A quarter of a billion dollars in bitcoin, taken by telephone

Nobody broke any cryptography.

Malone Lam pleaded guilty on 8 September to one count of federal racketeering conspiracy, over an international scheme that stole and laundered more than $245 million of cryptocurrency. He is twenty-two and faces up to twenty years. Judge Colleen Kollar-Kotelly set a status hearing for 8 December.

The method deserves more attention than the number. In August 2024 two of Lam's alleged co-conspirators telephoned a man in Washington, said they were from Google and from the Gemini exchange, talked him into handing over access to his Google Drive, and got his security codes out of him. Lam then moved more than 4,100 bitcoin.

A quarter of a billion dollars, taken by phone.

The thing that failed was a person on a call

No exchange was hacked here. And no bridge was exploited, no signature forged, no wallet defeated. The victim's keys did exactly what keys are built to do.

What failed was a man answering his phone, and that is the failure mode no better wallet has ever fixed. So it is also why the industry's security spending keeps missing the largest single incident in its own history.

Work the arithmetic, while you are here. Those coins at that total price bitcoin around $59,750 apiece at the time, which tells you how far this story has been marked to market since.

Then he spent it in public

What came next reads like a script nobody would greenlight. Prosecutors say Lam laundered the proceeds into a fleet of sports cars (one of them valued at $3.8 million), rented mansions in Miami, Los Angeles and the Hamptons, luxury handbags and watches, and nightclub evenings running close to half a million dollars each. One night at a Los Angeles club came to $569,000.

That is roughly nine and a half stolen bitcoin, spent between dinner and closing time.

FBI agents arrested him at his Miami rental home in September 2025, exotic cars in the driveway. The indictment says an off-duty law enforcement officer had tipped him off that they were on their way. From jail, on a recorded call, he told associates: "We always talked about what it would be like if I were to go down, but never thought it would be this crazy."

So where is the money?

Neither account we read carries a recovery figure, and that silence is the part we would push on.

Eighteen defendants have been charged and eleven have now pleaded guilty (Lam is the eleventh). Evan Tangeman, also twenty-two, was sentenced in April to more than five years. A case this well documented, with this many cooperating defendants and this much conspicuous spending, is probably about the best conditions American law enforcement will ever get for clawing money back.

And we would still expect the recovery to come in poor, with the number arriving at sentencing rather than before. Our marker is a forfeiture figure under half the $245 million, and we would be pleased to be wrong about it. If prosecutors announce more than that, it changes what a large theft is worth attempting, and every threat model in this industry should be rewritten around the new answer.

One detail keeps catching us. Lam is described as an eighth-grade dropout who came to the United States from Singapore. US Attorney Jeanine Pirro called the operation a cybercrime empire, and said he "led an international network that preyed on victims through deception."

But the tooling was a phone, a script and somebody else's Google account.

What would you have done on that call?