More than 4,100 bitcoins disappeared from one investor’s wallet after speaking to a fake Google support representative. According to American prosecutors, a group of very young fraudsters was behind one of the largest robberies of a private cryptocurrency holder. They spent their money on supercars, watches, mansions and late-night parties. Ultimately, investigators were supposed to be able to track them down, among other things, thanks to the errors they left on the Internet.
In August 2024, the owner of a huge bitcoin fortune received a call from people claiming to be Google support employees. The conversation looked professional and the scammers had enough information to gain the victim’s trust.
At the time of the theft, American services initially valued the seized funds at approximately USD 230 million. However, later documents from the Department of Justice revealed an amount of approximately USD 263 million. At the current Bitcoin price of approximately 64.7 thousand. USD the stolen coins would be worth approximately USD 265 millioni.e. over one billion zlotys.
Fake call from Google and security reset
According to the prosecutor’s office, one of the main suspects is Malone Lam, a Singaporean citizen who was 20 years old at the time of his arrest. Jeandiel Serrano, 21, of Los Angeles, was charged with him. The men were to act together with other people forming a larger group specializing in social engineering attacks.
The attackers did not have to break Bitcoin’s cryptography or exploit a bug in the blockchain network. Instead, they focused on the human.
Posing as Google employees, they were to convince the investor to reset security, share the computer screen and execute subsequent commands. In this way, they gained access to accounts and wallets, from which they then withdrew over 4,100 BTC.
This is one of the most spectacular examples showing that even a huge fortune stored in cryptocurrencies can be lost without a blockchain hack. All it takes is effective manipulation of the owner of the funds.
Millions of dollars on Lamborghinis, Ferraris and nightclubs
After seizing the bitcoins, the group allegedly began intensive money laundering. Funds were transferred between wallets, divided into smaller amounts and routed through services that made it difficult to analyze transaction flow. The prosecutor’s office describes, among other things, the use of cryptocurrency mixers and the so-called Peel chains, i.e. chains of transactions in which smaller parts of funds are gradually “cut off” from subsequent addresses.
However, some of the money was quickly converted into goods that were much more difficult to hide.
According to American investigators, Malone Lam allegedly spent hundreds of thousands of dollars on single nights at clubs in Los Angeles. He was also linked to the purchase or use of Lamborghini, Ferrari and Porsche luxury cars, the rental of a Miami mansion and a watch worth approximately $2 million.
Serrano, in turn, admitted to investigators that he bought three cars with a total value exceeding $1 million and a watch for about $500,000 with the stolen money. USD. According to the documents, he also had access to cryptocurrencies belonging to the victim and agreed to turn over some of the funds to the FBI.
The image of young people surrounded by supercars and luxury quickly began to circulate on social media. However, the same ostentatious lifestyle was intended to attract the attention of investigators and facilitate the connection of suspects with the flow of money.
They left digital traces for investigators
Although the criminals used techniques that made it difficult to track cryptocurrencies, according to media reports, they also made basic operational errors.
The materials relating to the case include information about publications on social media containing location data, photos of luxury cars and recorded conversations of the group. Investigators could cross-reference this information with publicly available blockchain transaction history, exchange data and traditional financial traces.
The paradox is that Bitcoin is pseudonymous but not anonymous. Every transaction remains publicly visible. The address itself does not show the owner’s name, but once it is associated with a stock account, car purchase, phone number or specific location, subsequent flows can be recreated.
Mixers and extensive wallet chains make analysis difficult, but they do not guarantee impunity. Especially when criminals start spending millions of dollars in the real world.
The case turned out to be bigger than initially thought
Malone Lam and Jeandiel Serrano were arrested in September 2024. The original indictment alleged the theft and laundering of approximately $230 million in cryptocurrencies. However, in the following months, the American services expanded the investigation.
In May 2025, the Department of Justice announced charges against another 12 people. The entire group was allegedly responsible for cybercriminal activities that generated over USD 263 million. The charges included participation in an organized criminal group, wire fraud, money laundering and obstruction of justice.
Some participants in the scheme began cooperating with authorities. One of the young defendants admitted his involvement in the theft and agreed to testify against the other suspects. In turn, Evan Tangeman, who, according to the prosecutor’s office, helped launder the group’s money, was sentenced in April 2026 to 70 months in prison.
However, the proceedings concerning the main suspects should not be described as if final judgments had already been passed against them. The allegations contained in the indictments remain the allegations of the prosecutor’s office until they are confirmed by a court judgment or the accused’s admission of guilt.
The weakest element of security is still the human
The story of the theft of over 4,100 BTC is not primarily a story about Bitcoin’s weakness. The network was not hacked and the cryptography was not broken.
The person who believed people impersonating technical support failed.
With funds worth millions of dollars, a single wallet and one person with full access create enormous risk. The solution may be the division of funds between several wallets, multisig, separate devices for signing transactions and a mandatory delay for large withdrawals.
In this case, the criminals used advanced social engineering, an extensive network of wallets and cryptocurrency laundering methods. Ultimately, however, they were to make a very traditional mistake: they began to act as if no one was watching.
