From Minecraft to US$245 million crypto heist: S’porean forfeits 28 cars to US after guilty plea

SINGAPORE - Singaporean Malone Lam was 19 years old in October 2023 when he flew to Texas on his own to live with a few gamers he befriended online through the video game Minecraft.

Within a month of living together, the group hatched a plan to steal cryptocurrency by impersonating employees of security and technical support teams at major companies like Google, and cryptocurrency exchanges like Coinbase.

Lam, who told US investigators that he had dropped out of school when he was 13 years old, used his knowledge of computer software and technology to obtain breached databases containing cryptocurrency-related information and lists of high-net-worth individuals.

The group then targeted these individuals.

After analysing the stolen data, Lam triggered “account access attempt” push notifications to the targets, to make them think there were unauthorised attempts to access their accounts.

Other members of the group would then convince the targets to provide personal account information by pretending to be security technicians, gaining access to their digital currency wallets or passwords to their accounts before stealing their cryptocurrency.

On Sept 9, Lam pleaded guilty at the US District Court for the District of Columbia for his role as a ringleader in organising one of the US’ largest cryptocurrency thefts.

Around June 2024, Lam and his associates targeted a victim by accessing his iCloud storage account through social engineering methods and concluded that the victim held a significant amount of cryptocurrency in a digital wallet.

When Lam was unable to break into the wallet online, the group sent one of their associates to break into the victim’s house in New Mexico, but they were ultimately unable to access the digital wallet even after successfully breaking into his home.

Their largest haul came in August 2024. In the days leading up to the digital heist, Lam continually sent Google account access attempt notifications to the victim, who was identified only as R.W.

On Aug 18, 2024, Lam’s associates called R.W. and claimed to be a Google representative following up on unauthorised account access attempts. Lam was eventually able to access R.W’s Google account and locate his cryptocurrency holdings after taking over his Google OneDrive account.

The group then impersonated the security team at Gemini, a virtual currency exchange and custodial bank, and convinced R.W. to provide the private keys to a portion of his digital currency holdings.

They then siphoned off some US$245 million from R.W.

Now 22, Lam faces a maximum jail sentence of 20 years. A sentencing date has not been fixed.

Forfeiture orders seen by The Straits Times show that at least 28 luxury vehicles have been seized from Lam.

The fleet of cars, which cost between US$100,000 and US$3.8 million each, includes vehicles from Rolls-Royce, at least seven Lamborghinis, multiple Ferraris and the sports car Pagani.

At least 95 pieces of jewellery, luxury watches, clothes and shoes were also seized and forfeited from Lam. Court documents show some watches cost upwards of US$500,000 each.

Lam admitted that he had come to an arrangement with his criminal group to divide up the proceeds of their fraud scheme and to launder the stolen money into clean “fiat” currency so they could spend the money freely.

Besides using common cryptocurrency laundering techniques including exchange platforms that do not require know-your-customer information, Lam and his associates also engaged the assistance of professional money launderers they had found operating on the dark web.

Because of the sums of money they were dealing with and moving, Lam and his associates came to an agreement to only engage in transactions of more than US$10,000 with the professional money launderers.

One such network was described in court documents as a Russian money laundering operation that existed on a dark web forum.

Lam also engaged the services of a San Jose-based money launderer to help convert his share of the stolen cryptocurrency into cash, using the same launderer to help him obtain private jet flights, rentals of mansions in Miami, and nightclub bottle services where Lam was recorded spending up to US$500,000 in a single night.

He was eventually arrested by FBI agents in September 2024 and has been held on remand since.