Security

Cyber-crime

US indicts two over socially engineered $230M+ crypto heist

Just one victim milked of nearly a quarter of a billion bucks


Two individuals are in cuffs and facing serious charges in connection to a major theft of cryptocurrency worth more than $230 million from a single victim.

Malone Lam, 20, and Jeandiel Serrano, 21, of Miami and Los Angeles respectively, are alleged to have carried out a scam between August and September and used the stolen funds, which were laundered sloppily, to buy luxury cars, watches, jewelry, international travel, VIP nightclub services, rental homes, and designer handbags.

The indictment [PDF], unsealed on Thursday, doesn't go into any great detail about the criminal incident at the heart of the case, other than claiming the pair allegedly contacted the victim directly and stole more than 4,100 Bitcoins from them. 

The stolen cryptocurrency tokens were then moved around various exchanges and mixers, with the help of some VPN use, in an attempt to mask their route to the cyber thieves' wallets.

Peel chains were used as part of this laundering process, the Department of Justice (DoJ) said. These involve making many small transactions from a wallet and passing the funds through to different exchanges where they are then converted to other cryptocurrencies, such as Ethereum, Monero, and sometimes fiat currency too.

The idea here is that the multitude of transactions and their low value makes it less likely that the exchange will zero in on them due to suspected money laundering. It also makes investigating the trail of funds more difficult for blockchain investigators.

Cryptocurrency exchanges are, due to the nature of their business and what criminals use crypto for, often used for the laundering stolen digital assets such as Bitcoin and are therefore subject to stringent measures from financial regulators to stamp down on such malfeasance.

Not much was revealed about the victim, other than that they resided in Washington, D.C. where the case is currently being handled by the US Attorney's Office, the FBI, and IRS.

The news comes mere days after the FBI released a report examining the state of crypto-related scams in the US, which net cyber scum $5.6 billion a year, by its reckoning.

Trust-based scams are the most common. Often, the scammer will spend weeks and sometimes months before beginning the actual scam phase of their endeavors. They'll spend a great deal of time on dating apps and social media, typically, building a relationship with the victim before convincing them to engage in some sort of phony investment which of course concludes with the victim's assets being stolen.

There are also the more violent types of crypto-related crime, as evidenced by the recent conviction of a Florida man and a band of his thug friends who invaded the homes of elderly people across the US, using physical force and threats of heinous acts to scare victims into handing over control of their digital assets. ®

Send us news
26 Comments

LottieFiles supply chain attack exposes users to malicious crypto wallet drainer

A scary few Halloween hours for team behind hugely popular web plugin

US contractor pays $300K to settle accusation it didn't properly look after Medicare users' data

Resolves allegations it improperly stored screenshots containing PII that were later snaffled

FBI created a cryptocurrency so it could watch it being abused

It worked – alleged pump and dump schemers arrested in UK, US and Portugal this week

Uncle Sam outs a Russian accused of developing Redline infostealing malware

Or: why using the same iCloud account for malware development and gaming is a bad idea

Belgian cops cuff 2 suspected cybercrooks in Redline, Meta infostealer sting

US also charges an alleged Redline dev, no mention of an arrest

Gang gobbles 15K credentials from cloud and email providers' garbage Git configs

Emeraldwhale looked sharp – until it made a common S3 bucket mistake

Russian spies use remote desktop protocol files in unusual mass phishing drive

The prolific Midnight Blizzard crew cast a much wider net in search of scrummy intel

JPMorgan Chase sues scammers following viral 'infinite money glitch'

ATMs paid customers thousands ... and now the bank wants its money back

Feds investigate China's Salt Typhoon amid campaign phone hacks

'They're taunting us,' investigator says and it looks like it's working

Brazen crims selling stolen credit cards on Meta's Threads

The platform 'continues to take action' against illegal posts, we're told

Dutch cops pwn the Redline and Meta infostealers, leak 'VIP' aliases

Legal proceedings underway with more details to follow

Senator accuses sloppy domain registrars of aiding Russian disinfo campaigns

Also, Change Healthcare sets a record, cybercrime cop suspect indicted, a new Mallox decryptor, and more