Malone Lam

That is a real number. It is not a monthly rent, a car price, or an investment. It is a receipt from a single night at a nightclub in Los Angeles.

One night. One club. $569,528.39 spent — documented in a court filing, sourced to the club's management, submitted as evidence by federal prosecutors. [SOURCE: NBC News / DOJ filing]

The man who ran up that tab was twenty years old. He had arrived in the United States fourteen months earlier on a tourist visa from Singapore. He had no job, no degree, and no source of income that could be explained to a tax authority.

He had, however, recently stolen 4,100 Bitcoin from a single investor in Washington D.C. — a theft that authorities would describe as the largest known single-victim cryptocurrency heist in history. The Bitcoin was worth approximately $230 million at the time of the theft. [SOURCE: NYT, Sept 2024; DOJ]

He spent it as fast as he could. He was arrested within a month.

The neighbourhood of Choa Chu Kang sits in the western reaches of Singapore, a planned residential town of Housing Development Board flats, hawker centres, and the particular density of a city that fits six million people into seven hundred square kilometres.

Malone Lam Yu Xuan was born there on July 19, 2004. He attended Unity Secondary School in the same neighbourhood, part of the ordinary infrastructure of Singaporean education — a system that routes its students through standardised examinations toward university or polytechnic, toward careers in finance, engineering, or the professions.

He dropped out in his teens.

What he did instead was go online. The platforms were Minecraft and Discord — the spaces where a generation of young men with internet connections and time on their hands built their first social worlds, learned to read communities, and discovered that the online economy ran on different rules than the one outside.

He was good at reading those rules. By the time he was a teenager he was trading cryptocurrency — not as a hobby but as a primary activity, with the focus of someone who had decided that this was the path and everything else could wait.

By the time he was nineteen, he had decided that earning it was slower than taking it.

In October 2023, Malone Lam boarded a flight to the United States. He entered on the Visa Waiver Program — no interview, no sponsor, no questions that mattered. He arrived in Miami, moved through Los Angeles, touched the Hamptons. He started with two roommates in Texas. He had a plan.

The blockchain was not broken. It never is, in cases like this. What Malone Lam and his associates broke was something far older and more reliable than cryptography: human trust.

Social engineering is the technical term for what the group did. The plain English version: they called people and convinced them to hand over their money by pretending to be people they were not.

The target in August 2024 was a wealthy early Bitcoin investor in Washington D.C. — a Genesis creditor whose holdings had been accumulating since the early days of the network, some of the Bitcoin reportedly dormant since 2012. [SOURCE: ZachXBT/@zachxbt; DOJ] The kind of investor whose wallet, if you could access it, represented a number most people would not see in a lifetime.

In August 2024, the scheme reached its peak. More than 4,100 Bitcoin transferred from a single investor. Worth approximately $230 million at the time. The largest known single-victim cryptocurrency theft in history. [SOURCE: Courthouse News, Oct 2024; DOJ]

Lam and his co-conspirator Jeandiel Serrano celebrated. They did not do this quietly.

They live-streamed it. On a Discord voice chat, to friends, they watched the Bitcoin arrive. 'Oh my god! 243 million dollars! Yes!' [SOURCE: ZachXBT; reported by NYT, NBC News] During the stream, one participant's screen inadvertently displayed his real Windows username. A separate recording showed another participant being referred to by his first name. These were the threads that would unravel everything.

He did not hide the money. He displayed it. With the same instinct that drove Hushpuppi to post every watch, every car, every front row — Malone Lam converted 4,100 Bitcoin into the most visible lifestyle money could buy, as fast as it was physically possible to spend it.

Within weeks of the theft, he was in Los Angeles. The clubs in LA told investigators that Lam had been trying to pay his tabs in cryptocurrency and was spending approximately $400,000 to $500,000 per night. [SOURCE: NBC News / DOJ filing] One receipt entered into evidence showed a single night's tab of $569,528.39. [SOURCE: NBC News / court filing]

He bought 31 luxury vehicles. [SOURCE: DOJ — prosecutors' own figures] Among them:

The prosecution noted that 'many of Lam's vehicles have not been located as of yet, such as his Pagani Huayra that he purchased for $3,800,000.' [SOURCE: NBC News quoting DOJ filing] Twenty-two of the thirty-one cars remained unrecovered. The money had physically disappeared into metal and carbon fibre and been driven away.

The Hermès Birkin is a handbag that starts at approximately $10,000 for the most basic configuration and climbs from there — to $20,000, to $50,000, to prices that require an invitation from the house to spend. It is an object that carries its price in its scarcity, its waitlist, its deliberate exclusivity.

Malone Lam gave them away at nightclubs.

Five Hermès Birkin bags, worth approximately $20,000 each, handed to women he met at clubs. [SOURCE: The Droid Guy reporting on DOJ filing] Not as gifts in the romantic sense — as favours, as calling cards, as the currency of a man who had decided that money was the language and he was fluent.

One woman reportedly received a Birkin after chatting with him for ten minutes. Another found one on her nightstand. The bags were sourced, paid for, and distributed as casually as most twenty-year-olds buy rounds of drinks.

Then there was the Lamborghini.

A pink Lamborghini Urus. Gifted — or attempted to be gifted — to a woman on Instagram as a means of winning her back or winning her over, the record is not precise on which. Her response, documented in reporting: 'I am taken once again.' [SOURCE: The Droid Guy] The car, reportedly, was still sent. She still declined. The Lamborghini sat somewhere, ungifted, as a monument to the specific failure of money to solve problems that money did not create.

And then there were the Birkins sent to his girlfriend after he was arrested.

This is documented in the IRS Criminal Investigation press release and the DOJ superseding indictment. Following his arrest in September 2024, while in pretrial detention, Lam allegedly continued working with members of the enterprise — directing them to buy luxury Hermès Birkin bags and hand-deliver them to his girlfriend in Miami, Florida. [SOURCE: IRS/DOJ Nov 2025 press release; DOJ superseding indictment]

He was in a detention cell. He was still ordering Birkins. From prison. For delivery. To Miami.

On September 10, 2024, Malone Lam boarded a private jet from Los Angeles to Miami. He had spent weeks in LA accumulating receipts, cars, and attention. Now he moved the operation to Florida.

In Miami, he rented multiple homes. One was on Hibiscus Island — a private island in Biscayne Bay accessible only by a guarded causeway, where the houses sit behind gates and the water is visible from every window. Another was near the water. A third was a luxury mansion with ten bedrooms and ten bathrooms — the kind of property typically used, the reporting notes, by actors, businessmen, and politicians. [SOURCE: The Droid Guy / NBC News]

The monthly rent on one of the Miami properties: $68,000. [SOURCE: NBC News / DOJ filing — Malay Mail]

He was twenty years old. He had been in the United States for less than a year. His visa had expired.

The enterprise was not just renting property in his own name. Co-conspirators obtained luxury rental homes for members of the enterprise using fake identity documents. [SOURCE: IRS/DOJ superseding indictment] They booked private jet travel with stolen cryptocurrency. They concealed ownership of exotic cars by registering them in shell company names. They shipped bulk cash through US mail to members of the enterprise — hidden inside Squishmallows stuffed animals. [SOURCE: DOJ superseding indictment, Nov 2025]

The Squishmallows detail is in the federal indictment. Bulk cash, mailed across the country, packed into stuffed animals.

It started with two roommates in Texas.

By the time the superseding indictment was filed in November 2025, the network had grown to Lam plus twelve others — fourteen people in total, operating across California, Connecticut, New York, Florida, and overseas. [SOURCE: DOJ superseding indictment Nov 2025; IRS Criminal Investigation]

The enterprise had specialised roles. Some members ran the unlicensed crypto-to-cash conversion services that turned stolen Bitcoin into spendable dollars. Others obtained the rental properties using fake identities. Others booked the private jets. Others — this is in the indictment — hid the cash in the stuffed animals and mailed it.

The operation had gone from two roommates to a structured criminal enterprise with a supply chain, a logistics function, and a money laundering operation that the DOJ would ultimately charge under RICO — the Racketeer Influenced and Corrupt Organizations Act. The first Bitcoin-related RICO case in American legal history. [SOURCE: DOJ Sept 2026 press release; BBC]

In July 2024, the group expanded into physical crime. Marlon Ferro traveled to New Mexico and broke into a victim's home to steal their hardware cryptocurrency wallet while Lam monitored the victim's location by logging into their iCloud account remotely. [SOURCE: DOJ indictment] They had gone from calling people to burglary. The network was arming itself.

While Malone Lam was spending $569,528 in a single night at an LA club, a pseudonymous blockchain investigator who goes by ZachXBT was watching the Bitcoin move.

ZachXBT is a former crypto scam survivor who became, by reputation, the most effective private blockchain forensics investigator in the industry. He operates under a pseudonym, has never revealed his real name, and maintains a following of hundreds of thousands of people who track his work exposing fraud in the cryptocurrency space. He is, in the context of this case, the person the story turns on.

On the day of the August 2024 theft, ZachXBT was in transit when he saw the blockchain movement. He began tracking. The stolen funds split into three main flows — he identified three suspects. He posted publicly on X (formerly Twitter) that a theft was occurring. He received a tip from an informant with leads on the hacker's identity. For the following week he worked through the night, sleeping four to five hours a day, sharing his findings directly with law enforcement. [SOURCE: ZachXBT reporting compiled by Chaincatcher/Bitget; ZachXBT @zachxbt on X]

Then he found the video.

A 90-minute recording of the Discord session during the heist — the voice chat in which Lam, Serrano, and others had celebrated as the Bitcoin arrived. During the stream, one participant's Windows screen had briefly displayed his real username. People on the call referred to others by their first names. 'Oh my god! 243 million dollars! Yes!' [SOURCE: ZachXBT; reported by multiple outlets including TradingView News, NYT]

ZachXBT posted the recording. He identified three suspects. He shared everything with law enforcement.

The mechanism of exposure was the same mechanism that had made Hushpuppi vulnerable: the compulsion to share the moment. To have an audience for the win. To let people see. Lam and Serrano had streamed themselves committing the largest single-victim cryptocurrency theft in history, and that stream had been obtained, posted publicly, and delivered to the FBI by a man on a plane watching the blockchain move in real time.

On September 18, 2024, an off-duty police officer tipped off Malone Lam that the FBI was coming.

What he did with this information: he threw his mobile phone into Biscayne Bay. [SOURCE: Wikipedia citing primary reporting; DOJ record] Not into a bin, not wiped and handed to a friend, not left in a hotel room. Into the water. Biscayne Bay, which is a body of water, into which he threw the device that contained whatever he believed the FBI most needed to find.

The FBI arrived at the mansion on Hibiscus Island anyway. Lam was there. He was arrested. The phone was in the bay.

Jeandiel Serrano was arrested the same day at Los Angeles International Airport — returning from a holiday in the Maldives with his girlfriend. [SOURCE: Malay Mail / DOJ]

The network continued operating without them. Through the autumn of 2024, through the winter, through the spring of 2025. The superseding indictment in May 2025 named Lam plus twelve others. By May 2026, nine of the thirteen defendants had pleaded guilty. Some agreed to testify against Lam. [SOURCE: DOJ press release May 2026]

And Lam, in pretrial detention, allegedly continued directing the enterprise from inside. The Birkins sent to his girlfriend in Miami were not an act of romance. They were evidence, documented in a federal indictment, that he was still running the operation from a detention cell. [SOURCE: IRS/DOJ Nov 2025]

This is the case that explains why the METRIC row exists on every TraceChain card.

The lesson: 4,100 Bitcoin from one victim is the only figure that does not change depending on when you measure it. Every dollar figure in this case is a dollar figure measured at a specific moment on a specific exchange. Lead with the BTC. Label the dollars.

On September 8, 2026, Malone Lam Yu Xuan pleaded guilty in the US District Court for the District of Columbia to RICO conspiracy.

The charge — the Racketeer Influenced and Corrupt Organizations Act — was not designed for cryptocurrency. It was designed for organised crime. For the Mafia. For enterprises that operate as ongoing criminal organisations across multiple states, with structured roles and coordinated operations. The DOJ determined that what Lam had built, in less than two years from two roommates in Texas, qualified. [SOURCE: DOJ Sept 2026 press release; BBC]

It was the first Bitcoin-related RICO prosecution in American legal history.

The DOJ press release was headlined: 'Singaporean Ringleader of $245 Million Cryptocurrency Racketeering Enterprise Pleads Guilty.' [SOURCE: DOJ/US Attorney DC, Sept 8, 2026]

Lam appeared in court in a green prison jumpsuit. A status hearing was scheduled for December 2026. He has not yet been sentenced as of this writing. He faces up to 20 years. [SOURCE: DOJ; Malay Mail]

Singapore is a country with a specific relationship to crime and consequence. The legal system is strict, the consequences are public, and the national mythology around meritocracy and order runs deep enough that a twenty-year-old from a Choa Chu Kang HDB block committing the largest single-victim cryptocurrency theft in history and spending it in Hollywood nightclubs was not a story the country could process quietly.

The Straits Times — Singapore's newspaper of record — covered the case extensively, running multiple stories at different dollar figures as the investigation developed. The Business Times reported on the plea. The coverage was not congratulatory. It was, in its own way, a reckoning with what it meant that one of their own had left, had reached, and had been caught.

He was, by most measures, a dropout from a respectable neighbourhood who had found a way to make the system irrelevant to him. The school he had left — Unity Secondary — is not a school that produces criminals. It produces engineers, managers, the ordinary working population of a city-state built on competence and order.

He found a different order. It lasted fourteen months in the United States before the blockchain gave him up.

Case 001 was about the flex as evidence. Hushpuppi posted his way into a federal case file. He turned his Instagram into the prosecution's exhibit list.

Case 002 is the same story told in a different register. Malone Lam did not build an Instagram persona over nine years. He was twenty years old. He had no patience for nine years of careful brand-building. He had 4,100 Bitcoin and a phone and the specific generational instinct to share the moment — to stream it, to show it, to let the people in the Discord chat see.

The live-stream of the heist. The Discord where people referred to each other by name. The Instagram posts that let ZachXBT track his location through his girlfriend's location tags. The $569,528 receipt that is now a court exhibit. The Squishmallows stuffed with cash. The pink Lamborghini.

Every element of the story is evidence. Every element of the evidence was content.

In Case 001, the persona was built over years and then dismantled by the prosecution. In Case 002, the persona lasted months — barely long enough to buy all the cars. The speed compressed the arc but did not change its shape. The instinct was identical: to take the money and make it visible, to have an audience for the arrival, to let the world see what you had reached.

Hushpuppi sat in the front rows of Paris fashion weeks and built a brand that 2.5 million people believed in for nine years before the FBI arrived.

Malone Lam threw a phone into Biscayne Bay and was arrested within a month.

$569,528.39.

One night. One club. One receipt that is now a line in a federal court filing in the District of Columbia. [SOURCE: NBC News / DOJ]

The Pagani Huayra is somewhere. Twenty-two of the thirty-one cars have not been located. The phone is in Biscayne Bay. The Birkins were delivered to a woman in Miami by people following instructions from a detention cell. The Bitcoin is partly recovered — approximately $70 million frozen or recovered as of October 2024 — and the rest is still in the trail. [SOURCE: Malay Mail / DOJ]

He was twenty years old when he stole it. He will not be free for most of his twenties.

The blockchain detective who caught him was on a plane when the Bitcoin started moving. He posted his findings publicly. He worked through the night. He found the video of two men celebrating in a Discord call. He delivered the evidence to the FBI.

Twenty-two cars still missing. One phone in the bay. A girl who said no to the Lamborghini. Nine co-defendants who said yes to the prosecutors.

All figures labelled by what they measure. Dollar amounts vary by source — see Part 9. The stable anchor throughout is 4,100 BTC from one victim. Lam has pleaded guilty; sentencing has not yet occurred as of this writing.