researchismOn a Sunday night in August 2024, a man in Washington, D.C., picked up a call from someone who said he was from Google support. Before the night was over, about $245 million in bitcoin was gone, and nobody had cracked his wallet.
Using court records and the public bitcoin ledger, we trace how a few phone calls pulled it off, how the money was spent, and how its trail started to point back at the people who took it.
How to read our sources
In the film, a small dot lights up where a claim is made, then slides into the right margin and becomes a note: a number, the source and its year. That number is the number below. researchism.tv/how-245-million-got-stolen/#5 takes you straight to source 5.
The brightness of the dot is our certainty, the lamp code:
Lit: established. A court finding, an admission in a plea, an official record.
Half: reported or alleged. Indictments, prosecutors’ claims, press reports, an investigator’s own account.
Dark: unknown or unverified. We looked and could not confirm it.
The dot rates the claim as the film makes it. A line like “prosecutors said” can be lit: the record proves they said it, not that it is true. The dot’s shape tells you what kind of source it is:
primary recordsecondary: press or an investigatortestimony or our own estimate
Every source shows when it was published and when we last looked at it. “Accessed” is the day we retrieved and read it. “Link checked” is the day its link last opened for us. Where a site blocks automated checks, we say that the link was not confirmed.
Sources
The 15 sources numbered on screen, in order. Timecodes show where each number appears in the film; the small dot is its brightness at that moment.
- 1
Statement of Offense in Support of Guilty Plea: Malone Lam (ECF 383)
Link checked
The facts Lam admitted as part of his guilty plea. Pages are shown in the film (victim’s initials and signatures masked).
established · reported or alleged at 2:39
In the film 0:57 2:39 3:08 3:25 3:29 3:44 3:52 6:57 9:36 10:15
- 2
Plea Agreement: Malone Lam (ECF 384)
Link checked
Also: courtlistener.com (PDF)
established
In the film 0:59
- 3
Consent Preliminary Order of Forfeiture: Malone Lam (ECF 381)
Link checked
Page 3 is shown in the film (vehicle numbers masked).
established
In the film 9:58
- 5
Second Superseding Indictment, redacted (ECF 245)
Link checked
Allegations, not proven.
Also: justice.gov, archived copy
reported or alleged
In the film 7:01 7:05 7:11
- 7
Indictment: United States v. Lam and Serrano (ECF 1)
Link checked
The charges are allegations; the fact that they were filed is on the record. Page 1 (with Lam’s listed nicknames) is shown in the film.
Also: courtlistener.com (PDF), archived copy
established
In the film 6:49
- 8
- 10
Government’s Memorandum in Support of Pretrial Detention: Jeandiel Serrano (ECF 13)
Link checked
The government’s account (Serrano has pleaded not guilty and is presumed innocent). Source of the October 2024 figures: about $70 million recovered or frozen, more than $100 million unaccounted for.
Also: courthousenews.com
established
In the film 7:54 9:55 10:02
- 16
Statement of Offense in Support of Guilty Plea: Veer Chetal (ECF 8)
Link checked
The facts Chetal admitted as part of his guilty plea. Page 9 is shown in the film.
established · reported or alleged at 2:40
In the film 0:57 2:40 6:38 6:43 9:37
- 17
Docket: United States v. Chetal, No. 1:24-cr-494
Accessed
Chetal is the 18th person in the tally: charged in his own case, not in No. 1:24-cr-417. In the film the 17 sits as a superscript on “18 charged”.
established
In the film 8:59
- 22
“Indictment Charges Two in $230 Million Cryptocurrency Scam”
Link checked
Shown in the film as a typeset recreation of its text.
Also: irs.gov
established
In the film 3:58
- 32
Bitcoin transaction e747b9…6360: 59.3421727 BTC
Link checked
Our own check of the public ledger. The transaction ID is shortened to protect the victim; the link opens the block it is in.
established
In the film 2:58 3:21 3:27
- 33
Bitcoin transaction 4b277b…9090: 4,064.37690829 BTC (6 inputs)
Link checked
Our own check. With #32: 4,123.71908099 BTC, which matches the court papers (#1) to the last decimal. ID shortened, link opens the block.
established
In the film 3:14 3:27
- 37
Thread on the theft of $243 million from a single victim
Link checked
The investigator’s own account. Post 3 of the thread carries the leaked screen recording (#84).
Also: threadreaderapp.com
reported or alleged
In the film 3:36
- 53
Link checked
Source of the first subtitle over the leaked recording, in Fortune’s wording. The second subtitle (“yo! we’re done! we’re done!”) is our own transcription; the speakers are not identified. That this was the “first Bitcoin RICO case” is Fortune’s claim; we could not verify it.
reported or alleged
In the film 3:39
- 85
Bitcoin flow graph (TRM): how the stolen coins were merged and split
Accessed · link checked
Shows the stolen coins merged into one transaction (#33) and split across new wallets the same night. In the film it follows the five-way split Lam admitted (#1); the graph itself does not show who received which share.
established
In the film 3:50
Further reading
Everything else we used to research this episode, with the same numbering. These do not appear with a number in the film.
Court records
- 4
Docket: United States v. Lam et al., No. 1:24-cr-417
Accessed
Basis of the case tally in the film (18 charged, 11 pleaded guilty, 3 sentenced).
Also: courtlistener.com, courtlistener.com (2)
Named in the film 8:57
- 6
- 9
Rule 5 documents from the Southern District of Florida: Malone Lam (ECF 6)
Link checked
Papers from Lam’s first court appearance in Miami.
- 11
- 12
- 13
- 14
Link checked
Checked; not relied on for any claim in the film.
Also: courtlistener.com (PDF), courtlistener.com (PDF) (2), courtlistener.com (PDF) (3)
- 15
Information: Veer Chetal (ECF 2)
Link checked
- 18
Ex parte motion for revocation of release and bench warrant: Veer Chetal (ECF 13)
Link checked
Government allegations, later partly withdrawn (see #19).
- 19
- 20
- 21
- 81
Government’s Sentencing Memorandum: Adam Iza, United States v. Iza, No. 3:25-cr-30 (ECF 308)
Accessed · link checked
Source of the wording that police “chased down the van before it could reach its destination”. Not named on screen.
Used in the film 6:13
Government
- 23
Link checked
Its $263 million figure covers the wider group’s thefts, not this one theft.
Also: irs.gov
Named in the film 8:43
Used in the film 8:51
- 24
- 25
- 26
- 27
- 28
Accessed
The release dates Lam’s arrest “Sept. 18, 2025”; the correct year is 2024 (see #8).
Also: irs.gov, archived copy
Used in the film 0:34
- 29
“The Com: Theft, Extortion, and Violence are a Rising Threat to Youth Online”
Link checked
General background; does not name this case.
- 30
“Wellington-based man arrested in international cryptocurrency scam investigation”
Link checked
Does not name the man; we do not connect it to any defendant.
- 31
- 78
- 80
YouTube channel and press-conference page
Accessed · link checked
Checked: no video on this case.
Also: youtube.com
Ledger and data
- 34
Bitcoin transaction 5ebfb2…db8f: split into 2 × 2,032.138 BTC
Link checked
ID shortened, link opens the block.
- 35
Bitcoin transaction 7c7ebe…e9e3: 14.88161266 BTC
Link checked
Checked; an open question we did not use in the film. ID shortened, link opens the block.
- 36
BTC/USD price data: historical price for Aug. 19, 2024 (about 04:00 UTC) and spot price
Accessed · link checked
Used for our own conversions.
Also: mempool.space
Social media
Press
- 39
“Meet ZachXBT, the Masked Vigilante Tracking Down Billions in Crypto Scams and Thefts”
Link checked
ZachXBT’s account of the night he started tracing.
Named in the film 5:20
- 40
“Party’s over for crypto scammers who went on a spending spree after a $240 million bitcoin theft”
Link checked
Reports the judge’s “Ferris Bueller” remark at Lam’s first hearing.
Also: archived copy, archived copy (2)
Named in the film 8:16
- 41
- 42
“Lamborghini Carjackers Lured by $243M Cyberheist”
Link checked
Shown as a press clipping; also ties the @malone.lv account to Lam.
Named in the film 6:13
- 43
“Man Sentenced For Danbury Kidnapping Bitcoin Robbery”
Link checked
Shown as a press clipping.
Named in the film 6:21
- 44
- 45
[Report on the sentencing in the Danbury kidnapping case]
Link not confirmed on : the site blocks automated checks
- 46
- 47
[Report on the eXch shutdown and asset seizure]
Link checked
- 48
- 49
[Report on the TradeOgre seizure]
Link checked
- 50
“Bitcoin Investor Loses $91 Million to Social Engineering Scam: ZachXBT”
Link checked
A separate case; background only.
- 51
[Early report on the theft, the day it happened]
Link checked
- 52
- 54
- 55
Link not confirmed on : the site blocks automated checks
- 56
“FBI raids luxury home in Miami, neighbors see ‘really fancy cars’ taken away”
Link checked
Source of the neighbors’ quote.
Named in the film 7:43
- 57
- 58
“They Stole a Quarter-Billion in Crypto and Got Caught Within a Month”
Link not confirmed on : the site blocks automated checks
- 59
- 60
Other
Image and footage credits
Unless a license is listed, third-party photos and clips appear under fair use (17 U.S.C. § 107) for news reporting and commentary: short excerpts, framed and desaturated, discussed by our narration, with the source named on screen. We do not use news agency photos or pool footage.
Faces of bystanders, guests, guards and people who are only charged are blurred, as are license plates, house numbers, street signs, handles and wallet details. Third-party audio is muted, with one exception noted below (#84).
Court records and government documents
Public records, shown as page excerpts. The victim’s initials, signatures and vehicle numbers are masked. The 2024 press release appears as a typeset recreation of its text.
Listed under Sources above: Lam’s statement of offense 1, forfeiture order 3, second superseding indictment 5, 2024 indictment 7, arrest warrant 8, Chetal’s statement of offense 16.
- 22
“Indictment Charges Two in $230 Million Cryptocurrency Scam”
In the film 5:55 8:08
Government photos
- 62
Link checked
Public domain (Florida government record, as tagged on Wikimedia Commons)
Also: commons.wikimedia.org
In the film 0:34 7:39
- 76
Evidence photos released with the plea announcement (#28): cars, a house and a driveway
Link checked
Fair use. The DOJ does not say who took the photos, so we do not claim public domain. Muted color; license plates and background figures blurred; no address or house number in frame.
Also: justice.gov, justice.gov (2), justice.gov (3)
In the film 4:45 4:48 7:34
- 95
Photos of watches seized in the case
Accessed · link checked
Posted by a U.S. government office; likely public domain, but the photographer is not stated, so we also treat it as fair use.
In the film 4:53 7:34
- 111
Defendants table from the May 15, 2025 release (#23)
Accessed · link checked
U.S. government content. Every name, age and hometown blurred: most people listed are only charged.
In the film 8:43
- 63
- 71
“Miami skyline from Biscayne Bay, Florida (LCCN 2011634548)”
Link checked
Public domain
In the film 7:10
- 105
“Aurora Borealis and eastern United States at Night”
Accessed · link checked
Public domain
In the film 1:48
.png){kind=link}
Social media
- 82
Instagram @malone.lv: profile and a post of Apr. 22, 2024
Accessed · link checked
Fair use. The account was tied to Lam by ZachXBT (#37) and Krebs on Security (#42). Everyone else in the photo is blurred.
In the film 1:19 9:13
- 83
Leaked group-chat screenshot from the night of the theft
Accessed · link checked
Fair use. Handles and every wallet, app and exchange detail blurred.
In the film 2:45
- 84
Leaked screen recording from the night of the theft
Accessed · link checked
Fair use. The only third-party audio in the film: a few seconds of the group’s voices. Dollar figures, chat names and offensive language are cut or blurred.
In the film 3:12 3:34
- 85
Bitcoin flow graph (TRM): how the stolen coins were merged and split
Fair use. Exchange names, addresses and timestamps blurred.
In the film 3:43
- 86
Frame from the leaked screen share
Accessed · link checked
Fair use. Everything but one corner of the screen is blurred, the name itself included.
In the film 5:41
- 87
Accessed · link checked
Fair use. Faces of guards and guests blurred.
In the film 4:30 4:36 4:53
- 88
Club images from friends’ Instagram stories (signs reading “@MALONE” in Los Angeles and Miami)
Accessed · link checked
Fair use. Guests’ faces blurred. No artist named on a sign is connected to the case.
In the film 4:14 5:07 5:50 9:13
- 89
Investigation map linking photos, chats and places
Accessed · link checked
Fair use. Address text blurred.
In the film 8:08
- 90
Club with letter boards spelling “MALONE” and money raining over the crowd
Accessed · link checked
Fair use. Faces blurred.
Also: thestar.com.my
In the film 4:14
- 91
White Lamborghini with “MALONE” on the door
Accessed · link checked
Fair use. Driver not identified; plate blurred.
In the film 4:36
- 92
Accessed · link checked
Fair use. The posters say the clips show Lam’s parties; we could not verify that, and the on-screen caption says so. Faces blurred, audio muted.
In the film 4:14 4:20 4:36 5:11
- 93
Club clip: sparkler bottles over a crowd
Accessed · link checked
Fair use. Said to show a party for Lam; unverified. Faces blurred, audio muted.
In the film 4:14
- 94
Phone screenshot of a club bill tagged @vendome.miami
Accessed · link checked
Fair use. Said to be from a Lam party; unverified. Server’s name and check number blurred, audio muted.
In the film 4:26
News footage
- 96
Report on Lam and the theft, with club footage credited to Instagram and social media
Accessed · link checked
Fair use. Station graphics cropped, faces blurred, audio muted.
In the film 0:39 4:20
- 97
“Another day in Miami: FBI raids luxury home with long guns, tactical gear”
Accessed · link checked
Fair use. No address, house number, street sign or face in frame; audio muted.
Also: wsvn.com
In the film 0:39 4:48 7:16 7:25
- 98
Report on the theft and the raid (club video credited to @gogetta80, raid-night footage)
Accessed · link checked
Fair use. Faces blurred, audio muted.
In the film 4:20 7:43
- 99
Bystander phone video of the raid night
Accessed · link checked
Fair use. Station graphics cropped, no house or street sign, audio muted.
Also: cbsnews.com
In the film 7:16
- 100
Raid-night street: tow truck and police
Accessed · link checked
Fair use. Faces and plates blurred, audio muted.
In the film 7:43
- 101
Accessed · link checked
Fair use. Plates blurred, audio muted.
In the film 6:13
- 102
Bystander video of the Danbury police scene, Aug. 25, 2024
Accessed · link checked
Fair use. Plates and officers’ faces blurred, audio muted.
In the film 6:13
Licensed photos and footage
- 67
“E. Barrett Prettyman United States Courthouse – 2026”
Link checked
CC BY 4.0 · color-graded and cropped by us
In the film 9:20
- 103
Singapore at night, Marina Bay
Accessed · link checked
CC BY 3.0 · trimmed and color-graded by us
In the film 1:01
- 104
- 106
- 107
Downtown Los Angeles at night (drone)
Accessed · link checked
CC BY 3.0 · trimmed and color-graded by us
In the film 4:08
- 108
- 110
“LAX Theme Building and moon from northwest”
Accessed · link checked
CC0 · illustrative
In the film 7:56
.jpg){kind=link}
.jpg){kind=link}
Maps
- 112
Accessed · link checked
Map data © OpenStreetMap contributors (ODbL 1.0)
In the film 1:57 4:08 4:48 5:07 6:07 6:54 7:56 9:07
- 79
- Map data
- Map data © OpenStreetMap contributors (ODbL). Land and border outlines: Natural Earth (public domain).
- Voice, music, sound
- The narration is an AI voice (ElevenLabs), reading our script. Original music and sound effects were generated with ElevenLabs and edited and mixed by us.
- 3D and graphics
- 3D scenes, reconstructions, maps and graphics: researchism. Reconstructions and illustrations are labeled on screen.
- Type
- Fraunces, Source Serif 4 and Charis SIL (SIL Open Font License).
Checked, not used in the film
- 64
- 65
“E. Barrett Prettyman Federal Courthouse, DC”
Link checked
- 66
- 68
E. Barrett Prettyman courthouse, front entrance
Link checked
- 69
Aerial view of Washington, D.C. (LCCN 2011632786)
Link checked
- 70
Prettyman courthouse exterior and courtroom (items 2017656621, 2017656632)
Link not confirmed on : the site blocks automated checks
- 72
“The city lights of Miami, Florida (iss072e399013)”
Link checked
- 73
“Florida Peninsula at night (ISS041-E-74232)”
Link checked
- 74
“View of Washington, D.C. (ISS026-E-10839)”
Link checked
- 75
“Miami – City Skyline from Biscayne Bay 1”
Link checked
- 77
- 109
“Danbury, Connecticut downtown aerial view”
Accessed · link checked
.jpg){kind=link}
.JPG){kind=link}
Legal status
as of the last public court records shown in the film: Sept. 18, 2026
Status checked : no change since Sept. 18, 2026.
- 18 people have been charged: 17 in United States v. Lam et al. (No. 1:24-cr-417) and Veer Chetal in a separate case (No. 1:24-cr-494). #4 #17
- 11 of them have pleaded guilty, among them Malone Lam (Sept. 8, 2026) and Veer Chetal (Nov. 2024, under a cooperation agreement). #1 #16
- 3 of them have been sentenced. Lam has not been sentenced; he faces up to 20 years in prison. Chetal has not been sentenced either. #2 #11 #12 #13 #17
- Jeandiel Serrano, named in the film as the alleged “Gemini” caller, has pleaded not guilty. #4
Everyone who has not pleaded guilty or been found guilty is presumed innocent. Indictments and prosecutors’ statements are allegations, not proof.
The victim is not named in the film or on this page. That is our choice.
What we checked on Oct. 22, 2026: the dockets of both cases on CourtListener / RECAP, which copy the court’s public docket feed; the press releases of the U.S. Attorney’s Office for the District of Columbia; and press reports since Sept. 18, 2026. This covers public entries up to the evening of Oct. 21, 2026, Eastern Time. Sealed filings do not appear there, and we did not search PACER, the court’s paid records system.
Dockets via CourtListener / RECAP: No. 1:24-cr-417, last public filing Sept. 18, 2026; No. 1:24-cr-494, last public filing Apr. 29, 2026 (both re-checked Oct. 22, 2026: no new public entries). Court records change; when they do, we update this box and log it below.
Corrections
Spotted an error? contact@researchism.tv
Tell us the source number or the timecode. We fix mistakes on this page and log every change here.
- Page created.
- Court status re-checked: no change since Sept. 18, 2026. Source links checked. Page published.