Date: May 15, 2025
Contact: [email protected]
WASHINGTON — A four-count superseding indictment, unsealed today in U.S. District Court, charges 12 additional people – Americans and foreign nationals – for allegedly participating in a cyber-enabled racketeering conspiracy throughout the United States and abroad that netted them more than $263 million. Several were arrested this week in California, while two remain abroad and are believed to be living in Dubai.
The superseding indictment and the arrests were announced by U.S. Attorney Jeanine Ferris Pirro, Executive Special Agent in Charge Kareem A. Carter of the Internal Revenue Service – Criminal Investigation Washington, D.C. Field Office, and FBI Special Agent in Charge Sean Ryan of the Washington Field Office Criminal and Cyber Division.
The defendants, listed below, face charges that include RICO conspiracy, conspiracy to commit wire fraud, money laundering, and obstruction of justice. The superseding indictment adds charges originally brought against Malone Lam on Sept. 19, 2024.
According to the superseding indictment, the enterprise began no later than October 2023 and continued through March 2025. It grew from friendships developed on online gaming platforms.
Members of the enterprise held different responsibilities. The various roles included database hackers, organizers, target identifiers, callers, money launderers, and residential burglars targeting hardware virtual currency wallets.
Database hackers hacked websites and servers to obtain cryptocurrency-related databases or purchased databases on the darkweb. Organizers and target identifiers organized and collated information across the databases to determine the most valuable targets. Callers cold-called victims and used social engineering to convince them their accounts were the subject of cyberattacks and the enterprise callers were attempting to help secure their accounts. Money launderers received the stolen crypto currency and turned it into fiat U.S. currency in the form of bulk cash or wire transfers.
According to the indictment, members and associates of the enterprise used the stolen virtual currency to purchase, among other things, nightclub services ranging up to $500,000 per evening, luxury handbags valued in the tens of thousands of dollars that were given away at nightclub parties, luxury watches valued between $100,000 and $500,000, luxury clothing valued in the tens of thousands of dollars, rental homes in Los Angeles, the Hamptons, and Miami, private jet rentals, a team of private security guards, and a fleet of at least 28 exotic cars ranging in value from $100,000 to $3.8 million.
According to the indictment, members of the enterprise laundered stolen cryptocurrency proceeds by moving the funds through various mixers and exchanges using “peel chains,” pass-through wallets, and virtual private networks to mask their true identities.
The indictment alleges that in one instance on Aug. 18, 2024, Malone Lam and contacted a victim in D.C. and, through the communications with that victim, fraudulently obtained over 4,100 Bitcoin -- worth over $230 million at the time. In another instance in July 2024, Malone Lam and others are accused of stealing over $14 million in cryptocurrency from an additional victim.
The indictment alleges that members of the enterprise also committed home break-ins. As alleged in the Indictment, Marlon Ferro traveled to New Mexico in July 2024 and broke into a victim’s home to steal their hardware virtual currency wallet while Lam monitored the victim’s location by logging into his iCloud account.
The superseding indictment also alleges that the enterprise engaged in significant money laundering activity. Kunal Mehta, Hamza Doost, Joel Cortez, and Evan Tangeman are alleged to have engaged in unlicensed crypto-to-cash services for the enterprise, obtained luxury rental homes for members of the enterprise using fake identity documents, booked private jet travel with stolen cryptocurrency for the enterprise, concealed ownership of exotic cars by registering them in shell company names, and shipped bulk cash through U.S. mail to members of the enterprise hidden in Squishmallows stuffed animals.
Following his arrest in September 2024 and continuing while in pretrial detention, Lam is alleged to have continued working with members of the enterprise to pass and receive directions, collect stolen cryptocurrency, and to have enterprise members buy luxury Hermes Birkin bags and hand deliver them to his girlfriend in Miami, Florida.
This ongoing investigation is being handled by the U.S. Attorney’s Office for the District of Columbia, the IRS-Criminal Investigation Washington D.C. Field Office, and the FBI’s Washington Field Office. Significant investigative and operational support was provided by the FBI’s Los Angeles and Miami field offices.
The matter is being prosecuted by Assistant United States Attorney Kevin Rosenberg, Acting Deputy Chief of the Fraud, Public Corruption, and Civil Rights Section of the U.S. Attorney’s Office for the District of Columbia.
If found guilty, the defendants’ sentences will be determined by the court based on the advisory Sentencing Guidelines and other statutory factors.
IRS-CI is the criminal investigative arm of the IRS, responsible for conducting financial crime investigations, including tax fraud, narcotics trafficking, money-laundering, public corruption, healthcare fraud, identity theft and more. IRS-CI special agents are the only federal law enforcement agents with investigative jurisdiction over violations of the Internal Revenue Code, obtaining a 90% federal conviction rate. The agency has 20 field offices located across the U.S. and 14 attaché posts abroad.