The US just got its first RICO conviction for a $245 million crypto theft
A 22 year old just became the face of the first case the US Department of Justice has ever built entirely on a cryptocurrency theft under racketeering (RICO) law. He never hacked a wallet. He talked his way into one, over the phone. The number: more than 4,100 Bitcoin, roughly $245 million, gone in a matter of hours.
Malone Lam, a 22 year old Singaporean national who recently lived in Miami, pleaded guilty this week to a single count of racketeering conspiracy in federal court in Washington, D.C. Prosecutors say Lam was the ringleader of a network that stole more than 4,100 Bitcoin, worth roughly $245 million, from a single victim. It is, according to the Department of Justice itself, the first federal RICO case built entirely around a cryptocurrency theft. Eighteen people have been charged in the wider scheme, which ran from late 2023 into mid 2024. Lam faces up to 20 years in prison; the judge accepted the plea without setting a sentencing date and scheduled a status hearing for December 8, 2026.
The method matters more than the amount here. Nobody exploited a bug in a wallet or broke a private key. The scheme started with a fake alert about unauthorized account access. When the victim, alarmed, looked for help, another member of the network reached out posing as Google or Gemini support staff and walked the victim through handing over control of the accounts, step by step. There was no technical exploit. There was a convincing phone call.
| Warning sign (social engineering) | What legitimate support actually does |
|---|---|
| They contact you first about suspicious activity on your account | Never reaches out first asking for access to your account or wallet |
| They ask you to share a private key, seed phrase or verification code | Never asks for your private key, seed phrase or password |
| They pressure you to act immediately to avoid "losing your funds" | Does not create artificial urgency or rush you on the phone |
| They ask you to install remote access software or click a link | Never requires installing remote control tools |
The proceeds did not stay hidden. Prosecutors say the money funded more than 30 exotic cars, a $2 million watch, mansions, private jets and a single night at a Los Angeles nightclub that cost $569,000. That visibility had consequences beyond the criminal case: weeks after the original theft, a separate group of attackers attempted to kidnap family members connected to someone tied to the case, in a failed extortion attempt, believing they had access to the stolen money. The attackers were arrested quickly. The episode still confirms something we repeat with every case like this: crypto wealth that becomes visible, through cars, watches or conspicuous spending, stops being only a digital target and becomes a physical one, for you and for your family.
- Verify through your own channel: if you get an alert from an exchange or platform, contact it yourself through the official channel, never the number or link given to you in the message.
- Split custody: no meaningful balance should depend on a single key that a single person could be pressured into handing over.
- Legal structure, not just technical: holding significant positions through an entity or a trust, rather than a personal wallet, adds a layer of decision making that a phone call cannot skip.
- Separate your identity from your wealth: the easier it is for anyone to know how much you have and where you live, the easier you are to locate, for a scammer and for a criminal alike.
Get your crypto structure reviewed in 3 minutes
Our AI co-founder reviews how your digital wealth is custodied and your personal exposure, free, no obligation. If your case warrants it, the strategic consultation with a written opinion is $1,499 USD.
Start my diagnostic →None of this is solved by being permanently suspicious of every call, that is not sustainable. It is solved by a structure that assumes, from the design stage, that someone will eventually try to trick you, and makes sure that attempt cannot cost you everything at once.
Frequently asked questions
Is it legal to keep all my crypto in a single personal wallet?
Yes, it is legal. The issue is not legal, it is a risk issue: a single wallet under your exclusive control is a single point of failure. If you are tricked through social engineering, you lose access to everything at once, exactly what happened to the victim in this case. Splitting custody and adding an institutional or legal layer reduces that risk without making anything you do illegal.
What is social engineering as it applies to crypto?
It is the tactic of tricking a person, not a system, into voluntarily handing over access to their accounts. In the Malone Lam case, the network sent fake suspicious activity alerts and then posed as Google or Gemini support to walk the victim into giving up control. There was no technical hack, there was a credible story delivered over the phone.
How do I protect myself from a crypto social engineering attack?
The simplest rule: no legitimate support contacts you first asking for your key, your seed phrase or remote access to your device. If you get an alert, verify on your own, going directly into the platform or calling the official channel you already knew, never the one given to you in the message. Combining that with split custody and legal structure is what actually reduces the risk.
What does this case have to do with international tax planning?
More than it seems. Holding meaningful crypto wealth through an entity or a trust, in the right jurisdiction, does not just organize your tax situation, it also adds a layer of decision making and privacy between your public identity and your funds, exactly what the victim in this case lacked. Properly designed wealth structure and tax structure solve both problems at once.
Your first analysis is free
Answer a few questions and get a preliminary read on your case from our AI co-founder. No obligation, no sales calls.
Run my diagnosis →Keep reading
Kidnapped for 30 hours to steal his crypto: asset protection is not a password The IRS now tracks your wallet without a 1099-DA Asset protection for US-exposed entrepreneurs: what still works in 2026This content is informational and educational. It is not legal or tax advice. Verify current regulations and consult a specialist about your case before making decisions.