$263 Million Crypto Theft: Social Engineering Ring, RICO Charges, and What Every Crypto Holder Needs to Know
- Carolina Nunez
- Mar 17
- 5 min read
Updated: Mar 18
At The Law Offices of Carolina Nunez, P.A., Attorney Carolina Nunez advises victims of cryptocurrency fraud, investors navigating asset recovery, and individuals protecting their digital assets. Call (407) 900-FIRM to speak with a crypto attorney.
LEGAL DISCLAIMER: A criminal complaint contains allegations. All named defendants are presumed innocent unless and until proven guilty. This article provides general legal information. It does not constitute legal advice. Facts reflect public reporting as of March 16, 2026.
by Cryptocurrency & Digital Asset Attorney
A multi-state criminal enterprise that stole $263 million in cryptocurrency through social engineering has resulted in nine guilty pleas and a new superseding indictment charging three additional defendants.
The U.S. Attorney’s Office for the District of Columbia announced the latest developments and the case continues to expand in 2026 with arrests reaching as far as Dubai. The stolen Bitcoin, with over 4,100 BTC taken from a single victim in Washington, D.C., is now valued at more than $368 million. For an overview of how cryptocurrency and blockchain law affects investors and businesses in Florida, visit our comprehensive guide.
The enterprise grew from friendships on online gaming platforms and included members based in California, Connecticut, New York, Florida, and abroad. The operation involved database hackers, target identifiers, social engineering callers, money launderers, and even residential burglars targeting hardware cryptocurrency wallets.
Federal prosecutors charged the defendants under RICO (18 U.S.C. § 1962) — the same statute historically used against organized crime families and now increasingly deployed against sophisticated crypto criminal networks.
This case overlaps with Operation Atlantic, a joint international law enforcement initiative targeting approval phishing and pig butchering crypto scams launched just days ago.
At The Law Offices of Carolina Nunez, P.A., Attorney Carolina Nunez advises individuals protecting their digital assets, victims of cryptocurrency fraud, and families securing digital asset estate plans throughout Orlando, Winter Park, Daytona Beach, Sanford, Kissimmee, Lake Mary, DeLand, and all of Central Florida. Call (407) 900-FIRM to speak with a crypto attorney, or click here to fill out our online case review.
The Social Engineering
Scheme
The enterprise began no later than October 2023 and continued through at least May 2025.
Members used stolen databases, obtained by hacking servers or purchasing data on the dark web, to identify victims who held significant cryptocurrency.
According to the IRS Criminal Investigation announcement, the operation was structured like a professional criminal business with specialized roles:
Database hackers gained access to cryptocurrency-related servers and databases.
Target identifiers collated data to find the most valuable crypto holders.
Social engineering callers impersonated exchange representatives using spoofed phone numbers.
Money launderers converted stolen crypto through mixers, peel chains, shell companies, and bulk-cash conversions.
Residential burglars physically broke into homes to steal hardware cryptocurrency wallets.
The stolen cryptocurrency funded an extravagant lifestyle: nightclub tabs reaching $500,000 per evening, luxury watches valued between $100,000 and $500,000, designer handbags given away at parties, private jet rentals, rental mansions in Los Angeles, the Hamptons, and Miami, private security, and a fleet of at least 28 exotic cars.
Members even shipped bulk cash through U.S. mail hidden inside Squishmallows stuffed animals.
Key Defendants and
Guilty Pleas
Evan Tangeman, 22, of Newport Beach, California, became the ninth defendant to plead guilty. He admitted to RICO conspiracy and laundering at least $3.5 million for the enterprise.
After FBI agents arrested co-conspirator Malone Lam in Miami, Tangeman accessed home security systems to screenshot FBI agents during the search and directed another member to destroy digital devices. Tangeman faces sentencing on April 24, 2026.
Three additional defendants: Nicholas Dellecave, Mustafa Ibrahim, and Danish Zulfiqar, were charged in the second superseding indictment. Ibrahim and Zulfiqar were arrested in Dubai. At the center of the investigation is 20-year-old Malone Lam, a Singaporean national accused of orchestrating the theft of over 4,100 Bitcoin from a single victim using fake Google security alerts. Even after his arrest, Lam allegedly continued directing operations from pretrial detention.
Kunal Mehta, 45, of Irvine, California — known as "Papa," "The Accountant," and "Shrek" — also pleaded guilty to RICO conspiracy, admitting to laundering at least $25 million through shell companies he created specifically to process stolen crypto.
Why RICO Matters for
The use of RICO marks a significant shift in how federal prosecutors approach crypto-native criminal networks. Enacted in 1970 to combat traditional organized crime, RICO (18 U.S.C. § 1962) allows prosecutors to charge all members of an enterprise if they participated in a pattern of racketeering activity including wire fraud (18 U.S.C. § 1343), money laundering (18 U.S.C. § 1956), and obstruction of justice.
This enables the DOJ to connect digital asset thefts with real-world violence, tie overseas laundering operations to U.S.-based facilitators, and apply enhanced sentencing and asset forfeiture tools. For businesses and startups navigating crypto and blockchain legal compliance, understanding how RICO applies to crypto enterprises is critical.
For cryptocurrency holders and businesses throughout Central Florida, this signals that law enforcement now treats sophisticated crypto theft rings the same way it treats traditional organized crime.
Hardware Wallet Burglaries
The most alarming aspect: the enterprise conducted residential burglaries specifically targeting hardware cryptocurrency wallets. In one instance, defendant Marlon Ferro traveled to New Mexico and broke into a victim's home while Malone Lam monitored the victim's location through iCloud. Physical security matters as much as digital security.
A comprehensive digital asset estate plan should include guidance on secure storage locations, access protocols, and emergency procedures for physical theft. Under Florida’s Fiduciary Access to Digital Assets Act (Fla. Stat. §§ 740.001–740.10), your fiduciary can access digital assets only if properly authorized.
This is exactly what GhostWill™ addresses, developed by The Law Offices of Carolina Nunez, P.A. Learn more about how to include cryptocurrency in your Florida estate plan and what happens to crypto after death in Florida.
Lessons for Every
No exchange will call you first. If you receive an unsolicited call about your crypto, hang up and contact the exchange directly. The defendants used spoofed numbers and fake Google alerts.
Never share screen access. The $263 million victim was convinced to download a remote desktop program, which the criminals used to steal account information.
Secure hardware wallets physically. Store in a safe or safety deposit box. This case proves criminals will physically break in to steal them.
Protect your personal information. Use a VPN, unique email addresses for exchanges, and avoid sharing crypto holdings on social media. Learn more about protecting crypto and streaming income if you can’t log in.
Have a legal plan. A digital asset estate plan ensures your beneficiaries have a legally enforceable path to recover and manage your crypto under Florida Statutes §§ 740.001–740.10. If you are a victim, report to the FBI IC3 and the FTC.
Florida Statutes That
Protect Crypto Holders
Florida has adopted several legal frameworks relevant to crypto holders. The Florida Fiduciary Access to Digital Assets Act (Fla. Stat. §§ 740.001–740.10) governs fiduciary access to digital assets. Florida Statutes § 817.034 covers schemes to defraud using electronic communications. Florida Statutes § 812.014 addresses theft of property including digital assets, and § 896.101 covers money laundering.
At the federal level, 18 U.S.C. § 1962 (RICO), 18 U.S.C. § 1343 (wire fraud), and 18 U.S.C. § 1956 (money laundering) are the primary statutes used in cases like this one. For game developers working with NFTs and digital tokens, understanding the intersection of federal securities law and Florida regulations is equally critical.
Call (407) 900-FIRM now to speak with Attorney Carolina Nunez. Offices in Winter Park and Daytona Beach. Serving Orlando, Sanford, Kissimmee, Lake Mary, DeLand, and all of Central Florida.
DISCLAIMER: This article provides general legal information about cryptocurrency theft, RICO charges, and digital asset protection under Florida and federal law. It does not constitute legal advice and does not create an attorney-client relationship. Every situation is different — consult a qualified attorney for guidance specific to your circumstances.