22-Year-Old 'Anne Hathaway' Pleads Guilty in $245M Crypto Theft Ring

A Justice Department court filing in the case against Hamza Doost and Kunal Mehta, which included a photograph of Malone Lam, was captured Friday, Sept. 4, 2026, by AP photographer Jon Elswick.

Malone Lam, a 22-year-old from Singapore who used aliases including "Anne Hathaway," "King Greavy" and "$$$," has pleaded guilty to a RICO conspiracy charge in federal court in Washington, D.C., admitting he led an elaborate cryptocurrency theft and laundering enterprise. At an early hearing, U.S. District Judge Alicia O. Valle compared his conduct to a darker version of the fictional 1986 character Ferris Bueller, saying: "As I was listening to the evidence, I could only think of Ferris Bueller gone bad."

How the Scheme Operated

Investigators say the group — largely composed of very young adults (many aged 18–20) based in California, Connecticut, New York, Florida and overseas — first connected on online gaming platforms. Members took on discrete roles: some breached databases or purchased stolen data on the Dark Web to identify targets; others monitored social media and crypto forums for potential victims. After assembling intelligence, callers posed as exchange security agents and used social engineering to trick victims into surrendering passwords, private keys and seed phrases, allowing conspirators to empty cryptocurrency wallets.

Violent and Physical Tactics

Most thefts were executed remotely, but in one instance an associate, Marlon Ferro, burglarized a victim's home and stole a portable hard drive containing a wallet. Ferro was sentenced in May 2026 to 78 months in prison for his role in the enterprise.

Money-Laundering Techniques

Prosecutors described the laundering operation as far more complex than the thefts. The group used a range of methods — including mixers, multiple cryptocurrency exchanges, peel chains, temporary pass-through wallets and virtual private networks (VPNs) — to obscure the origin of stolen funds. Mixers pool and redistribute funds to impede tracing; peel chains route funds through many wallets while "peeling" small amounts at each step; and pass-through wallets and VPNs added layers of anonymity.

The gang also converted cryptocurrency into high-value physical goods. Stolen assets were used to buy exotic cars through shell companies and to purchase luxury items. In one unusual tactic, bulk cash derived from converted crypto was hidden inside plush Squishmallows for transport.

Collapse of the Ring

The conspiracy's largest single heist came in August 2024, when the group convinced an individual they were support agents for the Gemini exchange and stole more than $240 million in Bitcoin. The lavish spending that followed — private jet trips, a month of extravagant purchases, a fleet of 28 luxury cars, jewelry and high-end watches — triggered law enforcement scrutiny.

The FBI used blockchain analysis to trace the movement of stolen funds; converting cryptocurrency into luxury purchases helped connect transactions to specific suspects. Lam and two co-conspirators were arrested in September 2024. Prosecutors allege Lam continued to direct parts of the operation while in pretrial detention and that stolen funds were used to pay legal fees. Lam is the 11th defendant convicted in the sprawling case; seven others remain charged.

Current status: Lam has pleaded guilty and is awaiting sentencing. Observers note the case reads like a high-tech crime drama, but investigators emphasize its real victims and complex criminal tradecraft.