How 'Ferris Bueller Gone Bad' Cracked a $240M Bitcoin Heist

The $240 million bitcoin theft that gutted a Washington DC man's life savings in a single afternoon is finally coming undone in court, one guilty plea at a time. Malone Lam, 22, the alleged ringleader, is set to become the 11th defendant to plead guilty in the biggest cryptocurrency theft case the country has seen, a scheme that unraveled partly because of a forgotten IP address, a Lamborghini gifted to the wrong parents, and a $500,000 watch worn to an airport arrest.

How Did They Pull Off a $240 Million Bitcoin Heist?

Two phone calls. That's all it took to wipe out the life savings of a wealthy, longtime cryptocurrency investor.

On August 18, 2024, a man referred to only as 'Victim 7' in court filings was at home in Washington when his phone rang. The first caller identified himself as a Google representative, flagging suspicious access attempts on his account. Minutes later, a second caller, claiming to work for the Gemini crypto exchange, warned him of malware threatening his wallet. The calls were coordinated, calm, and completely fabricated.

Between them, the callers convinced the victim to hand over access to his Google Drive and reveal the security codes that gave Malone Lam and his associates the keys to the entire account. Within hours, over 4,100 Bitcoin, worth more than $240 million at the time, had been drained and funneled through a chain of exchange platforms designed to obscure the trail.

Prosecutors say Lam and his co-conspirators Veer Chetal and Jeandiel Serrano targeted this man specifically because he was a high-net-worth, longtime crypto holder. The victim was chosen. The script was rehearsed. And the moment the funds disappeared, a private recording captured Lam's crew realizing exactly how much they had just stolen, a clip later posted to X by cryptocurrency crime investigator ZachXBT that became its own strange exhibit in the case.

This was social engineering at its most predatory: no exchange hacked, no malware planted. Just phone calls.

Nightclubs, Lamborghinis, and a Kidnapping in Connecticut

The crew didn't wait. The money was barely laundered before the spending started.

Lam burned through more than $4 million at Los Angeles nightclubs in a single month, including one night where he spent over $569,000 at one club alone, reportedly tossing designer bags worth tens of thousands of dollars to women in the crowd. He bought a $2 million watch and more than 30 cars, Porsches, Ferraris, Lamborghinis, flew on private jets, rented mansions in Miami and the Hamptons, and hired personal security. Eighteen defendants would eventually be charged in the operation. Some for laundering. Some for the theft itself.

Veer Chetal's choices were particularly memorable. He gifted his parents a Lamborghini and stashed $500,000 in cash inside their laundry machine. A week after the heist, masked men ambushed Chetal's parents in Danbury, Connecticut, cut off their car, beat his father with a baseball bat, shoved both of them into a van, and tied their hands. The kidnappers wanted Chetal's share of the stolen Bitcoin as ransom. The plot collapsed when police caught them.

Jeandiel Serrano, meanwhile, was on vacation in the Maldives when investigators first flagged him as a suspect. He had been renting a house in Encino, California for $47,500 a month. Not exactly laying low.

U.S. Magistrate Alicia Valle, who has now sentenced three of the co-conspirators, including two money launderers who each received six-year prison terms, captured the absurdity of it all in one sentence.

I could only think of Ferris Bueller gone bad.

How Did Investigators Crack the $240M Bitcoin Case?

Serrano handed investigators exactly the thread they needed. When he created a cryptocurrency exchange account to hold nearly $30 million in stolen funds, he simply forgot to mask his IP address. That one lapse, basic operational security, the kind anyone handling nine-figure stolen funds should know, led investigators straight to his Encino rental and blew the whole operation open.

On September 18, 2024, FBI agents arrested Serrano at Los Angeles International Airport. He was wearing a $500,000 watch. He initially denied any involvement, then later admitted to holding approximately $20 million worth of the Washington victim's stolen Bitcoin, according to prosecutors. Lam was arrested the same day at his Miami mansion, but nearly escaped. An off-duty police officer, named in an indictment, had tipped Lam off that federal agents were on the way. They got him anyway.

Chetal's end came nine days earlier. On September 9, 2024, FBI agents searched his apartment in Brunswick, New Jersey and found $37 million in stolen cryptocurrency. He agreed to cooperate. In November 2024, Chetal pleaded guilty to conspiracy charges and still awaits sentencing. Serrano's charges remain pending.

Now Lam faces the same reckoning. As the 11th defendant to plead guilty in the 240 million bitcoin theft case, his sentencing is the most watched in the bunch, he's the alleged architect of a scheme that a federal judge compared, however absurdly, to a teen comedy. The watch was worth half a million dollars. The Encino house cost more per month than most people earn in a year. None of it was enough to stay free.

The off-duty cop who tipped Lam off has not been publicly charged. That may be the next shoe to drop.