In Irvine, California man, Kunal Mehta (known by aliases like “Papa,” “The Accountant,” and “Shrek”), has become the eighth individual to plead guilty in connection with a large-scale, cyber-enabled racketeering and money laundering scheme that resulted in the theft of $230 million in cryptocurrency. Mehta, aged 45, admitted to his role in laundering at least $25 million of the stolen funds.
The criminal enterprise, whose members included young adults mostly between 18 and 20 years old, was organized across California, Connecticut, New York, Florida, and international locations, reportedly forming through friendships developed while playing online games. According to court documents, the group employed social engineering techniques to gain unauthorized access to victims’ cryptocurrency accounts between October 2023 and March 2025, subsequently transferring the funds to wallets they controlled. The group’s operation was sophisticated, with different members specializing in organizing, identifying targets, hacking, making calls, stealing hardware crypto wallets, and, in Mehta’s case, money laundering.
In total, fourteen suspects have been charged for their alleged involvement in the massive theft and subsequent laundering of the $230 million in crypto. Among those charged are Malone Lam (20, aka “Greavys” and “$$$”) and Jeandiel Serrano (21, aka “Box” and “VersaceGod”), who were arrested in Miami in September 2024. The charges against the defendants include cyber-enabled racketeering conspiracy and conspiracy to commit money laundering.
The indictment filed in May 2025 also includes charges of obstruction of justice and conspiracy to commit wire fraud for several defendants, including Marlon Ferro (19), Hamza Doost (21), Conor Flansburg (21), Ethan Yarally (18), Cody Demirtas (19), Aakash Anand (22), Evan Tangeman (21), Joel Cortes (21), John Tucker Desmond (19), and two individuals known only by aliases “Chen” and “Danny.” These individuals represent a significant portion of the ring’s membership, which coordinated the multi-state and international crime.
A prime example of the ring’s activities involved Lam and an accomplice who, in an August 18th attack, stole over 4,100 Bitcoin from a Washington, D.C., victim. The value of the stolen Bitcoin was over $230 million at the time of the theft, now estimated to be worth more than $384.5 million. To conceal the origins and destination of the funds, the criminals reportedly employed complex laundering techniques, utilizing crypto mixers, various exchanges, “peel chains,” and pass-through wallets, while also using Virtual Private Networks (VPNs) to mask their locations and identities.
Reference:
