Crypto Ringleader Malone Lam Pleads Guilty in $245 Million RICO Case

The case stemmed from a social-engineering crime ring operating across several US states and overseas. From late 2023 to early 2025, its members divided tasks including database hacking, fraudulent phone calls and money laundering to steal more than $250 million in cryptocurrency. When hardware wallets could not be breached remotely, members resorted to physical break-ins, underscoring how digital-asset security also involves risks to personal safety and homes.

The US Attorney's Office for the District of Columbia said 20-year-old Marlon Ferro was sentenced in federal court on May 6, 2026, to 78 months in prison, followed by three years of supervised release, and ordered to pay $2.5 million in restitution. In February 2024, he stole a hardware wallet in Texas containing about 100 Bitcoin, then worth more than $5 million. He pleaded guilty to RICO conspiracy on October 17, 2025.

Cryptocurrency transactions are typically difficult to reverse once recorded on-chain, making industry professionals with access to wallet credentials high-risk targets for social engineering. Chainalysis estimates that compromises of personal crypto wallets caused $713 million in losses in 2025. The incident also shows how legitimate productivity tools such as Obsidian and their community plugins can be turned into entry points for corporate breaches.

Elastic Security Labs disclosed the REF6598 campaign on April 14, 2026. Scammers posed as a venture capital firm, initially contacting finance and crypto professionals on LinkedIn before moving conversations to Telegram and persuading victims to open an attacker-controlled Obsidian cloud vault and sync its plugins. The campaign targeted both Windows and macOS systems and deployed the PHANTOMPULSE remote access trojan. Elastic said it intercepted the attack at an early stage.