One unhidden IP address at an exchange signup broke the $240 million bitcoin heist case
Eighteen defendants are charged over the August 2024 heist, and the alleged ringleader reaches a plea agreement hearing on Tuesday. Prosecutors describe laundering built to hide the money, but one account signup exposed it.
The Watch · Security desk
What happened
- Two callers, one posing as a Google representative and one as the Gemini exchange, talked a Washington investor into handing over Google Drive access and security codes on Aug. 18, 2024, and over 4,100 bitcoin left.
- Malone Lam, 22, an eighth-grade dropout from Singapore whom prosecutors call an alleged ringleader, has a plea agreement hearing set for Tuesday.
- FBI agents arrested Lam about a month after the theft, on charges that he organized the social engineering attack on the Washington, D.C., resident.
- Prosecutors say Lam, Veer Chetal and Jeandiel Serrano met in online gaming forums and had run other multimillion-dollar thefts with a similar playbook since late 2023.
- A week after the score, masked men from Miami cut off Chetal's parents in Danbury, Connecticut, beat his father with a baseball bat and bound them in a van.
Why it matters
- Who's exposed exposure Prosecutors say the victim was picked for being wealthy and a longtime crypto investor, so the qualifying condition for this attack is a discoverable reputation for holding.
- What it limits constraint The Justice Department disbanded its dedicated crypto-crime unit last year while FBI complaints of crypto investment fraud rose nearly 50% in 2025, which leaves prosecutions of this size leaning on evidence defendants create themselves.
- What doesn't add up contradiction SecurityWeek puts the take above $240 million and blockchain.news, citing Decrypt, calls it $245 million; the fixed quantity in the filings is over 4,100 coins, so the two totals imply about $58,500 versus $59,800 a coin depending on the valuation date.
- What it sets up precedent Researcher Allison Nixon, who tracks the young-hacker subculture The Com, says resources have to ramp up or the fraud spreads further; on this case's evidence, the deterrent on offer is that the winners spend loudly.
Next story · Invest · yesterday
Altcoins fell harder than bitcoin when the Kospi plunged 8% and buyers defended $80,000Confirmed3 publishers
Prosecutors say the group hired money laundering specialists to wash the bitcoin through multiple exchange platforms and convert it into government-issued cash [9]. The finding that broke the case was clerical. Serrano opened an account at a cryptocurrency exchange to hold nearly $30 million of the proceeds and failed to conceal his IP address, and investigators linked that address to a house in Encino, California, that he was renting for $47,500 a month [10][11]. He was vacationing in the Maldives when they identified him as a suspect [21].
The second evidence stream was the receipts. The defendants, a network of young men in their late teens or early 20s, bought fleets of sports cars, flew on private jets, hired security guards and rented mansions in Miami and the Hamptons [22][15]. Lam spent over $569,000 in one evening at a Los Angeles night club [13], out of roughly $4 million that he and his friends ran through LA nightclubs in one month, according to authorities [14]. One evening was about a seventh of the month's club spend [23]. Veer Chetal gifted his parents a Lamborghini and hid a duffel bag with $500,000 in cash in their laundry machine [16].
Neither account describes how investigators reached the other 17 defendants [26]. So what is public supports a narrower reading than chain analysis solving this: the identification thread runs through one exchange signup and a rented address, and the corroboration runs through a month of purchases, not through the laundering chain the group paid specialists to build [9][10][11].
That distinction shows what the next case will cost to crack. The phone script cost two callers an afternoon and returned more than 4,100 coins [5]. The evidence that answered it was generated by the defendants after the money landed, and it was perishable: an account open under a real address, a tab at a club, a car in a driveway in Connecticut.
What to watch
- Whether Tuesday's hearing produces a signed plea from Lam and what forfeiture figure it carries.
- Whether later filings show a path to the other 17 defendants that does not run through the Encino IP address.
- Whether the same two-caller script, impersonating Google and an exchange, turns up in newly charged cases.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence64
- Adoption78
- Hype gap+15
- Incentives58
- Confidence66
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
Malone Lam, 22, an alleged ringleader and an eighth-grade dropout from Singapore, has a plea agreement hearing set for Tuesday; his conviction would be a capstone for the government's investigation.
- [2]
blockchain.news reports that Malone Lam faces a plea hearing tied to a $245 million bitcoin theft case, citing Decrypt.
- [3]
A network of scammers duped a stranger out of bitcoin worth over $240 million in August 2024, described as one of the largest cryptocurrency thefts in U.S. history.
- [4]
On Aug. 18, 2024, a man identified as "Victim 7" in court filings was at home in Washington when a first caller identified himself as a Google representative inquiring about attempts to breach his account and a second caller, claiming to be from the Gemini crypto exchange, warned him of a malware attack affecting his crypto wallet.
- [5]
According to prosecutors, the callers manipulated the man into giving them access to his Google Drive and revealing security codes that allowed Malone Lam to siphon off over 4,100 bitcoin.
- [6]
Prosecutors said Lam and his friends on the calls, Veer Chetal and Jeandiel Serrano, targeted the man because he was a wealthy, longtime crypto investor.
- [7]
Charges have been brought against Lam and 17 others.
- [8]
The spending spree lasted a month before FBI agents arrested Lam on charges that he organized a "social engineering" attack on the Washington, D.C., resident.
- [9]
Once they took the man's savings, the group used money laundering specialists to wash it through multiple exchange platforms and convert virtual currency into government-issued cash.
- [10]
According to prosecutors, Serrano failed to conceal his IP address when he created an account on a cryptocurrency exchange to hold nearly $30 million in stolen crypto.
- [11]
Investigators linked the IP address to a home in Encino, California, that Serrano was renting for $47,500 a month.
- [12]
According to prosecutors, the friends met in online gaming forums and had teamed up on other multimillion-dollar thefts since late 2023 using a similar playbook.
- [13]
Lam spent over $569,000 in one evening at a Los Angeles night club.
- [14]
Authorities say Lam and friends spent $4 million at Los Angeles nightclubs in one month.
- [15]
The group purchased fleets of sports cars, flew on private jets, hired security guards and rented mansions in Miami and the Hamptons.
- [16]
Chetal gifted a Lamborghini to his parents and hid a duffel bag filled with $500,000 in cash in their laundry machine.
- [17]
A week after the theft, Chetal's parents were driving in Danbury, Connecticut, when several masked men from Miami cut them off, forced them out of their new car, beat Chetal's father with a baseball bat, shoved the couple into a van and bound their hands.
- [18]
Complaints of cryptocurrency investment fraud to the FBI rose by nearly 50% in 2025.
- [19]
Last year the Justice Department disbanded a unit dedicated to prosecuting crypto-related crimes.
- [20]
Cybersecurity researcher Allison Nixon, who has spent years tracking The Com, an underground subculture of young hackers united by the money crypto fraud can generate, said: "If we don't seriously ramp up the resources to take these people down and do it faster, then it's going to spread more and more."
- [21]
Serrano was vacationing in the Maldives when investigators identified him as a suspect.
- [22]
The scammers were a network of young men in their late teens or early 20s.
- [23]
The $569,000 single-evening nightclub tab is about 14% of the $4 million spent at Los Angeles nightclubs over the month, or roughly a seventh.
- [24]
Valuing the stolen coins at over $240 million implies roughly $58,500 per bitcoin.
- [25]
Valuing the same coins at $245 million implies roughly $59,800 per bitcoin.
- [26]
Neither source describes the investigative steps that identified the 17 defendants other than Lam.
Sources
2 independent publishers whose own reporting we read for this story.
- blockchain.newsMalone Lam: Plea Hearing Set Over $245M BTC Theft | Flash News Detail | Blockchain.News
1 article · September 7, 2026
- securityweek.comParty’s Over for Crypto Scammers Who Went on a Spending Spree After a $240 Million Bitcoin Theft
1 article · September 8, 2026
Topics and entities
Topics
- Cryptocurrency-based money laundering
- Social Engineering and Voice Phishing
- Cryptocurrency theft
- Crypto Crime Enforcement