Spending It Took a Crew

The case

Up to half a million dollars, in one evening, at a nightclub. That is the top of the range for the crew’s nightclub bills listed in the federal indictment of a group prosecutors call a social engineering enterprise, charged in Washington, D.C.

Prosecutors say the crew made fake support calls. On or about 19 August 2024, the indictment says, members of the group took $245,093,239 in virtual currency from one man, while he was at his home in Washington. Then, between 19 August and 10 September, prosecutors say, the crew spent over $4 million of stolen virtual currency at Los Angeles nightclubs. That is twenty-two days.

On 8 September 2026, the man prosecutors call the crew’s ringleader pleaded guilty to a racketeering conspiracy count. In his plea agreement, he agreed the victim is owed approximately $245,093,239 in restitution “by the members of this conspiracy, including your client.”

This article follows the money after the theft: how stolen coins became cash, nightclub bills, cars and houses, and who handled each part. It is not a guide to the theft itself.

How to read it. The case has three layers of proof, and every sentence here says which one it uses:

• Prosecutors say — an allegation in the indictment. Not proven.
• Admitted — a fact the defendant who signed a statement of offense agreed was true. It binds only that defendant.
• Ordered — something a judge did: a sentence, a guilty plea accepted, a judgment.

No victim or defendant is named. The alleged ringleader has pleaded guilty but has not been sentenced, and his own signed account of the facts is not in the public court records we could read. So almost everything about him below is still what prosecutors say.

How did the money leave the man in Washington?

Through his own computer. The crew, the indictment says, convinced him to download a program that let them into his computer remotely. The indictment calls what happened a social engineering scheme — its term for calling someone and tricking them. It does not say what they told him.

It does describe how this crew worked. Callers, the indictment says, “were responsible for cold-calling victims and convincing them their accounts were the subject of a cyber-attack and the callers were attempting to help secure their accounts.” Members “made fraudulent ‘support’ calls in which they called victims and identified themselves as employees from major” crypto exchanges or email providers. And before those calls, prosecutors say, the crew caused unauthorized-access alerts to be sent to potential victims, “in order for the fraudulent ‘support’ call to seem more legitimate.”

This is the same family of scam as our piece on fake Microsoft security alerts: someone who claims to be protecting your account is the one taking it. We will not repeat the mechanics. This article is about what came next.

Prosecutors say the group largely grew from “friendships developed among its members and associates through online gaming platforms.” Justice Department releases describe the group’s thefts from all its victims as more than $263 million, and an earlier version of the indictment lists other victims who lost from over $600,000 to about $14 million each. The $245 million came from one man.

How did the crew turn stolen crypto into cash?

By paying other people to take the risk, the court records say. Stolen coins were not money anyone could hand a bartender.

The indictment describes three ways the launderers handled it. They turned virtual currency “into fiat US currency in the form of bulk cash or wire transfer, or” provided “luxury services such as exotic car purchases, private jet rentals, international vacations, or shipping bulk cash across the United States.”

Crypto-to-cash. The indictment defines a crypto-to-cash exchanger as an unlicensed money transmitter who receives stolen virtual currency and hands over physical U.S. cash. “Due to its illegality,” it says, “the fee charged for this service is exorbitant” — compared with exchanges that check who their customers are. How exorbitant? One money launderer admitted, in his signed statement, that he charged “a 10% fee for converting the cryptocurrency to fiat cash.” Another defendant’s statement describes 6–7% and 10–11% fees. The indictment describes a 7% commission elsewhere, and up to 20% through nightclub promoters.

The courier. A cash courier admitted, in his statement of offense, how the cash was collected: the retrievals “were not done from banking institutions, but rather from discrete residential addresses throughout Los Angeles,” where he received the money in envelopes or grocery bags. In one transaction, he admitted, he went to retrieve $1,000,000 in cash and delivered it personally to the man prosecutors call the ringleader.

The mail. Then the cash had to travel. Prosecutors say members “shipped fiat currency across the country to other members, sometimes hidden in clothing or stuffed animals.” The courier admitted a single stuffed animal could hide up to $20,000. That is the scale of one parcel, not of the theft: nothing in the records says the $245 million moved this way.

The wires. Money in a bank needs a story. The launderer who charged 10% admitted creating multiple shell companies in 2024 “for the purpose of laundering funds through bank accounts created to give the appearance of legitimacy.” The incoming wires, he admitted, “were often in the hundreds of thousands of dollars” and were disguised with payment descriptions such as “family support” or “IT services.” Our article on how scam networks hide money follows the offshore version of the same idea.

For the crypto that stayed crypto, a 2024 Justice Department release on the arrests said the funds were moved through mixers and exchanges. The money in this article is the part that left the blockchain.

How did the crew pay nightclubs with stolen crypto?

Through a middleman. Prosecutors say the crew “used various ‘nightclub promoters’ to pay for their nightclub services in exchange for stolen cryptocurrency and up to a 20% fee for the unlicensed conversions.”

According to the indictment, “between August 19, 2024 and September 10, 2024,” the crew “spent over $4,000,000 in stolen virtual currency at Los Angeles nightclubs.” Twenty-two days, starting the day of the theft. In Miami, the courier admitted, the bills at times reached $200,000 to $300,000 or more per evening.

The indictment’s list of what the stolen money bought, which co-defendants also admitted in their signed statements:

• nightclub services “ranging up to $500,000 per evening”;
• luxury handbags worth tens of thousands of dollars, “given away at nightclub parties”;
• watches valued from $100,000 to over $500,000;
• luxury clothing;
• rental homes in Los Angeles, the Hamptons and Miami;
• private jet rentals;
• a team of private security guards;
• “a fleet of exotic cars, ranging in value from $100,000 up to $3,800,000.”

Cash covers a bar tab. A car is different. A car has a title, and a title has a name on it.

Whose name went on the cars and the houses?

Someone else’s, for a fee. A money launderer admitted that at times he would “seek out straw signers who would place their names on the automobile title and purchase documents in exchange for payments.” Those payments, he admitted, “exceeded $10,000 per signing,” and he “would in turn typically charge a 10% fee for this service.” The courier’s statement puts it at $10,000 to $15,000 per car.

The indictment’s definition of that person: “A straw signer or straw owner is a person who agrees to hold title to another’s automobile or home, for a fee, in order to disguise and conceal the true owner of the items when the true owner wants to conceal their identity from law enforcement.”

The cars. In August and September 2024, prosecutors say, the man they call the ringleader bought over 30 cars with stolen virtual currency — Ferraris, Lamborghinis, a Pagani — and created a fictitious holding company to hold title to them. The courier admitted he knew of about seven exotic cars bought immediately after the theft, all estimated at around $700,000 each.

Why go to that trouble? The launderer who found the signers gave the reason in writing. Members, he admitted, “did not want Lamborghinis, Rolls Royce, Porsches, Ferraris and the like held in their true names because it would bring unwanted attention to their unexplained wealth as unemployed young men.”

The houses. Another launderer admitted getting mansions for the crew. In his signed statement, he admitted the members were unemployed young men who “did not want to draw law enforcement attention for renting homes for $40,000 - $80,000 per month with no legitimate income.” Some of those homes, according to Zillow, were valued “between $4,000,000 up to nearly $9,000,000.” He admitted using “fake identification documents or stolen identity documents to complete the rental transactions to conceal the true owners of the homes.”

For one Los Angeles house, prosecutors say, about $3 million in cryptocurrency was laundered so the alleged ringleader could obtain it. The realtor, the indictment says, put the home under the name of a 55-year-old man living at the residence with his family, “all in an effort to conceal” who was paying and who owned it. That man is not a defendant.

The trips. The launderer’s statement also describes an earlier trip, in the spring of 2024, before this theft: another member used stolen cryptocurrency to rent two mansions in the Hamptons, along with about ten exotic cars, commercial flights for at least ten people and private flights for six more.

Every one of those steps put the money in more hands: a courier, a launderer, a promoter, a paid signer, a realtor. Not all of them were charged, and the launderer who arranged the leases admitted using fake or stolen identity documents — so a name on a lease is not proof that its owner took part. Stealing it took a handful of people. Spending it took many more hands — and every one of them was a potential witness.

How did the spending end?

With a phone in the water. On or about 13 September 2024 — five days before his arrest — prosecutors say the alleged ringleader wrote to a group chat that “the fbi better arrest me before October,” and that if not, “we will make 50m ++ before December.”

Two of his associates, prosecutors say, then discussed his recent spending: over 30 cars, multiple homes in Miami and Los Angeles, “a two-million-dollar watch,” and the private jets he rented to fly friends from Los Angeles to Miami.

Then, the indictment says, he got a tip from an off-duty law enforcement officer that agents were on their way to arrest him. He “walked to the rear of his Miami rental home and tossed his mobile telephone off the boat dock and into Biscayne Bay to destroy incriminating evidence,” prosecutors say. While FBI agents searched the house, another member allegedly watched them remotely through the home’s security cameras.

He was arrested in Miami on 18 September 2024, one month after the theft. (A 2026 Justice Department release gives the year as 2025; the indictment and earlier releases say 2024.) Around that day, according to his plea agreement, he voluntarily transferred cryptocurrency into FBI custody. The agreement does not say how much.

What was there to seize. The forfeiture list in the current indictment includes 11 cars and cash in bags — one bag alone held $275,212 — along with watches, firearms that prosecutors say members obtained for protection from rival cybercrime groups, and 17 crypto entries, the largest about 1,033 ether, valued in the indictment at about $4.27 million. An earlier version of the indictment listed 28 cars for forfeiture, without saying whose; the same 28 appear in a co-defendant’s consent forfeiture order.

Not everything was found. After the arrest, prosecutors say, an associate told him over a recorded line, while he was in a Miami jail, that law enforcement had not recovered all of his cars. And from jail, they say, the money kept moving: members used his funds to buy luxury handbags for a girlfriend and to pay for his defense team.

What did the alleged ringleader plead guilty to?

One count of racketeering (RICO) conspiracy — Count 1 of the second superseding indictment — on 8 September 2026, according to the court docket, which records pleas of not guilty on two other counts. The agreement he signed says: “I am pleading guilty because I am in fact guilty of the offense(s) identified in this Agreement.”

What else the agreement says:

• The ceiling. The charge “carries a maximum sentence of 20 years.” The agreement estimates a guidelines range of 324 to 405 months, which exceeds that maximum, so the estimated range becomes 240 months. That is an estimate, not a sentence. The judge decides.
• The role. “Defense counsel reserves the right to argue at sentencing that the aggravating role enhancement does not apply.” Ringleader is the prosecutors’ word.
• The money. He agreed the victim is owed approximately $245,093,239 in restitution, and he agreed to a forfeiture money judgment in the same amount.
• The cars. He agreed to keep helping law enforcement locate the cars he had described in interviews.
• Deportation. The agreement says his plea makes it “very likely” that his deportation from the United States is “presumptively mandatory.”

He has not been sentenced. The docket sets a status report for 8 December 2026; no sentencing date appears in the public entries we read, the latest dated 18 September 2026.

What happened to the others?

Before the alleged ringleader pleaded, others had. By December 2025, prosecutors said, nine defendants had pleaded guilty, and two more had been arrested in Dubai on related charges. By May 2026, three had been sentenced:

• 78 months in prison for one member who, prosecutors say, helped with the laundering and, they say, the occasional break-in. The judgment also ordered $2.5 million in restitution. Prosecutors said he bought more than $255,000 in designer clothing for others in the crew with stolen funds.
• 70 months in prison for the launderer who admitted arranging rental homes with fake documents (judgment).
• 36 months of probation for a third defendant, sentenced for obstruction. No prison.

Is the victim being paid?

Nothing in the records we could read says so. The plea agreement gives a number for what is owed — approximately $245,093,239 — and none for what has been paid. Owed is not paid.

Two different things are easy to confuse here. A forfeiture judgment lets the government take property: cars, watches, cash in bags, crypto. Restitution is what a defendant owes the victim. They are separate lines on the same bill, and none of the court records we could read says how much of either has reached the man in Washington. Our article on who else is claiming the seized money shows how long the road from seized property to a victim can be.

How to spot it

An alert, then a call. Counter-test: if a security alert about your account arrives and a “support” call follows, treat them as one event. Prosecutors say this crew sent unauthorized-access alerts ahead of its calls on purpose, so the call would seem more legitimate. The alert makes the call feel like the answer.

The claim that your account is under attack and the caller is helping secure it. Counter-test: hang up and look up the company’s number yourself. That is the line the crew’s callers used, according to the indictment.

A request for a code, a password or a PIN. Counter-test: ask yourself who started the conversation. The FBI and prosecutors, in a November 2025 Justice Department release on this case, advise: “Do not reply to calls, emails, or texts that request personal information, such as your password, PIN, or any one-time passwords that are sent to your email or phone.”

A request to install something. Counter-test: no unexpected caller needs access to your computer. For the $245 million theft, the indictment says, the man was convinced to download a program that let the crew in remotely.

What to do if it already happened

Report it to the FBI’s Internet Crime Complaint Center at ic3.gov — type the address into your browser yourself.

If someone claiming to be a company asks you for a code, start a new call. The same 2025 release says: “you should initiate a new call to that company by dialing the company’s verified customer service line.” Not the number that called you.

Be careful with anyone who offers to get it back for a fee. In this case, what is owed to the victim was set in a federal plea agreement and forfeiture runs through a federal court; no private company charging the victim appears in these records. Our article on where scam money goes quotes the FBI’s warning about “recovery” offers.

Know what a freeze means. Seized or forfeited property is not money returned. In this case the restitution is owed, and no record we read shows it paid.

How to not be next

The money in these records moved fast and through many hands: a courier with grocery bags, a launderer taking 10%, a promoter taking up to 20%, a stranger paid to sign a car title, a lease in someone else’s name. None of that can be undone from the victim’s side. The one step a victim controls is the first one — the call that says your account is under attack. If support calls you out of the blue, hang up. Then call the company yourself, on its verified line.

Everything here comes from the public record of case No. 1:24-cr-00417 in the U.S. District Court for the District of Columbia: the second superseding indictment, the plea agreement, three signed statements of offense, two judgments, a consent forfeiture order and the docket, plus Justice Department releases from 2024 to 2026. No victim or defendant is named; what prosecutors say is allegation, what a defendant admitted binds only that defendant, and the alleged ringleader has not been sentenced.