A Crypto Crime Wave Unravels
Federal authorities have charged twelve additional individuals in connection with a sprawling cybercrime scheme that stole more than $230 million in cryptocurrency and laundered the proceeds through a web of crypto exchanges and mixers. The charges, filed under the Racketeer Influenced and Corrupt Organizations (RICO) Act, add to a deepening federal case that has now implicated at least 14 suspects.
The newly indicted defendants are accused of participating in a sophisticated conspiracy that involved hacking into victims’ crypto accounts, impersonating tech support agents, and using advanced digital laundering techniques to obscure their identities and financial trails. Two key suspects—20-year-old Malone Lam and 21-year-old Jeandiel Serrano—had already been arrested in September 2024. Lam, who went by aliases like “Greavys,” “Anne Hathaway,” and Serrano, known as “Box,” “VersaceGod,” and “@SkidStar,” allegedly played central roles in executing and coordinating the theft.
Inside the $230M Crypto Heist
According to court filings, the group stole over 4,100 Bitcoin—worth more than $230 million at the time—from a single victim based in Washington, D.C., on August 18, 2024. Investigators say the group targeted a creditor of the Genesis crypto exchange by spoofing phone numbers and posing as customer service agents for Google and Gemini, two major players in the crypto space.
Once contact was established, the suspects convinced the victim to reset their two-factor authentication (2FA) and share their computer screen using AnyDesk, a remote desktop application. This maneuver allowed them to access Bitcoin Core private keys and initiate the massive transfer of funds into wallets they controlled.
“An initial tracing showed $243M split multiple ways between each party before funds quickly peeled off to 15+ exchanges, immediately swapping back and forth between Bitcoin, Litecoin, Ethereum, and Monero,” said prominent blockchain sleuth ZachXBT, who worked closely with the FBI on the case.
The Faces Behind the Operation
The newly charged defendants include a mix of young adults and a 45-year-old, hailing mostly from California but also from New York, Florida, New Zealand, and undisclosed locations. Their names are
- Marlon Ferro, 19 (Santa Ana, CA)
- Hamza Doost, 21 (Hayward, CA)
- Conor Flansburg, 21 (Newport Beach, CA)
- Kunal Mehta, 45 (Irvine, CA)
- Ethan Yarally, 18 (Richmond Hill, NY)
- Cody Demirtas, 19 (Stuart, FL)
- Aakash Anand, 22 (New Zealand)
- Evan Tangeman, 21 (Newport Beach, CA)
- Joel Cortes, 21 (Laguna Niguel, CA)
- John Tucker Desmond, 19 (Huntington Beach, CA)
- Two individuals identified only by their aliases—“Chen”/“Squiggly” and “Danny”/“Meech”—remain at large and unnamed.
In addition to RICO conspiracy and money laundering, the defendants face charges of obstruction of justice and conspiracy to commit wire fraud.
A Trail of Luxury and Excess
Though the group employed virtual private networks (VPNs), “peel chains,” and pass-through wallets to obscure their tracks, prosecutors say they made fatal errors that ultimately linked them to the stolen funds. Despite converting much of the stolen crypto into Monero, a privacy-focused digital currency, investigators were able to trace key transactions back to the original theft.
Authorities revealed that the stolen crypto financed a lifestyle straight out of a Hollywood script. “Members and associates of the enterprise used the stolen virtual currency to purchase, among other things, nightclub services ranging up to $500,000 per evening,” federal prosecutors said. They also reportedly splurged on “luxury handbags valued in the tens of thousands of dollars that were given away at nightclub parties” and “luxury watches valued between $100,000 and $500,000.”
The spending spree didn’t stop there. The indictment details expenditures on designer clothing, private jet rentals, armed security teams, rental mansions in Los Angeles, the Hamptons, and Miami, and a fleet of 28 exotic cars—some worth as much as $3.8 million.
A Web of Roles in a High-Tech Heist
Authorities described the criminal enterprise as highly organized, with members assigned specific roles. These included hackers, organizers, target identifiers, callers posing as tech support, money launderers, and even residential burglars focused on stealing physical hardware wallets.
The case underscores growing concerns about crypto-related fraud and the ease with which digital assets can be stolen and laundered on a massive scale. As the investigation continues, more charges may be forthcoming, with law enforcement warning that the pursuit of all parties involved remains active.
