Twelve More Defendants Charged in RICO Conspiracy Tied to More Than $263 Million in Cryptocurrency Thefts
The Justice Department announced on May 15, 2025, that a four-count superseding indictment unsealed that day in U.S. District Court in Washington, D.C., charges 12 additional people for allegedly participating in a cyber-enabled racketeering conspiracy throughout the United States and abroad that netted them more than $263 million. Several of the defendants were arrested that week in California, while two remain abroad and are believed to be living in Dubai.
The superseding indictment and the arrests were announced by U.S. Attorney Jeanine Ferris Pirro for the District of Columbia, FBI Special Agent in Charge Sean Ryan of the Washington Field Office's Criminal and Cyber Division, and Executive Special Agent in Charge Kareem A. Carter of the Internal Revenue Service-Criminal Investigation Washington, D.C., Field Office. The defendants face charges that include RICO conspiracy, conspiracy to commit wire fraud, conspiracy to launder monetary instruments, and obstruction of justice. The superseding indictment adds to charges originally brought against Malone Lam on September 19, 2024.
According to the indictment, the enterprise began no later than October 2023 and continued through March 2025, and grew out of friendships developed on online gaming platforms. Its members held different roles: database hackers broke into websites and servers to obtain cryptocurrency databases or bought them on the dark web; organizers and target identifiers collated the information to pick the most valuable targets; callers cold-called victims and used social engineering to convince them their accounts were under cyberattack and that the callers were helping to secure them; money launderers turned the stolen cryptocurrency into bulk cash or wire transfers; and residential burglars targeted hardware virtual currency wallets.
The indictment alleges that on August 18, 2024, Lam and others contacted a victim in Washington, D.C., and through those communications fraudulently obtained more than 4,100 Bitcoin, worth more than $230 million at the time. In July 2024, Lam and others are also accused of stealing more than $14 million in cryptocurrency from an additional victim. The indictment further alleges that Marlon Ferro traveled to New Mexico in July 2024 and broke into a victim's home to steal a hardware wallet while Lam monitored the victim's location by logging into his iCloud account.
Prosecutors say the stolen proceeds bought nightclub services costing up to $500,000 an evening, luxury handbags valued in the tens of thousands of dollars that were given away at nightclub parties, luxury watches valued between $100,000 and $500,000, rental homes in Los Angeles, the Hamptons, and Miami, private jet rentals, a team of private security guards, and a fleet of at least 28 exotic cars ranging in value from $100,000 to $3.8 million. The laundering allegedly moved funds through mixers and exchanges using peel chains, pass-through wallets, and virtual private networks. Kunal Mehta, Hamza Doost, Joel Cortez, and Evan Tangeman are alleged to have run unlicensed crypto-to-cash conversion services for the enterprise, rented luxury homes for its members using fake identity documents, booked private jet travel with stolen cryptocurrency, registered exotic cars in shell company names, and shipped bulk cash to members hidden inside Squishmallow stuffed animals.
Many of the defendants are California residents: Marlon Ferro, 19, of Santa Ana; Hamza Doost, 21, of Hayward; Conor Flansburg, 21, and Evan Tangeman, 21, of Newport Beach; Kunal Mehta, 45, of Irvine; Joel Cortes, 21, of Laguna Niguel; and John Tucker Desmond, 19, of Huntington Beach, who is charged with obstruction of justice. Lam, 20, the alleged organizer, is a citizen of Singapore who lived in Miami and Los Angeles. The indictment also alleges that after his September 2024 arrest, while in pretrial detention, Lam continued to pass directions to enterprise members, collect stolen cryptocurrency, and have members buy luxury Hermes Birkin bags and hand-deliver them to his girlfriend in Miami.
The investigation is being handled by the U.S. Attorney's Office for the District of Columbia, the FBI's Washington Field Office, and the IRS-Criminal Investigation Washington, D.C., Field Office, with significant support from the FBI's Los Angeles and Miami field offices. Assistant U.S. Attorney Kevin Rosenberg is prosecuting the case. An indictment is merely an allegation, and all defendants are presumed innocent until proven guilty beyond a reasonable doubt in a court of law. (Source: U.S. Attorney's Office for the District of Columbia)
Source: U.S. Attorney's Office for the District of Columbia
Published by GSM · USA (original Chinese edition)
Photo: 图：位于华盛顿特区的 E. Barrett Prettyman 美国法院大楼正门（资料图），本案替代起诉书即向该院所在的哥伦比亚特区联邦地区法院提起。Tony Webster 摄，CC BY 2.0，经 Wikimedia Commons。 / Photo: The entrance of the E. Barrett Prettyman United States Court House in Washington, D.C. (file photo); the superseding indictment was filed in the U.S. District Court for the District of Columbia housed there. By Tony Webster, CC BY 2.0, via Wikimedia Commons.
