
Suspects allegedly targeted the musician's home in search of a cold wallet containing Bitcoin
AI-generated summary
The incident occurred on September 1 in Atizapán de Zaragoza. It highlights a trend of physical violence targeting cryptocurrency holders.
Mexican prosecutors allege two men targeted the home of Camilo Séptimo keyboardist Jonathan Meléndez in search of a cold wallet they believed contained millions of dollars in Bitcoin, killing the musician and three others.
According to a report by IBTimes UK, Meléndez, his pregnant wife Ana Paula Barragán, their three-year-old daughter Sofía, and 21-year-old domestic worker Aleyda Romero were found dead at the family’s home in Atizapán de Zaragoza, State of Mexico, on September 1. The couple’s six-year-old son survived.
State prosecutors said the suspects allegedly entered the home searching for a cold wallet they believed contained “million-dollar amounts in Bitcoin.”
Authorities identified the suspects as Diego Sebastián and Gerardo, using “N” in place of their surnames in accordance with Mexican privacy rules for criminal proceedings. Diego Sebastián, a business associate of Meléndez, allegedly used their relationship to gain access and offered Gerardo 2 million pesos, about $118,000, to help obtain the crypto. Both were arrested on September 2.
Cold wallets don’t store Bitcoin itself; instead, they are typically devices also known as hardware wallets, like the popular Ledger, Trezor, or the air-gapped Coldcard, that store the private keys that control access to the funds. While cold wallets protect against many online attacks, they do not eliminate physical threats, as criminals can target holders directly to gain access to their wallets.
The killings are the latest in an increase in physical attacks targeting crypto holders. Blockchain analytics firm Chainalysis documented 46 violent crypto attacks through late June, with more than $30 million stolen during the first half of 2026. Home invasions accounted for 37% of documented incidents.

The U.S. Secret Service froze $52.8 million in cryptocurrency tied to Xinbi Guarantee, a Telegram-based illicit marketplace, on September 8, working with Elliptic to identify wallets holding USDT; two wallets with ~$12 million were seized under a DOJ warrant, while Xinbi has processed at least $24 billion in transactions since 2022, making it the second-largest tracked illicit marketplace after Huione Guarantee.

Britain's National Economic Crime Centre (NECC) has elevated crypto assets to its third-highest economic crime priority. The agency is shifting toward proactive, intelligence-led operations to combat money laundering networks utilizing crypto and AI.

Singaporean national Malone Lam pleaded guilty to participating in a racketeering conspiracy that used social engineering and home break-ins to steal and launder over $245 million in cryptocurrency. The operation, formed through online gaming platforms, ran from October 2023 to at least May 2025. Lam admitted guilt before a US federal judge for one count of RICO conspiracy, nearly two years after being charged in the theft of 4,100 Bitcoin from a Washington, DC resident.

Malone Lam, a 22-year-old Singaporean, is scheduled for a plea agreement hearing in federal court in Washington on Tuesday. Prosecutors allege he organized a racketeering group that stole over $245 million in Bitcoin from a single investor through social engineering scams impersonating Google and Gemini staff, burglarized homes to steal hardware wallets, laundered funds via Monero and peel chains, and spent millions on luxury items while continuing fraud operations from Dubai.

Ireland's Criminal Assets Bureau reports organized crime gangs are renting vaults to store cryptocurrency wallet seed phrases and private keys alongside cash, luxury watches, and passports. The bureau has shared this finding with the government committee preparing for new EU anti-money laundering rules, noting that while crypto use by criminals is growing, it remains 'still quite basic' and cash dominates dirty money transactions in Ireland.

The exploiter behind the Coldcard wallet hack has moved 45% of their stolen Bitcoin through THORChain and CoinJoin. Galaxy Research reports that 18% of total stolen funds across all waves have been moved, while 82% remain in attacker-controlled addresses.