Malone Lam, $230M, and the Crypto RICO Indictment That Changed the Game
Federal prosecutors charged Malone Lam and a dozen co-conspirators with running a RICO enterprise that drained crypto wallets and spent the proceeds on Lamborghinis and Miami nightclubs. Here's how the scheme worked — and how to defend against it.
The headline number
A single victim in Washington, DC reportedly lost more than $230 million in crypto to a social-engineering attack run by the crew now charged in a federal RICO indictment. Full dossier and named defendants in our Operation Sunshine entry on the Malone Lam crypto RICO ring.
How they got in
The crew did not break any cryptography. They broke trust.
- Target identification — leaked customer-support data from a major exchange surfaced wallets with eight- and nine-figure balances.
- Spoofed support call — an operator posed as the exchange's fraud team and warned the victim of a "compromise."
- 2FA reset on a live call — the victim was walked through resetting two-factor authentication and approving a "secure transfer" to a wallet the attacker controlled.
- On-chain laundering — funds moved through mixers, instant-swap services, and shell exchanges within hours.
- Conspicuous spend — Lamborghinis, Patek Philippes, $500K bottle service at Miami and LA nightclubs.
How they got caught
The same conspicuous spending that made the crew famous in Miami nightlife also made them traceable. Wire transfers from laundering wallets to exotic-car dealers, watch shops, and event promoters created the paper trail that built the indictment. The FBI seized roughly $3 million in luxury vehicles within weeks of arrest.
Three rules every crypto holder should live by
- No exchange will ever phone you to "secure" your wallet. End the call, then call back on the number printed on the exchange website.
- Use a hardware wallet for any balance you cannot afford to lose. Private keys never touch a phone, so a 2FA reset cannot drain you.
- Treat inbound 2FA prompts as adversarial by default. If you did not just trigger a login, the prompt is the attack.
If someone has contacted you claiming to be from an exchange, search the phone number or username on scamers.org before you do anything else.