Prosecutors Say Social Engineering Scheme Stole $240 Million in Bitcoin
Summary
Prosecutors say a group led by Malone Lam used phone calls posing as Google and Gemini staff to steal over 4,100 bitcoin from a Washington, D.C., investor in August 2024. Eighteen people were charged; several have pleaded guilty.
Key points
- According to prosecutors, callers impersonating Google and Gemini representatives manipulated the victim into sharing Google Drive access and security codes.
- The theft involved more than 4,100 bitcoin, valued at over $240 million, prosecutors said.
- Prosecutors say Malone Lam, Veer Chetal, and Jeandiel Serrano participated in the calls and targeted the victim because he was a wealthy, longtime crypto investor.
- Investigators linked Serrano to an exchange account holding nearly $30 million in stolen cryptocurrency after he allegedly failed to conceal his IP address.
- The FBI said it found $37 million in stolen crypto in Chetal’s possession; he agreed to cooperate with the investigation.
- Eighteen defendants have been charged. Lam is set to have a plea agreement hearing; several co-defendants have pleaded guilty, while Serrano’s charges remain pending.
- The article describes an earlier abduction attempt against Chetal’s parents, which authorities say was intended to extort his share of the stolen cryptocurrency.
Article Details
- Incident Type
- Social-engineering attack resulting in cryptocurrency theft
- Incident Date
- 2024-08-18
- Data Types Exposed
- Google Drive access
- Security codes
- Cryptocurrency wallet access
- Affected Data Size
- More than 4,100 bitcoin, valued at over $240 million according to the article
- Operational Impact
- A Washington, D.C., resident lost more than 4,100 bitcoin. Prosecutors said the stolen cryptocurrency was laundered through multiple exchange platforms and converted to government-issued cash.
- Ransom Or Extortion
- Separately, captors allegedly kidnapped and assaulted Veer Chetal's parents to extort him into surrendering his share of the stolen cryptocurrency. The plot fell apart after witnesses notified police, who apprehended the carjackers.
- Claim Status
- alleged
People
Allison NixonCybersecurity researcher who has tracked The Com and advocated for more law-enforcement resources to address crypto fraud.Jeandiel SerranoNamed by prosecutors as one of the friends on the calls targeting the victim; prosecutors said he possessed stolen cryptocurrency.Malone LamAlleged ringleader accused of organizing the social-engineering attack and siphoning off the victim's bitcoin.Veer ChetalNamed by prosecutors as one of the friends on the calls targeting the victim; pleaded guilty to conspiracy charges.ZachXBTCryptocurrency-crime private investigator who posted a video containing a private recording related to the theft.
Threat Actors
Jeandiel SerranoProsecutors identified him as a participant in calls targeting the victim and said he possessed stolen cryptocurrency.Malone LamAccused of organizing the social-engineering attack and stealing the victim's bitcoin.Veer ChetalProsecutors identified him as a participant in calls targeting the victim; he pleaded guilty to conspiracy charges.
Products
GeminiA second, claiming to be from the Gemini crypto exchange, warned the man of a malware attack affecting his crypto wallet.Google DriveThe callers manipulated the man into giving them access to his Google Drive and revealing security codes that allowed Lam to siphon off over 4,100 bitcoin, according to prosecutors.