoin and stablecoins were specifically identified among the assets Builders Bank could custody.

Woolley said the company plans to work with the OCC as it pursues a charter designed to support secure asset custody for Block and its customers.

Woolley currently serves as Block’s Digital Asset Strategy Lead and has more than 20 years of experience in banking and financial services. Before joining Block, he served as president and CEO of Treasury Department Federal Credit Union and held senior banking positions at Northern Trust and BNY Mellon.

Block already has experience operating within the U.S. banking system through Square Financial Services, an industrial bank that began operations in 2021. Builders Bank would create a separate federally supervised structure focused on trust and custody activities.

OCC has opened a path for more crypto bank applications

Block is seeking the charter during a period of increased applications from cryptocurrency and fintech companies looking to bring digital asset businesses under federal banking supervision.

Comptroller Jonathan Gould said in August that digital asset companies conducting legally permissible activities should have access to the U.S. national banking system. At the time, the OCC had received 40 de novo charter applications over an 18-month period, including applications for national trust banks, crypto.news reported in August.

The regulator had 13 pending digital asset licensing applications at that point, with companies including Payward, Revolut and World Liberty Financial among those pursuing federal approvals.

Revolut moved further through the process last week after receiving conditional OCC approval to establish Revolut Bank US, N.A. The fintech plans to base the proposed bank in Stamford, Connecticut, and inject roughly $95 million in initial capital.

Revolut expects the bank to launch in the first half of 2027, but the company still needs Federal Deposit Insurance Corporation and Federal Reserve clearances along with final OCC authorization. Its planned services include checking accounts, cards, installment loans, foreign exchange products and a stablecoin.

The OCC has used national trust charters more extensively with digital asset businesses since late 2025. Ripple, Circle, Paxos, BitGo and Fidelity Digital Assets received conditional approvals in December 2025, while other applicants followed during 2026.

Conditional approval represents an intermediate stage in the charter process. Applicants generally must complete organizational requirements and meet conditions involving areas such as capital, governance, compliance systems and operational readiness before receiving authorization to open.

Circle has since progressed beyond that stage. The stablecoin issuer received final OCC approval in July to establish Circle National Trust, a federally supervised trust bank that can provide digital asset custody services to Circle, its affiliates and a limited group of institutional customers.

Kraken parent Payward has taken a similar route. Its proposed Payward National Trust Company would provide federally regulated digital asset custody to institutional customers without accepting deposits or issuing conventional loans.

Crypto firms continue pursuing national trust charters

Applications have continued even as some companies face longer regulatory reviews.

Zerohash submitted a second national trust bank application in August after the OCC returned its original filing. The revised application proposes a narrower set of trust activities, with the regulator opening a public comment period through Sept. 17.

The OCC can request further information, impose conditions, approve an application or reject it after reviewing the filing and public comments. Zerohash’s revised application had not received an approval or rejection when crypto.news reported on the filing in late August.

World Liberty Financial, the crypto venture backed by President Donald Trump’s family, received preliminary conditional approval on Aug. 14 to establish World Liberty Trust Company, National Association.

The proposed institution would issue and redeem the USD1 stablecoin, manage its reserves and provide digital asset custody services. World Liberty must meet the OCC’s conditions before the bank can begin operations, including maintaining at least $20 million in eligible capital.

The application and subsequent approval have drawn political scrutiny because of the Trump family’s ties to the company. A Trump family-affiliated entity reportedly owns 38% of WLTC Holdings, the holding company behind the proposed bank, while a group backed by Sheikh Tahnoon bin Zayed Al Nahyan of Abu Dhabi and co-investors reportedly controls a 49% stake.

World Liberty’s conditional approval came after lawmakers had questioned potential conflicts of interest surrounding the company and its regulatory dealings with the administration.

Scrutiny of crypto trust charters has extended beyond World Liberty. Sen. Elizabeth Warren questioned the OCC’s authority earlier this year to grant national trust charters to digital asset companies, arguing that some approved activities could exceed limits under the National Bank Act.

Traditional banking groups have raised separate objections. The Bank Policy Institute retained outside counsel as it considered a possible legal challenge to the OCC’s approach after the regulator issued a series of conditional approvals to crypto companies. No lawsuit had been filed when the potential challenge was reported in July.

Block’s application remains subject to OCC review. Builders Bank will not begin operating unless the regulator approves the proposed charter and the institution completes the requirements needed to open under federal supervision.

Iran’s central bank has reportedly eased foreign-exchange controls and tolerated cryptocurrency use for export payments as businesses seek alternatives to conventional banking channels restricted by U.S. sanctions.

Iranian companies can receive cross-border payments through USDT, Bitcoin and other digital assets, the Financial Times reported on Sept. 9, citing people familiar with the matter. USDT is reportedly the most widely used asset.

“Receiving export payments in crypto has now become completely normalized,” an executive at a government-linked company told the publication. The executive was not identified, and the Central Bank of Iran did not respond to the newspaper’s request for comment.

Iran crypto payments remain an unofficial policy shift

The reported changes include allowing exporters to repatriate overseas funds through domestic cryptocurrency exchanges. Businesses may also convert foreign currency through open markets or use export revenue directly to purchase imports.

These arrangements reduce exporters’ reliance on Iran’s official foreign-exchange system. That system has traditionally required companies to return foreign earnings through state-supervised channels, often at exchange rates below those available on the open market.

The Financial Times report describes a shift in enforcement rather than a published law or formal central bank directive. No public document from the Central Bank of Iran has confirmed that cryptocurrency is now an authorized settlement method for every exporter.

The distinction matters because tolerance by officials does not necessarily provide businesses with legal certainty. Policies could change, while transactions may still face domestic reporting, tax or foreign-exchange requirements.

Iranian officials are also seeking the return of export proceeds held outside the country. More than 20,000 individuals and companies have allegedly failed to repatriate approximately €94 billion, according to figures cited by the Financial Times. That claim has not been independently verified through a central bank filing.

On-chain activity approached $10 billion in 2025

TRM Labs attributed approximately $9.9 billion in cryptocurrency volume to Iran during 2025. Its 2026 crypto crime report measured both incoming and outgoing transactions linked to Iranian services and entities.

The total was lower than approximately $11.4 billion recorded in 2024. TRM said the sustained volume reflected structural demand rather than purely speculative trading. Blockchain attribution remains an estimate and could change when researchers identify additional addresses.

Iranian users employ digital assets for several purposes, including savings, trading and cross-border payments. USDT offers exposure to the U.S. dollar without requiring access to a dollar-denominated bank account. Tron is widely used for USDT transfers because of its relatively low transaction fees.

Bitcoin mining provides another crypto channel. Elliptic estimated in 2021 that Iran accounted for about 4.5% of global Bitcoin mining. That estimate is historical and should not be treated as Iran’s confirmed share in 2026.

The reported $10 billion in annual crypto activity also remains small relative to Iran’s wider economy and trade requirements. Digital assets can improve settlement access, but they do not fully replace banking relationships, trade finance or large-scale foreign-exchange markets.

U.S. sanctions make Iranian crypto transactions risky

Iran’s domestic acceptance of crypto does not override foreign sanctions. The U.S. Treasury considers Iranian digital asset exchanges to be Iranian financial institutions whose property must be blocked when it falls under U.S. jurisdiction.

An official OFAC notice says U.S. persons generally cannot transact with Iranian crypto exchanges unless an exemption or authorization applies. Sanctions obligations apply whether transactions use traditional currency or digital assets.

The exposure can extend beyond U.S. companies. OFAC says non-U.S. financial institutions and other foreign persons may face sanctions for materially supporting designated Iranian exchanges or facilitating certain transactions on their behalf.

In June, Treasury designated Nobitex, Wallex, Bitpin and Ramzinex. The agency accused the platforms of operating in Iran’s financial sector and facilitating activity linked to sanctioned entities.

TRM estimated that the four exchanges handled about $7.7 billion, or 78%, of Iran’s attributed cryptocurrency volume during 2025. Nobitex alone reportedly processed more than half of Iranian digital asset inflows.

Stablecoin freezes limit crypto’s resistance to sanctions

USDT may offer faster cross-border settlement, but Tether can freeze tokens at the issuer level. This makes the stablecoin more controllable than Bitcoin, whose protocol lacks a central issuer with comparable blocking authority.

In April, Tether froze approximately $344 million in USDT held across two Tron addresses linked by U.S. authorities to Iranian state and military networks. As crypto.news previously reported, the wallet freeze targeted funds tied to Iran’s IRGC.

The action showed that blockchain transfers do not automatically place funds beyond sanctions enforcement. Stablecoin issuers, centralized exchanges and compliant intermediaries can restrict addresses or freeze assets when authorities identify prohibited activity.

Washington has since widened its campaign. In related coverage, U.S. authorities intensified actions against Iran-linked cryptocurrency networks while warning companies about digital asset transactions involving sanctioned Iranian entities.

The next developments will depend on whether Iran’s central bank formally confirms the reported policy, publishes settlement rules or licenses specific channels for exporters. Until then, claims that crypto payments have become “completely normalized” remain based on unnamed sources and industry testimony.

Foreign exporters, exchanges and payment providers must separately assess U.S., European and domestic sanctions exposure. Iran’s reported tolerance does not protect an overseas counterparty from asset freezes, secondary sanctions or enforcement in another jurisdiction.

Gemini received a Major Payment Institution license from the Monetary Authority of Singapore on Sept. 9, completing an approval process that lasted almost two years.

The license covers Gemini Digital Payments Singapore, the exchange’s locally incorporated entity. The company can provide digital payment token services and cross-border money transfers under Singapore’s Payment Services Act.

Gemini had operated in the country since 2020. MAS granted the company in-principle approval for the MPI license in October 2024, subject to Gemini satisfying the regulator’s remaining conditions.

Gemini’s Singapore license removes standard volume caps

The MAS Financial Institutions Directory lists Gemini Digital Payments Singapore as a licensed major payment institution. Its approved activities include digital payment token and cross-border money transfer services.

An MPI license allows its holder to exceed the transaction limits applied to standard payment institutions. Those thresholds normally restrict the monthly value that a standard institution can process across regulated payment services.

The absence of standard volume caps does not mean Gemini will operate without restrictions. MAS says major payment institutions face more comprehensive regulation because their larger operations can create greater financial and operational risks.

The license requires continued compliance with rules covering anti-money laundering controls, customer due diligence, technology risk and regulatory reporting. Authorization applies to Gemini’s Singapore entity and its approved services, rather than every product offered by the wider Gemini group.

Full approval follows Gemini’s 2024 preliminary license

Gemini received in-principle approval from MAS in October 2024. As crypto.news previously reported, the preliminary approval covered crypto and cross-border payment services while the company worked toward full authorization.

In April 2025, Gemini transferred its Singapore customers from U.S.-based Gemini Trust Company to Gemini Digital Payments Singapore. The local company operated under a temporary exemption while its license application remained under review.

Gemini informed customers through a support notice that the transition would change their contracting entity. Customers had to accept updated user agreements and privacy terms to continue using the platform.

The final license ends Gemini’s reliance on that exempt arrangement for the approved activities. It also places responsibility for regulated Singapore services directly with the local entity.

Gemini will serve retail and institutional customers

Gemini Digital Payments Singapore currently offers spot cryptocurrency trading, custody and over-the-counter services. The company has not announced new products or a launch schedule tied directly to the license.

Gemini President Cameron Winklevoss said the approval “validates” the company’s investment in Singapore. Chief Executive Tyler Winklevoss described the country as a strategic hub for serving retail and institutional customers.

Those statements describe Gemini’s intended regional strategy. The company did not disclose its Singapore customer count, transaction volume or revenue in the license announcement.

The exchange has recently expanded local asset support. In related coverage, Gemini enabled XRP deposits and withdrawals through the XRP Ledger for customers in Singapore, allowing direct transfers without routing them through another supported network.

Singapore maintains selective crypto licensing

Gemini joins other digital asset companies holding MPI licenses in Singapore, including Coinbase, Crypto.com, OKX, Bitstamp and institutional liquidity provider Cumberland.

MAS approved Cumberland’s digital token and cross-border payment services in July. The regulator has also taken action against companies that failed to meet its standards.

Singapore’s licensing framework distinguishes between firms with local authorization and offshore platforms that may be accessible elsewhere. An international exchange’s global operations do not automatically permit it to serve Singapore residents.

Meanwhile, the approval also strengthens Gemini’s position in Asia as regulators apply entity-specific licensing requirements to crypto platforms. 

Gemini must now maintain the systems, staffing and controls required by its MPI license. MAS can impose conditions, conduct inspections or take enforcement action if a licensed provider breaches its obligations.

No verified market reaction was available because the announcement concerned Gemini’s private operating subsidiary and did not involve a publicly traded token. The next measurable developments will be any new locally approved products, regional hiring or changes to Gemini’s Singapore services.

A Singaporean national, Malone Lam, has pleaded guilty in US federal court to participating in a racketeering conspiracy prosecutors say relied on social engineering and physical break-ins to steal and launder more than $245 million in cryptocurrency. The US Department of Justice said Lam helped build and run an international operation, including selecting targets and coordinating co-conspirators.

Prosecutors allege the enterprise operated from no later than October 2023 through at least May 2025, according to court documents unsealed by the DOJ. Lam entered the plea before US District Judge Colleen Kollar-Kotelly to one count of participating in a Racketeer Influenced and Corrupt Organizations (RICO) conspiracy, and the judge scheduled a status hearing for Dec. 8 without announcing a sentencing date.

Key takeaways

• Malone Lam’s guilty plea centers on participation in a DOJ-described RICO conspiracy involving over $245 million in crypto theft and laundering.
• Prosecutors say the operation used online gaming platform connections and blended digital social engineering with home break-ins.
• The case traces back to allegations that Lam helped steal more than 4,100 Bitcoin from a Washington, DC resident.
• A RICO track expanded the prosecution: a superseding indictment added 12 defendants and increased the scope to more than $263 million in alleged thefts.
• Lam’s sentencing date has not been announced, even though the plea was entered roughly two years after the original criminal charge.

How the alleged theft worked

According to the original DOJ allegations, Lam and another defendant, Jeandiel Serrano, were accused of fraudulently obtaining more than 4,100 Bitcoin from a single victim on Aug. 18, 2024. Prosecutors previously said the victim’s assets were worth more than $230 at the time of the alleged theft.

Later reporting by blockchain investigator ZachXBT identified the victim as a Genesis creditor. The alleged scheme, according to that investigative reporting, involved attackers impersonating “Google support” staff to compromise the victim’s accounts, then posing as Gemini support to pressure the victim into resetting two-factor authentication and using screen-sharing software. Prosecutors said the screen-sharing step exposed private keys, enabling attackers to gain control of the Bitcoin.

From targeted fraud to a broader racketeering conspiracy

Prosecutors arrested Lam and Serrano on Sept. 18, 2024, and unsealed an indictment the next day. In that filing, prosecutors alleged that the defendants laundered stolen proceeds through a network of methods including crypto mixers, exchanges, pass-through wallets, and virtual private networks.

The DOJ also positioned the case as more than a single theft. On May 15, 2025, prosecutors announced a superseding indictment that added 12 additional defendants and expanded the matter into an alleged RICO conspiracy tied to more than $263 million in cryptocurrency thefts. The updated charging narrative included an additional $14 million theft reported in July 2024 and an alleged home break-in targeting a hardware wallet.

In the same expanded prosecution, prosecutors also alleged Lam continued directing associates after his arrest and while he was held in pretrial detention. They claimed he coordinated the delivery of luxury items to his girlfriend as part of the broader alleged operation.

What prosecutors say the operation looked like

The guilty plea adds clarity—at least from the government’s perspective—on how prosecutors believe the enterprise functioned. In its announcement of Lam’s plea, the Justice Department said Lam organized the international operation, identified prospective victims, and coordinated other conspirators.

The DOJ further stated that court documents show the enterprise was formed through connections on online gaming platforms. Prosecutors described a hybrid approach that combined online access and manipulation with physical intimidation or intrusion, including home break-ins aimed at compromising crypto holdings.

As the case expanded, prosecutors also alleged that stolen funds were used for high-end purchases and a lifestyle involving private jets, rental properties, watches, and at least 28 exotic cars. They also pointed to nightlife expenses, including claims of nightclub bills reaching $500,000 per evening.

Why Lam’s plea matters for the crypto industry

Although the case is rooted in one defendant and one alleged victim, the RICO structure and the government’s description of tactics are significant for the broader crypto ecosystem. The allegations emphasize how social engineering attacks can be paired with operational coordination and money movement infrastructure, making them more resilient than a single compromise event.

Investors and users should take note of how the DOJ’s narrative connects account takeover techniques—such as impersonation of trusted service channels and pressure to reset authentication—directly to the longer-term laundering pipeline. The plea also underscores that prosecutors may pursue multi-defendant conspiracy theories under RICO when they view crypto thefts as part of an ongoing enterprise rather than isolated fraud.

That said, the practical impact on ongoing civil or creditor-related matters will depend on what facts are established in the case record beyond the plea itself, including how courts and prosecutors handle evidence tied to the expanded allegations.

With Lam now having pleaded guilty, attention will likely shift to what the government can prove at sentencing and what additional defendants still fighting the charges will challenge—particularly around how the alleged operation formed, how targets were selected, and how proceeds were traced and laundered. Readers should watch for updates as the status hearing approaches and for any subsequent DOJ filings that clarify the government’s remaining theory of the case.