Malone Lam, the alleged ringleader of a group accused of stealing more than $240 million in Bitcoin from a Washington, D.C., investor, has been set for a plea agreement hearing after 10 other defendants admitted guilt in the sprawling crypto theft case.

The Associated Press reported that the 22-year-old Singaporean is scheduled to appear in court Tuesday, nearly two years after prosecutors accused him and his associates of using social engineering to steal more than 4,100 Bitcoin from a longtime crypto investor in August 2024.

Eighteen defendants have been charged in the case, with Lam set to become the 11th to plead guilty. A prosecutor estimated during his first court appearance that federal sentencing guidelines could recommend at least 14 years in prison if he is convicted.

Lam was arrested in September 2024 after investigators traced a month-long spending spree involving luxury cars, private jets, expensive watches, mansions and millions of dollars spent at nightclubs.

Malone Lam case began with a $240 million Bitcoin theft

The case centers on an Aug. 18, 2024, attack against a Washington resident identified in court filings as “Victim 7.”

Prosecutors said the group targeted the man because he was a wealthy, longtime cryptocurrency investor. One caller posed as a Google representative and asked about supposed attempts to compromise the victim’s account. Another pretended to work for crypto exchange Gemini and warned that malware had affected his wallet.

The callers persuaded the victim to give them access to his Google Drive and disclose security codes, allowing the group to take control of more than 4,100 BTC.

Crypto.news previously reported in September 2024 that Lam, Veer Chetal and Jeandiel Serrano were linked to the roughly $243 million social engineering attack. Blockchain investigator ZachXBT helped trace the theft and published material tied to the group.

A private recording captured the suspects reacting after gaining control of the Bitcoin, according to the AP. One voice could be heard saying, “Oh, my God! Bro, bro, I’m going to spaz out!”

The stolen cryptocurrency was subsequently moved through multiple exchange platforms as money launderers worked to convert parts of the proceeds into fiat currency, prosecutors said.

Investigators alleged that the August theft was not the group’s first operation. Lam and his associates, who had met through online gaming communities, had worked together on other multimillion-dollar thefts since late 2023 using similar social engineering methods.

Such attacks have remained a major source of cryptocurrency losses. In January 2026, a crypto holder lost more than $282 million in Bitcoin and Litecoin after being deceived in another social engineering scheme involving a hardware wallet. ZachXBT said the stolen assets were moved through instant exchanges and converted into Monero.

Investigators traced the group through an IP address

One operational mistake helped investigators identify the people behind the 2024 theft.

Prosecutors said Serrano created an account on a cryptocurrency exchange to hold nearly $30 million in stolen assets but failed to conceal his internet protocol address. Investigators traced it to a home in Encino, California, that he was renting for $47,500 per month.

By then, members of the group had started spending their proceeds.

Serrano was vacationing in the Maldives when investigators identified him as a suspect, while Lam and his associates spent $4 million at Los Angeles nightclubs within a month, according to authorities.

Lam alone spent more than $569,000 during one night at a Los Angeles club. The FBI said he used stolen cryptocurrency to buy a $2 million watch and more than 30 vehicles, including customized Porsches, Lamborghinis and Ferraris.

Chetal bought his parents a Lamborghini and kept $500,000 in cash inside a duffel bag hidden in their washing machine.

Their spending soon created another security problem. Roughly a week after the Bitcoin theft, several masked men intercepted Chetal’s parents while they were driving in Danbury, Connecticut.

The attackers beat Chetal’s father with a baseball bat, forced the couple into a van and bound their hands, according to the AP. Prosecutors said the group intended to use the parents to pressure Chetal into surrendering his portion of the stolen cryptocurrency.

Witnesses contacted police, and officers arrested the alleged kidnappers before the ransom plan could be completed.

Physical attacks involving cryptocurrency holders and their relatives have become more common. Chainalysis estimated that criminals stole more than $30 million through successful physical crypto attacks worldwide during the first half of 2026.

The blockchain analytics firm documented 46 attacks through late June, of which 12 resulted in payments. Family members or people connected to crypto holders accounted for roughly 25% to 30% of documented cases by early 2026.

FBI arrests followed the group’s spending spree

The FBI searched Chetal’s apartment in Brunswick, New Jersey, on Sept. 9, 2024, finding $37 million in stolen cryptocurrency in his possession. Chetal subsequently agreed to cooperate with investigators.

Nine days later, agents arrested Serrano at Los Angeles International Airport while he was wearing a watch valued at $500,000.

Serrano initially denied involvement but later acknowledged possessing roughly $20 million in cryptocurrency stolen from the Washington victim, prosecutors said. His charges remain pending.

Lam was arrested the same day at one of the Miami properties he had been using. Prosecutors later alleged that an off-duty law enforcement officer warned him that authorities were preparing to make the arrest.

“We always talked about what it would be like if I were to go down, but never thought it would be this crazy,” Lam told associates during a recorded jail call cited in his indictment.

His spending surprised U.S. Magistrate Judge Alicia Valle during his initial appearance in Miami.

“I could only think of Ferris Bueller gone bad,” Valle said, referring to the main character in the 1986 film “Ferris Bueller’s Day Off.”

The arrests did not immediately stop stolen funds from being spent. Prosecutors said another defendant, Ferro, later used proceeds from the scheme to pay Lam’s legal expenses. Ferro pleaded guilty to racketeering conspiracy and declined to address the court when he was sentenced in May.

Social engineering losses remain high

The Lam case is part of a series of large cryptocurrency thefts in which attackers have targeted people instead of exploiting blockchain code.

Another elderly American lost $330.7 million worth of Bitcoin in April 2025 after attackers used a social engineering scheme to take 3,520 BTC, according to ZachXBT. The funds were subsequently moved through more than 300 wallets and at least 20 exchanges.

Federal data have recorded substantial losses from crypto-related fraud. The FBI received 181,565 cryptocurrency-related complaints involving $11.37 billion in losses during 2025, while investment fraud accounted for 61,559 complaints and $7.23 billion in reported losses.

Cybersecurity researcher Allison Nixon, who has tracked an online hacker subculture known as The Com, told the AP that the large sums available through crypto fraud have attracted young offenders and called for more law enforcement resources.

“If we don’t seriously ramp up the resources to take these people down and do it faster, then it’s going to spread more and more,” Nixon said.

U.S. District Judge Colleen Kollar-Kotelly, who is overseeing Lam’s case, has already sentenced three of his alleged co-conspirators. Two defendants involved in laundering the stolen funds received prison terms of roughly six years.

Chetal pleaded guilty to conspiracy charges in November 2024 and is awaiting sentencing, while Tucker Desmond received probation after pleading guilty to destroying evidence connected to other members of the group.

Desmond told the court during his March sentencing that he had become “obsessed with the image of success rather than actually becoming a hard-working individual myself.”

During Ferro’s sentencing in May, defense attorney Kevin Wilson described the defendants as mischievous “young kids,” an argument Kollar-Kotelly rejected.

“Being young only goes so far,” the judge said.

Zcash (ZEC) climbed to its highest price since 2016, extending a rally that has pushed the privacy-focused cryptocurrency’s market capitalization above $20 billion.

ZEC reached $1,249.28 before retreating to about $1,195 on Monday, according to CoinGecko data. The token gained about 45% over the past week and 138% over 30 days.

The rally leaves Zcash below its launch-era record. CoinGecko lists an all-time high of $3,191.93 on Oct. 28, 2016, when only a small supply of tokens was available.

Zcash allows users to choose between public and “shielded” transactions. The latter uses zero-knowledge proofs to verify payments without revealing the sender, recipient or transaction amount.

“For users that prioritize privacy, this could become a ‘must have’ feature,” Grayscale’s head of research, Zach Pandl, said in an Aug. 31 analysis.

Pandl said that AI could increase demand for financial privacy by making it easier to link public blockchain transactions to users’ identities.

Zcash has been on a tear since Grayscale converted its existing Zcash Trust into an exchange-traded fund. The product, trading under the ticker ZCSH, began trading on NYSE ARCA on Aug. 25, giving investors exposure to ZEC through brokerage accounts.

The ETF closed Friday at $83.77 a share, with $463.2 million in assets under management, according to the fund’s website. US markets are closed Monday for the Labor Day holiday.

Related: Grayscale says Zcash can challenge Bitcoin’s network effects as privacy demand grows

This article is produced in accordance with Cointelegraph’s Editorial Policy and is intended for informational purposes only. It does not constitute investment advice or recommendations. All investments and trades carry risk; readers are encouraged to conduct independent research.

Bitcoin sidechain Liquid Network has paused operations after supposed white-hat hackers withdrew 4,000 BTC, worth around $320 million, from its federation wallet.

White-hat hackers are cybersecurity professionals who detect vulnerabilities in software, hardware, or networks and warn organizations about potential security risks.

Liquid Network Pauses Operations

The Bitcoin sidechain released a statement on X confirming the incident, adding that it was working with Blockstream, its technology partner, to contact the hackers in question through an on-chain signed message. However, Liquid Network has not yet identified the hackers or disclosed whether the funds would be returned.

“We are aware of a security incident on @Liquid_BTC. Purported white-hat hackers have withdrawn ~4,000 BTC (~$320 million) from the Liquid Federation wallet. The @Blockstream team is working on contacting them on-chain with a signed message.”

The hackers withdrew around 95% of Liquid’s Bitcoin reserves. The sidechain’s Bitcoin reserves stood at 4,200 BTC before the security incident.

Incident Details

The statement also explained how the Bitcoin was withdrawn. According to Liquid Network, the hackers withdrew the funds using the SideSwap PAK, or Peg-Out Authorization Key. The statement clarified that the network was not compromised, but it did not disclose the vulnerability that allowed the white-hat hackers to withdraw the BTC. Following the withdrawal, the hackers reached out to the Liquid Network in an on-chain message linked to the transaction.

“We are whitehats. Contact us on-chain.”

It also notified cryptocurrency exchanges, with deposits and withdrawals of LBTC, the sidechain’s Bitcoin-backed token, already suspended. The protocol also temporarily disabled bridge nodes to prevent new transactions from being submitted to the network.

“Exchanges have been notified and have already paused (or will pause) LBTC deposits and withdrawals. Other Liquid assets such as USDT, DePix, and RWAs are unaffected by this security incident. Bridge nodes have been temporarily disabled, so no new transactions can be submitted to the network. Effectively, the Liquid sidechain is paused until this issue is resolved.”

The Liquid Network warned that wallets may also be impacted, but said the incident did not affect other assets such as USDT, DePix, and real-world assets.

Crypto Security Back In Focus

Liquid Network is a Bitcoin sidechain facilitating faster and confidential transfers. It also enables the issuance of digital assets. BTC in Liquid is represented by the LBTC token, with the underlying asset secured by federation operators. The protocol is used by several platforms for quick settlements, primarily because the primary Bitcoin blockchain often faces network congestion.

The incident, part of a string of hacks that have hit the industry, has put crypto security back in the spotlight. A Crypto.com-linked lending platform was drained of $6 million by a hacker on August 31. The recent Coldcard exploit also shook the foundations of digital asset custody, raising serious questions about cold wallets, considered the safest way to store crypto.

Disclaimer: This article is provided for informational purposes only. It is not offered or intended to be used as legal, tax, investment, financial, or other advice.

El Salvador President Nayib Bukele has rejected reports that the country transferred its Strategic Bitcoin Reserve to a private operator as part of its agreement with the International Monetary Fund (IMF).

The denial came after the IMF reached a preliminary agreement with El Salvador that will unlock $140 million in additional funding under a broader $1.4 billion financing program.

Bukele said the transaction involved shares in the government’s Chivo wallet rather than the country’s Bitcoin holdings, pushing back against reports that the reserve itself had been handed to a private entity.

Key Takeaways

• Nayib Bukele says El Salvador did not transfer its Strategic Bitcoin Reserve to a private operator.
• The president said only shares in the Chivo wallet were transferred.
• The IMF has agreed to release another $140 million as part of its $1.4 billion program with El Salvador.
• The country’s Bitcoin holdings have risen from about 6,224 BTC in June 2025 to more than 7,764 BTC.
• The IMF says recent growth in the reserve came from private donations rather than government spending.

Bukele Draws a Line Between Chivo and El Salvador’s Bitcoin Reserve

Bukele responded to reports about the transfer on Friday, saying the government had not handed over control of its strategic Bitcoin holdings.

“The only thing that was transferred were Chivo’s shares … and NOT the Strategic Bitcoin Reserve,” Bukele said in a post on X.

The comments came shortly after the IMF outlined changes involving El Salvador’s state-backed Chivo wallet. The Fund said majority ownership and operational control of the wallet had been transferred to a private operator.

The government, however, continues to hold a minority stake and retains responsibility for the custody of customer assets.

The distinction is important because Chivo and the Strategic Bitcoin Reserve represent separate parts of El Salvador’s cryptocurrency strategy.

El Salvador’s Bitcoin Holdings Continue to Attract Attention

El Salvador became the first country to adopt Bitcoin as legal tender in 2021, introducing it alongside the US dollar. The policy later became a central issue in negotiations with the IMF.

The government removed Bitcoin’s legal tender status in January as part of the conditions surrounding the IMF program.

Despite the policy changes, El Salvador’s Bitcoin holdings have continued to increase. The country’s reserve stood at around 6,224 BTC at the end of June 2025 and has since risen to more than 7,764 BTC.

That represents an increase of roughly 1,540 BTC.

The size of the increase has raised questions because Salvadoran officials have continued to promote the idea of adding one Bitcoin per day to the national reserve.

IMF Says Recent Bitcoin Growth Came From Donations

Meanwhile, the

DBS and Citi have completed what they describe as the first weekend tokenized cross-border payment between Singapore and the United States, using tokenized deposits routed through Swift’s Digital Ledger. The transaction was settled within minutes, positioning blockchain-enabled payment rails as a potential solution to the long delays and limited operating hours associated with conventional cross-border banking workflows.

DBS said it finalized the transfer using tokenized deposits on Swift’s system, enabling activity outside standard banking schedules. The group called the speed of settlement a “significant improvement,” contrasting it with the industry norm—often up to two business days—for traditional cross-border transfers.

Key takeaways

• DBS and Citi executed a Singapore-to-US cross-border payment over the weekend using tokenized deposits on Swift’s Digital Ledger.
• Settlement reportedly took minutes, improving on typical traditional cross-border timelines of up to two business days.
• The test highlights how major banks are experimenting with blockchain-based messaging/settlement infrastructure while keeping deposits within regulated banking channels.
• It builds on earlier Swift-led pilots involving other large banks, including HSBC and Standard Chartered.
• Citi is also pursuing a separate roadmap for tokenized deposit networks via The Clearing House, with plans discussed for 2027.

Weekend settlement becomes the latest proof point for tokenized rails

The DBS-Citi payment underscores a practical problem tokenization aims to address: cross-border transfers often remain bound by banking hours and operational processes that can stretch timelines well beyond a single business day. By running the transaction through Swift’s Digital Ledger and using tokenized deposits, the banks were able to complete the payment during a weekend—when many traditional settlement and processing paths are less active.

According to DBS’s announcement, the workflow relies on tokenized deposits rather than a full move to cryptocurrency custody or retail-style blockchain transfers. That distinction matters for investors and market participants watching these initiatives: it signals the direction large institutions are taking—using blockchain-style settlement mechanics to accelerate payment completion while preserving deposit-based structures familiar to regulated banking systems.

DBS emphasized that the deposit was finalized in minutes, framing it as a notable improvement over the “as long as two business days” timeframe often experienced in traditional cross-border channels. For banks and corporates alike, reducing idle time between initiation and settlement can improve cash management and operational efficiency, especially when payments are time-sensitive.

Swift’s Digital Ledger pilots: from readiness to expanding bank participation

This latest settlement follows earlier milestones tied to Swift’s push into tokenized deposits. In August, Standard Chartered and HSBC completed what was described as the first live tokenized cross-border transaction on Swift’s blockchain ledger.

Before that, Swift said its blockchain-based ledger was ready for initial use and that it was preparing to pilot tokenized cross-border payments with 17 major banks. In July, reporting noted that the pilot group included institutions such as Citi and DBS, alongside HSBC, BNP Paribas, UBS, ANZ, and Standard Chartered. Earlier coverage also tied the effort to Swift’s broader strategy for modernizing financial messaging and settlement paths.

What’s notable in the DBS-Citi weekend test is the maturity implied by moving beyond pilot-style milestones toward transactions that address real-world timing constraints. If weekend settlement becomes repeatable at scale, it could change how banks and payment operators think about cut-off times and settlement certainty for international transfers.

Citi’s parallel plan for a tokenized deposit network

DBS’s transaction also arrives amid other institution-level roadmaps for tokenized deposit infrastructure. Citi CEO David Watson, as reported by The Wall Street Journal, discussed a separate initiative in which a group of major US banks—including Citi—aim to launch a tokenized deposit network in the first half of 2027.

Watson linked the effort to The Clearing House, the US payments and clearing operator owned by banks. This suggests the industry is not placing all its bets on a single technology path. Instead, it appears to be building multiple layers: one focused on interoperable cross-border messaging and settlement, and another focused on domestic deposit token networks designed for broader interbank transfer capabilities.

For readers tracking the direction of crypto-adjacent finance, the coexistence of these efforts is important. Swift’s Digital Ledger work centers on cross-border settlement mechanics through a messaging network, while the Clearing House plan points toward a more US-centric network of tokenized deposits. Together, they reflect how large institutions may pursue both interoperability and network effects as they move from prototypes to operational systems.

Ongoing collaboration between major banks on tokenization frameworks

The industry momentum also includes collaboration frameworks between banks aimed at establishing compatibility across deposit token ecosystems. In November 2025, reporting highlighted that DBS and JPMorgan unveiled plans to develop a blockchain-based tokenization framework enabling onchain transfers between their deposit token environments, with the stated goal of moving toward an industry standard for cross-bank payments.

While these announcements do not guarantee full interoperability across all banks or across different tokenization platforms, they do indicate a shared theme: large financial institutions see tokenization as a way to reduce friction in transfers without necessarily replacing deposits with entirely new asset classes. The closer the industry gets to standardized frameworks, the easier it becomes for participants to connect systems and reduce settlement bottlenecks.

DBS’s Monday announcement tied the weekend transaction directly to the benefits of 24/7 settlement ability, reinforcing the idea that the value proposition is operational rather than speculative.

What to watch next

As Swift and major banks move from pilot milestones to repeatable live usage, the key question for the market is whether tokenized cross-border payments can sustain faster settlement reliably at scale—especially across weekends and holiday periods—while aligning with longer-term plans for tokenized deposit networks. The next updates from banks and Swift will likely focus on throughput, operational controls, and whether improvements in minutes translate into broader day-to-day savings for international payments.