How a Singaporean man allegedly stole US$230 million in cryptocurrency and what he spent it on

SINGAPORE: A Singaporean man who is accused of stealing and laundering US$230 million in cryptocurrency had pretended to be a Google employee to hoodwink his victim, court filings showed.

Malone Lam, 20, has been charged in the United States with conspiracy to commit wire fraud and money laundering.

Together with his co-conspirator, Jeandiel Serrano, they allegedly stole over 4,100 bitcoin – worth about US$230 million at the time – from a victim in Washington.

The scam was described as “one of the largest cryptocurrency thefts from a private individual ... in the history of the United States”, prosecutors said.

On Wednesday (Oct 23) morning Singapore time, Serrano appeared in court for a status hearing. The court heard that both the prosecution and defence were “seeking a resolution of this matter short of a trial”, court records showed.

They requested about 60 days to continue plea negotiations and will inform the court if a deal is reached before the deadline.

Court filings unsealed earlier this month detailed how Lam and Serrano allegedly carried out the scam and how they spent the money.

THE THEFT

Lam and his co-conspirator Serrano, 21, from Los Angeles, targeted the victim because they identified him as a “high-net-worth investor” from the early days of cryptocurrency.

According to court documents, substantial planning went into the scam, with a co-conspirator causing “unauthorised Google account access” notifications to be sent to the victim in the week leading up to the theft.

This person also used proxy and virtual private network (VPN) services to make it appear as if the access attempts were coming from overseas – this laid down the groundwork for the theft through “sophisticated social engineering”.

The court heard that on Aug 18, Lam and his accomplice called the victim, pretending to be Google support team members. They said there had been a hack attempt on his account and that they needed to shut it down.

The pair ultimately convinced the victim to provide the security codes to his account, before Lam allegedly accessed the victim’s OneDrive and Gmail accounts to locate the cryptocurrency assets.

He also “further scoured” the victim’s private accounts looking for additional information, court documents showed.

Lam found Gemini cryptocurrency exchange records in the victim’s Google accounts. 

The conspirators agreed that one of them should call the victim back and pose as a Gemini security team member to convince the victim that his cryptocurrency accounts had also been compromised.

Initially, they allegedly convinced the victim to transfer about US$3 million of cryptocurrency to a crypto wallet controlled by Lam.

They then asked the victim to download a remote desktop connection program for his own security. This program gave Lam and Serrano real-time access to the victim’s computer.

Serrano purportedly continued to manipulate the victim into opening several files, including those with private keys to over 4,100 bitcoin.

While Serrano continued to speak with the victim, Lam used the access keys to steal the bitcoin.

Prosecutors said they have screen recordings capturing Lam using the “$$$” Telegram handle and “Anne Hathaway” Discord display name to discuss strategies to manipulate the victim. 

Serrano used the online monikers “VersaceGod” and “@SkidStar”.

Authorities said they have numerous documents and photos linking the $$$ Telegram handle to Lam.

One of the photos is of Lam with a new white sports car, with his name painted on the side. He sent this photo to his friends using the $$$ Telegram handle.

In a police interview, Lam also admitted to using the $$$ Telegram handle, committing cryptocurrency theft and dividing up the stolen funds, as well as laundering these funds through cryptocurrency exchanges.

Serrano allegedly created an account on TradeOgre, a digital currency exchange, and made a deposit of about US$29 million worth of virtual currency.

He did not use a VPN when he created the account, and records from TradeOgre showed that the account was created from an IP address registered to Serrano’s home in Encino, California, which was being rented at US$47,500 per month.

WHAT LAM DID WITH THE MONEY

Lam went on a spending spree following the theft, the court documents showed.

“Government surveillance captured (Lam) at Los Angeles nightclubs spending hundreds of thousands of dollars per night, and gifting handbags valued at tens of thousands of dollars,” a law enforcement officer told the court, according to court documents.

Management at the nightclubs said that Lam tried to pay in cryptocurrency and was spending about US$400,000 to US$500,000 per night.

The prosecution also has a receipt from a Los Angeles nightclub where Lam spent US$569,528.39 in one night.

Lam also apparently bought a “collection of luxury automobiles”, some costing as much as US$3 million. They included custom Lamborghinis, Ferraris and Porsches.

According to the court documents, Lam admitted to buying 31 luxury cars, 22 of which had yet to be found as of Sep 24. One of those still missing is the car with “Malone” painted on its side.

On Sep 10, Lam flew on a private jet from Los Angeles to Miami to continue his spending spree.

He rented multiple homes in Miami, including one on Hibiscus Island and two other luxurious homes near the water. One of those homes had a monthly rent of US$68,000.

In Miami, Lam continued to spend money in nightclubs, as well as on jewellery and cars.

ARRESTS

Serrano was arrested at Los Angeles International Airport on Sep 18 when he arrived home from a holiday in the Maldives with his girlfriend.

Despite being told by the Federal Bureau of Investigation that the “only way to make the situation worse would be for her to call Serrano’s associates and tip them off”, Serrano’s girlfriend told Lam about the arrest.

The Singaporean man immediately deleted his Telegram account. 

Lam was arrested on the same day in Miami.

From two of his houses in Miami, officers seized nine cars and luxury watches, one of which cost US$1.8 million. They also found bills of sale for some of these cars. 

In a police interview, Lam admitted to carrying out additional hacks and making millions from those separate cryptocurrency fraud schemes.

REMANDED

Lam has no legal status in the US, the court heard.

He arrived in October 2023 on the US visa waiver programme, which allows tourists to visit the country for up to 90 days without a visa.

While in the US, Lam had no permanent residence, was not employed and was “paying for his lavish lifestyle with stolen funds”, the court heard during the government’s bid to keep him in remand.

“Moreover, (Lam) has substantial assets that have yet to be located, which provide him with the financial means to flee.”

For each count of conspiracy to commit wire fraud and money laundering, he could be jailed for up to 20 years and fined up to US$250,000, or up to twice his gains from the scams.