Federal prosecutors charge 12 individuals in $263 million crypto scheme targeting early Genesis investor

A superseding indictment unsealed on Thursday in U.S. District Court charged 12 more American and foreign nationals with allegedly taking part in a racketeering scheme that stole over $263 million in cryptocurrency.

Several were arrested this week in California, while two others are believed to be living abroad in Dubai, according to a U.S. Department of Justice release.

The defendants face charges including racketeering conspiracy, conspiracy to commit wire fraud, money laundering, and obstruction of justice. The indictment builds on charges initially filed against Malone Lam in September 2024, following the alleged theft of over 4,100 BTC a month before — worth over $230 million at the time — first disclosed by blockchain sleuth ZachXBT.

Those funds were thought to have been stolen from an early bitcoin investor and creditor of the defunct lending firm Genesis. ZachXBT worked with authorities and security firms Cryptoforensic Investigators and zeroShadow to trace the funds, describing the financial forensic investigation as "one of my best … of all time."

In a separate July 2024 incident, Lam and others allegedly stole more than $14 million in cryptocurrency from another victim.

How we got here

According to the indictment, the alleged cybercriminal enterprise began as friendships on online gaming platforms and evolved into a sophisticated crypto theft ring, operating from at least October 2023 to March 2025. Members took on specialized roles — from hacking databases and identifying high-value targets to impersonating support staff in phishing calls, laundering funds into U.S. dollars, and even breaking into homes to steal hardware wallets.

The stolen cryptocurrency funded an extravagant lifestyle that included $500,000 per evening nightclub tabs, luxury watches and clothing, private jet rentals, security guards, and a fleet of exotic cars ranging in value from $100,000 to $3.8 million, prosecutors said. To obscure their tracks, the group allegedly used mixers, "peel chains," VPNs, and fake identities to launder the funds across multiple platforms.

After his September arrest and while in pretrial detention, Lam allegedly continued coordinating with enterprise members to exchange instructions, collect stolen crypto, and have luxury Hermes Birkin bags purchased and hand-delivered to his girlfriend in Miami.

The ongoing investigation is being handled by the U.S. Attorney’s Office for the District of Columbia, the FBI, and the IRS.