A fake Google and Gemini call delivered 94% of the thefts named in Malone Lam's plea

Four thousand one hundred bitcoin booked at more than $245 million values the coin near $59,800 ^[16], which is the price on the day the wallet emptied, 18 August 2024 ^[11], rather than a mark on anything since. The other victims named in the case add up to roughly $14.8 million, about $800,000 from a holder identified as M.C. in June 2024 and about $14 million from S.P. ^[6][15], so that single Washington, D.C. call carried 94% of the $259.8 million of thefts on the record ^[14].

What the caller needed was access to Google Drive and a set of security codes, obtained by claiming to be Google and Gemini ^[11], and Assistant U.S. Attorney Christopher Howland described the group in court as a "social engineering enterprise", as reported by Courthouse News ^[10]. The Justice Department says it grew out of relationships formed on online gaming platforms, with the work split into database hacking, target identification, fraudulent calls and laundering, plus breaking and entering when the remote approach failed ^[3].

Hong Kong's securities regulator has warned that weak approval controls and signers authorizing fraudulent transactions can undermine a custody system whether it runs on HSMs, MPC or multisignature ^[18], while a 2026 institutional survey found 66% of investors naming security and key-signing protocols as a key factor in choosing a custodian ^[19]. Those two findings sit one layer apart: buyers are grading the cryptography, and the regulator is pointing at the person who signs. That gap is where the custody-as-verification-problem reading earns its keep, or rather, the more careful version of it does, because the failure the regulator describes is procedural: a signer authorizing a transaction that should never have been approved, regardless of what protects the key material.

The New Mexico break-in and the two scam-tracking ledgers complicate that reading in different ways. The break-in that went after a hardware wallet came away with nothing ^[7], but the enterprise kept that capability precisely for calls that did not work ^[3], so a tighter phone script relocates the loss rather than deleting it. And the aggregates are two different ledgers: Chainalysis has scams receiving at least $14 billion on-chain in 2025, possibly above $17 billion as more addresses are identified ^[20], against the FBI's 181,565 cryptocurrency-related complaints and more than $11 billion in losses ^[22], which puts this one theft at about 2.2% of the FBI figure ^[17]. The 1,400% year-on-year growth in impersonation scams arrives without a stated base ^[20], and TRM Labs rating scams the only "Mature" category in its 2026 AI-in-Crime Adoption Index ^[21] is a judgment about method, not a loss share.

Lam was arrested in Miami on 18 September 2024, 31 days after the largest theft ^[4][9], and an accomplice, Evan Tangeman, was sentenced in April for laundering proceeds from the operation ^[8]. The cars Lam has agreed to surrender cover about 1.6% of that one theft ^[13]. Attribution took a month. Forfeiture recovers only a small fraction of losses this size. The money that changes the outcome is spent before someone authorizes the transaction, not recovered afterward.