Crypto Theft Ring Accused of Stealing $263M in Digital Assets

Federal prosecutors have recently unsealed a new indictment that adds 12 defendants to an already extensive cybercriminal case involving one of the largest cryptocurrency theft rings ever prosecuted in the U.S. The group, operating from various locations including California and Dubai, is accused of stealing over $263 million in digital assets using a mix of hacking, fraud, and real-world home burglaries. The criminal enterprise began no later than October 2023 and ran through March 2025, evolving from online gaming friendships into a highly coordinated cyber-theft network.

The group allegedly executed a range of roles, including database hackers, social engineers, money launderers, and even physical burglars. Their primary targets were wealthy crypto holders whose details were extracted from leaked or hacked data bought off the dark web. Stolen databases containing email addresses and crypto exchange credentials were obtained or purchased on underground markets. These datasets were then mined for high-value targets. Once identified, callers would impersonate security professionals, tricking victims into sharing credentials or confirming sensitive details. In several cases, physical surveillance and burglaries followed—one member reportedly broke into a victim’s home while an accomplice tracked their iPhone location in real-time.

Their most high-profile score was over 4,100 BTC—valued at $230 million at the time—stolen from a single victim in Washington, D.C., via a targeted social engineering scheme in August 2024. Other incidents include the theft of $14 million in crypto from a separate victim the month prior. Far from hiding in the shadows, members flaunted their gains with extravagant purchases. The indictment details spending such as up to $500,000 per night in upscale nightclubs, a fleet of 28 exotic cars worth between $100K to $3.8M each, luxury homes in Miami, Los Angeles, and the Hamptons rented with fake documents, designer items like Hermès Birkin bags, luxury watches, and high-end clothing, private jets, and a full-time team of security guards. They even used squishmallow plush toys to ship bulk cash across states and relied on mixers, peel chains, and pass-through wallets to obscure transactions and evade blockchain tracing.

Four key defendants—Kunal Mehta, Hamza Doost, Joel Cortez, and Evan Tangeman—allegedly ran unlicensed crypto-to-cash services and helped convert the stolen assets into fiat currency or luxury items using shell companies and fake IDs. Even after being arrested in 2024, the alleged ringleader Malone Lam is said to have continued orchestrating operations from jail, directing others to deliver stolen crypto and lavish gifts—including designer bags—to his girlfriend. The accused face a range of federal charges including RICO conspiracy, conspiracy to commit wire fraud, money laundering, and obstruction of justice. Arrests were carried out in California, while two suspects remain abroad—believed to be in Dubai. The U.S. Attorney’s Office for the District of Columbia, FBI cybercrime sections, and the IRS Criminal Investigation division are all involved in this multi-agency probe. Everyone is assumed innocent until court evidence shows otherwise. If convicted, sentencing will follow federal guidelines based on the nature and scale of the crimes.

This case highlights the sophistication and reach of modern cybercriminal operations, which often span multiple jurisdictions and employ a variety of tactics to evade detection and prosecution. The use of social engineering, physical surveillance, and high-level money laundering techniques underscores the need for enhanced cybersecurity measures and international cooperation in combating such crimes. The lavish spending and flamboyant lifestyle of the defendants also serve as a stark reminder of the potential rewards that drive these criminal enterprises, despite the significant risks involved. The ongoing investigation and prosecution of this case will likely have broader implications for the regulation and oversight of cryptocurrency transactions and the protection of digital assets.