U.S. federal prosecutors have charged 18 individuals under the Racketeer Influenced and Corrupt Organizations Act in connection with the theft of $263 million worth of bitcoin, according to the case details provided. Prosecutors allege the group stole more than 4,100 BTC in August 2024 after posing as representatives of Google and Gemini to obtain wallet access information from a victim.

Prosecutors identified Malone Lam as the alleged ringleader of the operation. According to the allegations, members of the group contacted the victim while claiming to represent Google and Gemini, then obtained information that gave them access to the victim's wallet. The theft was valued at $263 million, and the amount allegedly taken exceeded 4,100 BTC.

Investigators said the stolen crypto was later laundered through cryptocurrency exchanges. The proceeds were then allegedly used to buy luxury cars, private jets, and mansions. The case stands out because prosecutors are framing the activity not only as theft and laundering, but as conduct carried out through an organized criminal enterprise.

The report describes this as the first significant U.S. case in which RICO charges were used in connection with a cryptocurrency theft. That matters procedurally because RICO is designed to target coordinated criminal activity involving multiple actors, rather than a single isolated offense. In this case, the government is alleging a network structure behind the theft, movement of funds, and spending of proceeds.

The case is also still developing. If Lam's planned guilty plea goes forward as scheduled, it would mark the 11th guilty plea among defendants tied to the matter. The provided details do not include the full status of every defendant or the full breakdown of charges beyond the RICO-related conspiracy allegations.

Why It Matters

This case is worth watching because it signals a tougher U.S. enforcement posture toward crypto crime that combines wallet compromise, exchange laundering, and coordinated actors. Using RICO in this setting could widen the legal and compliance consequences for participants connected to criminal fund flows, even when the initial theft begins with off-chain social engineering rather than an on-chain exploit.

It also underscores a persistent weakness in the crypto market's security stack: attackers do not always need to break code if they can successfully impersonate trusted institutions and gain access through the user. That keeps pressure on exchanges, wallet providers, and users to strengthen verification and fraud-response controls as enforcement scrutiny rises.