
AI-generated summary
The Social Engineering Enterprise grew out of friendships formed in online gaming and used stolen crypto databases to identify targets. The group employed social engineering tactics, including impersonating tech support from Google and Gemini, to gain access to victims' cryptocurrency wallets.
In brief
Malone Lam, 22, is due in federal court in Washington on Tuesday for a plea agreement hearing.
Prosecutors say callers posing as Google and Gemini staff talked a Washington investor out of more than 4,100 BTC.
The same indictment describes a racketeering group that also burgled homes to steal hardware wallets.
Malone Lam, the 22-year-old Singaporean whom prosecutors identify as an organizer of the crew that took $245 million in Bitcoin from a single investor, is due in federal court in Washington on Tuesday for a plea agreement hearing.
A man named in court filings only as Victim-7 was at home in Washington when callers claiming to be from Google and Gemini warned him his accounts were under attack. They talked him into installing remote desktop software and surrendering his security codes, then moved more than $245 million in Bitcoin out of his wallets.
The indictment charges 18 people as a racketeering group it calls the Social Engineering Enterprise, with roles running from database hackers to callers to money launderers. It grew out of friendships formed in online gaming and worked from stolen crypto databases to pick targets. When a victim kept coins on a hardware wallet, prosecutors say, members flew to the house and broke in.
Rivals came for the family
Word of the score spread, and the crew became targets themselves. A week later, co-defendant Veer Chetal's parents were driving in Danbury, Connecticut, when a car rammed their Lamborghini and men pulled up in a van, beat the couple and tied them up, meaning to extort Chetal for his share. Eyewitnesses called police, and an off-duty FBI agent happened to be driving past.
The money itself went into Monero through exchanges that ask for no identification, then through peel chains, prosecutors say. Cash came back in bulk, some of it shipped across the country inside stuffed toys. Lam spent $4 million at Los Angeles nightclubs in a month and bought more than 30 cars, titling them to a shell company called Crypto Administration LLC.
Members relayed messages to and from Lam in a Miami jail, funded his defense with fraud proceeds, and were still attempting social engineering attacks from Dubai in early 2025, discussing them in coded language about "playing tournaments," according to the indictment.
AI outlook — possibilities, not facts
Malone Lam will enter a plea agreement during Tuesday's hearing.
Likely · Within days
Additional legal actions may be taken against other members of the Social Engineering Enterprise.
Possible · Within weeks

Ireland's Criminal Assets Bureau reports organized crime gangs are renting vaults to store cryptocurrency wallet seed phrases and private keys alongside cash, luxury watches, and passports. The bureau has shared this finding with the government committee preparing for new EU anti-money laundering rules, noting that while crypto use by criminals is growing, it remains 'still quite basic' and cash dominates dirty money transactions in Ireland.

The exploiter behind the Coldcard wallet hack has moved 45% of their stolen Bitcoin through THORChain and CoinJoin. Galaxy Research reports that 18% of total stolen funds across all waves have been moved, while 82% remain in attacker-controlled addresses.

A FinCEN analysis identified $12.7 billion in cryptocurrency transactions tied to overseas scam centers, based on over 33,000 reports from September 2023 to December 2025. The scams included pig butchering, romance schemes, and fake crypto investment offers. Officials noted the operations are largely run by transnational criminal groups in Southeast Asia, with Myanmar and Cambodia pursuing legislation to criminalize such centers.

The United States and United Kingdom have formed a joint law enforcement alliance targeting scam centers involved in crypto and cyber-enabled investment fraud. The agreement, signed by the US Attorney’s Office for the District of Columbia, the Crown Prosecution Service of England and Wales, and the UK National Crime Agency, enables parallel investigations, information sharing, and coordinated prosecutions. It expands the Scam Center Strike Force launched in November 2025 and builds on prior international operations, including a Dubai-led raid that resulted in 276 arrests. The initiative responds to rising US losses from crypto investment fraud, which reached $8.65 billion in 2025.

The FBI seized Hamas-linked fundraising infrastructure and used it to intercept cryptocurrency donations intended for the group, building on earlier court-authorized seizures that recovered over $560,000 in digital assets. The operation involved working with Tether and Binance to redirect funds and leveraged seized domains and servers to trace and disrupt donations, turning a retrospective tracing effort into an active disruption operation.

Ukraine's National Police and Security Service dismantled a criminal network operating fake crypto investment platforms. The group, led by a 25-year-old IT specialist in Kyiv, defrauded victims in over 20 countries, stealing up to $1 million per month.