A nightclub bill exceeding $569,000 for a single evening. Around $4 million spent at Los Angeles clubs in roughly a month. Luxury cars, rented mansions and private jets. Prosecutors say the money behind that spending came from more than 4,100 bitcoin taken from one investor.
The case involves Malone Lam, a Singaporean who was 20 when the alleged theft occurred in August 2024. Now 22, he is expected to plead guilty, according to the Associated Press’s September 7, 2026 report. Eighteen people have been charged in the wider case. The latest development concerns the anticipated plea; the theft itself happened two years earlier. Associated Press report
How did the attackers get access to so much bitcoin? Prosecutors described a sequence of calls in which members of the group impersonated Google technical support and then support staff at Gemini, the cryptocurrency exchange. They presented themselves as people dealing with a security problem and persuaded the investor to disclose information and grant access. Court reporting on the prosecution’s account
That sequence helps explain what “social engineering” means in practice. The caller first creates a credible reason to worry, then offers to resolve the problem. Once the account holder accepts that premise, a request to “verify” something can become a way to obtain control of the account.
Years of experience holding crypto do not necessarily prepare someone for a convincing impersonation attempt. A person worried about losing assets may focus on completing the supposed recovery process. The danger is that each instruction can give the attacker more access while making the victim feel closer to safety.
In this kind of scam, the attempt to protect the money becomes the route by which control is surrendered.
The alleged theft was followed by a separate effort to move and spend the proceeds. The Justice Department’s original announcement described transfers through exchanges, mixing services and intermediary wallets. It said the proceeds funded travel, nightclubs, luxury cars, watches and rental homes. September 2024 Justice Department announcement
The prosecution also reached people involved in converting and spending the stolen funds. Evan Tangeman, who helped turn stolen cryptocurrency into cash and arrange luxury rentals for the group, was sentenced to 70 months in prison in April 2026. His case shows how the investigation extended beyond the people making the fraudulent calls. April 2026 Justice Department announcement
Reports that Lam could face “at least 14 years” need context. The AP attributes that figure to a prosecutor’s early estimate of the applicable sentencing guidelines at his first court appearance. It is not a sentence the court has already imposed. Associated Press report
For an account holder, the practical response to an unexpected security call is to pause the requested steps and check independently through the official app or a verified website. Gemini’s published guidance says it will not ask for a password or two-factor authentication code, or request remote access to a customer’s computer or phone. Gemini’s official safety guidance
Urgency is a reason to verify who is speaking before letting that person direct what you do with an account holding your assets.
← Back to Upwell Insights