Skip to main content
Sign in

263M RICO Social Engineering Crypto Theft Gang (DC — 2024-2026 Prosecutions)

avoid.net/263m-rico-social-engineering-crypto-theft-gang-dc-2024-2026-prosecutions0/100·97% conf.
[AI-DRAFTED · AWAITING VERIFICATION]

Summary

The Social Engineering Enterprise (SEE) is a multi-state organized crime network that prosecutors allege stole over $263 million in cryptocurrency from multiple victims between October 2023 and May 2025, including over 4,100 Bitcoin from a single Washington, D.C. resident on August 18, 2024 — described by federal prosecutors as one of the largest single-victim cryptocurrency thefts in U.S. history. Formed through online gaming platform connections and prosecuted under the federal RICO statute in the U.S. District Court for the District of Columbia, the enterprise had 17 individuals charged as of late 2025, with 9 guilty pleas entered and at least two sentencings completed as of mid-2026.

Connected Entities

1 entities
Organizations
263M RICO Social Engineering Crypto Theft Gang (DC — 2024-2026 Prosecutions)
Relationships
  • + 2 more
Have evidence about 263M RICO Social Engineering Crypto Theft Gang (DC — 2024-2026 Prosecutions)?

Timeline(12 events)

2023-10-01

Social Engineering Enterprise (SEE) begins operating, per DOJ charging documents (approximate date; indictment states 'no later than October 2023').

DOJ / IRS-CI press release

2024-02-01

Marlon Ferro (GothFerrari) breaks into a home in Winnsboro, Texas and steals a hardware cryptocurrency wallet containing approximately 100 Bitcoin (over $5 million at the time).

IRS-CI: GothFerrari sentencing press release

2024-07-01

Malone Lam and associates allegedly steal over $14 million in cryptocurrency from a second victim. Marlon Ferro conducts a second home invasion in New Mexico to steal a hardware wallet while Lam allegedly monitors the victim's location via iCloud.

TRM Labs analysis; IRS-CI sentencing press release

2024-08-18

Enterprise members including Malone Lam, Jeandiel Serrano, and Danish Zulfiqar conduct social engineering attack on a Washington, D.C. victim (identified in reporting as a Genesis bankruptcy creditor). Over 4,100 Bitcoin worth approximately $263 million is stolen in a single operation — one of the largest single-victim cryptocurrency thefts in U.S. history.

DOJ / IRS-CI; NBC News; ZachXBT investigation

2024-09-19

Malone Lam arrested in Miami. Jeandiel Serrano arrested. Both initially charged with conspiracy to commit wire fraud and conspiracy to launder monetary instruments. ZachXBT credited with assisting in the tracing of funds that led to the arrests.

NBC News; The Record from Recorded Future News

2025-05-16

DOJ unseals superseding indictment charging 12 additional defendants with RICO conspiracy, wire fraud, money laundering, and obstruction. Total number of charged defendants rises to 17. Enterprise operating period described as October 2023 through March/May 2025.

DOJ USAO-DC press release; CoinDesk

2025-10-01

Marlon Ferro (GothFerrari) pleads guilty to RICO conspiracy.

IRS-CI: GothFerrari sentencing press release

2025-11-01

Kunal Mehta (aka 'Shrek,' 'Papa,' 'The Accountant'), age 45, pleads guilty to RICO conspiracy, the eighth defendant to do so. He admits to laundering at least $25 million.

IRS-CI; DL News

2025-12-03

Nicholas Dellecave (aka 'Nic,' 'Souja') arrested in Miami on RICO conspiracy charge filed in Second Superseding Indictment.

IRS-CI: Guilty plea and superseding indictment press release

2025-12-08

Evan Tangeman, age 22, of Newport Beach, California pleads guilty to RICO conspiracy, the ninth defendant to do so. He admits to laundering at least $3.5 million and to directing destruction of digital evidence.

IRS-CI; Decrypt

2025-12-01

Mustafa Ibrahim (aka 'Krust') and Danish Zulfiqar (aka 'Danny,' 'Meech') arrested in Dubai on RICO conspiracy charges filed in Second Superseding Indictment.

IRS-CI: Guilty plea and superseding indictment press release

2026-04-24

Evan Tangeman sentenced to 70 months in federal prison plus three years supervised release by U.S. District Court for the District of Columbia.

IRS-CI: California money launderer sentenced in DC to 70 months
Provenance & Audit Trail
18 Wayback Archives

Decision Log

  • #1publish⛓ pending8/13/2026, 5:13:03 PM
    hash: veSHNiZaR549Xmi3oLdj2feTijKBHEXCJZVwoug5bnF

18 of 20 cited source URLs have an Internet Archive snapshot.

model: claude-sonnet-4-6

generated: 8/13/2026, 5:12:48 PM

last updated: 8/14/2026, 1:18:04 AM

avoid.net — verified advice for a post-truth world