22-year-old guy teamed up with friends to steal $245M in BTC

[tbct_mt2]

Malone Lam, a 22-year-old from Singapore, pleaded guilty to stealing $245 million worth of Bitcoin from a Washington resident. The incident occurred two years ago: his accomplices, posing as employees of Google and Gemini, tricked the victim into granting access to their Google Drive and stole 4,100 Bitcoin.

Long story short, ok it's Google Drive, a cloud storage service.

It means that the victim stored something important online, on Google Drive, and it was accessed by Malone Lam. Not only this, "revealing security code" that sounds vague information but it can be something relates to security of something like emails, wallets but whatever in the end, the attacker stoled 4,100 bitcoin.

The victim ignored many risks: store backups of important things online, in Google Drive, it is never recommended. Second and very risky, it's not a hacked but it was shared by the victim to attacker.

https://www.chainsec.io/checklist

⛔ DON’Ts
    Don’t save your recovery seed digitally. Avoid .txt files, documents, email drafts, notes apps, or any digital storage.

The dos and don'ts of bitcoin key management.

Don't create technical weaknesses

Most users should not store private key backups digitally; especially not in an online service. While it is possible to create secure digital backups, you need to be an advanced user in order to so safely.

[Emjay24]

I'm kind of confused about why he had his Bitcoin stored on Google Drive. How and why would anyone store the keys to such a large amount of Bitcoin on Google Drive? Honestly, I feel the victim was partly responsible for what happened because it was unreasonable to keep such sensitive information that way.I don't understand why it's so difficult for people to simply write down their keys on paper and store them somewhere safe. He could have also bought a hardware wallet and kept his coins completely offline. Instead, he left the keys on his Google Drive, on a PC that he regularly uses online. It's really unfortunate, but I can't feel too sorry for him. Sometimes, people have to learn the hard way so they don't make the same mistakes again.

To me this story remains incomplete, there is an insider who informed them the man stored his keys in his drive, the operation was very specific to compromise his drive and not a random social engineering attempt. I feel there's more to the case than was reported in the news. Most people think these online drives are safe, but sadly they aren't. Nothing beats offline storage of your keys, that's the only way your keys would be off the radar of scammers.

My only regret in the whole scenario is that the recovered BTC, if any might not go to the man, but the government. Recoveries are now looking as a way people's assets legally becomes government properties.

[Felicity_Tide]

What I more curious about is how those guys able to know that their victim have a huge crypto assets. Wondering if they study or monitor him somewhere or online? Also I kinda agreed that the victim shouldnt store his asset on a google drive especially when the amount you have was quite huge.

This is actually old news, and I'm quite surprised that it took so long for the court to reach a verdict because I remember reading about this very case sometime last year. From what I remember, their target was a somewhat a prominent person who was involved in tech/crypto_{(don't know how true)}. And what even makes it crazier is that the scammers weren't even sophisticated hackers or tech geniuses according to reports. This was literally one of the biggest social engineering scams I've seen, and I remember spending a lot of time following up on the case.

But I dont agreed that he should be the one to blame cause his only a victim and the fault should solely went to the criminals who stole his asset.

I personally would blame the victim in the case. The whole social engineering technique only gave them access to his Google account, but they were lucky enough to find wallet information lying around freely. I can bet that even the victims hardware wallet came with strict instructions that says something like... "Don't store seedphrase online". It's quite an unfortunate situation.

[Freeveto]

I'm kind of confused about why he had his Bitcoin stored on Google Drive. How and why would anyone store the keys to such a large amount of Bitcoin on Google Drive? Honestly, I feel the victim was partly responsible for what happened because it was unreasonable to keep such sensitive information that way.I don't understand why it's so difficult for people to simply write down their keys on paper and store them somewhere safe. He could have also bought a hardware wallet and kept his coins completely offline. Instead, he left the keys on his Google Drive, on a PC that he regularly uses online. It's really unfortunate, but I can't feel too sorry for him. Sometimes, people have to learn the hard way so they don't make the same mistakes again.

The victim should be responsible, if he could have kept his keys in a private place and not online or anywhere close where someone who come to work for you can access, he ignored so many risks despite having this amount of Bitcoin, he might thinks that it secure in the google drive and failed to do proper backup.

Nevertheless, it’s a sad news and this the reason why it is impirtant to know how and where to keep your BTC safe, just having the money to buy Bitcoin is not enough, take it upon yourself as a responsibility to secure and safeguard your Bitcoin because no one will do that for you.

[Zoomic]

Incidents like this helps to highlight how important it is to protect your keys, self-custody doesn't just end with "I have the private keys".

For an attacker to be able to compromise one Google account and steal every detail that was needed to transfer over 4k BTC, it simply means the security model of the wallet was too vulnerable.

 While we frown at incidents like this, it's important for others to learn from them and improve how we secure our keys so we don't end up in similar situation.

[Z_MBFM]

Malone Lam, a 22-year-old from Singapore, pleaded guilty to stealing $245 million worth of Bitcoin from a Washington resident. The incident occurred two years ago: his accomplices, posing as employees of Google and Gemini, tricked the victim into granting access to their Google Drive and stole 4,100 Bitcoin.
Lam then laundered the stolen funds, spending millions in a single month on thirty sports cars, mansions, and nightclubs.
Today he pleaded guilty, and now he faces up to twenty years in prison.

$245M is a huge amount so it needed to be secured to the highest level. How could he have put these in a place like Google Drive? How could he trust Google Drive and keep his wallet there when his Gmail could be hacked, his Gmail could be disabled. His activity make it seem like he is really crazy. I never have more than a few thousand dollars in my wallet, yet I dare not put the private key of that wallet in an online store like Google Drive. Here is a person who has kept such a large amount of Bitcoin in Google Drive. I am surprised to think about it. The victim of this incident should have been held responsible. And everyone should learn a lesson from this incident. Not your key not your Bitcoin

[Nwada001]

Is 20 years prison sentence even enough for someone that committed such a crime, maybe it's enough if he can also return all those stolen Bitcoin to the victim. I just have this suggestion that any time these set of scammers is being caught, they should be made to return all those stolen Bitcoin to the victim or risk serving a lifetime prison sentence.  I think this could make other scammers to be afraid when they think of being caught if they commit such crime.

If those coins are safely stored somewhere and not spent, then what you suggest will definitely be one of the top options that will be used, but in a situation where the scammer has spent most of the bitcoin, the only thing that will be left to force him to do is for the court to grant the right authority access to sell off any property linked to the criminal, including but not limited to what the stolen fund was used to acquire, and a sentence that will help them reflect on the crime they have committed.

[Antotena]

Of course the victims of this scam should be blamed to an extent, I mean for someone in possession of that huge amount of bitcoin should definitely try to atleast know more about privacy and security, I sometimes wonder how people are a bit careless with their privacy regardless of how they were able to earn huge amounts of bitcoin. Even if you inherited your bitcoin from your someone, I think learning how to keep them not exposed to this kind of scam is a primary responsibility that you have to take on.

However, if you have bitcoin and you do not learn how to keep them safe, then you should be ready to face scandals like this and you should have you’re self to be blamed, in my opinion there is no excuse for being this careless. It’s not ignorance its simply irresponsible.

The victims are consequences of lack of orientation, they lack exposure to how scammers can impersonate people. You can be in their shoe, have the same large quantity of Bitcoin and when they try to scam you with phishing and impersonation, you may not fall for any of them because you are oriented about how they do the scams. Some people just understand how to buy Bitcoin and hold it, they don't have any clue on what to do to protect them against scam.

What's appalling about this scam is that this could be protected with reading of seed phrase and how to keep Bitcoin in a self custody but they didn't. It shocking everyday when you see different type of scams coming up each day and it looks like people that have money to invest in Bitcoin don't invest on security, it's people that have less money on Bitcoin that don't play around with security and practice self custody of wallet instead of online wallet.

[lionheart78]

I'm kind of confused about why he had his Bitcoin stored on Google Drive. How and why would anyone store the keys to such a large amount of Bitcoin on Google Drive? Honestly, I feel the victim was partly responsible for what happened because it was unreasonable to keep such sensitive information that way.I don't understand why it's so difficult for people to simply write down their keys on paper and store them somewhere safe. He could have also bought a hardware wallet and kept his coins completely offline. Instead, he left the keys on his Google Drive, on a PC that he regularly uses online. It's really unfortunate, but I can't feel too sorry for him. Sometimes, people have to learn the hard way so they don't make the same mistakes again.

There is always an uninformed person, and there is always a person who thinks that Google's service is worth trusting.  I personally won't use Google Drive to save anything sensitive, but there are always people who do not think one or two steps ahead.  What they think is about convenience and for exchanging security for this, that person paid a huge price.

My only regret in the whole scenario is that the recovered BTC, if any might not go to the man, but the government. Recoveries are now looking as a way people's assets legally becomes government properties.

I believe the recovered amount will be given to the victim.  The estate has no right to keep the funds unless they find the funds "dirty".

[red4slash]

I'm kind of confused about why he had his Bitcoin stored on Google Drive. How and why would anyone store the keys to such a large amount of Bitcoin on Google Drive? Honestly, I feel the victim was partly responsible for what happened because it was unreasonable to keep such sensitive information that way.I don't understand why it's so difficult for people to simply write down their keys on paper and store them somewhere safe. He could have also bought a hardware wallet and kept his coins completely offline. Instead, he left the keys on his Google Drive, on a PC that he regularly uses online. It's really unfortunate, but I can't feel too sorry for him. Sometimes, people have to learn the hard way so they don't make the same mistakes again.

A pattern that is always repeated because not only because the thief is clever and can trick but his victims are also careless with what they do where they leave their assets open without the slightest guard that makes the thief seem free to do anything.

A lot happens here, where the victim is careless by storing his assets on google drive whether it's just a seed or access to his email that makes 4100 bitcoin can be easily obtained, second, the ingenuity of Thieves by outsmarting careless people also needs to be taken as a concern because with this we should not believe too much in anything that claims to be an employee of a well-known company or an important person because here our carelessness will be much looser when we believe what the other person is saying and it actually makes us lose our vigilance and destroyed as happened to the victim.
When we want to be in bitcoin in the end it is not only about financial freedom and value that must be considered but how we secure the assets we have should remain the initial standard so that we do not lose the bitcoins we have because of our own carelessness.

[Obim34]

If those coins are safely stored somewhere and not spent, then what you suggest will definitely be one of the top options that will be used, but in a situation where the scammer has spent most of the bitcoin, the only thing that will be left to force him to do is for the court to grant the right authority access to sell off any property linked to the criminal, including but not limited to what the stolen fund was used to acquire, and a sentence that will help them reflect on the crime they have committed.

I think his properties will be seized, governments knows how to confiscate all the properties and how to compensate the victim. According to the starter of the topic, they spent most of the money buying sports cars, houses, and some other assets, all the properties will be tracked, and parts of the victim's money returned, It won't be possible to recover the whole amount that was stolen, at least some percentage of it will be recovered, and the victim will learn his lesson.

[Italian Panic]

Malone Lam, a 22-year-old from Singapore, pleaded guilty to stealing $245 million worth of Bitcoin from a Washington resident. The incident occurred two years ago: his accomplices, posing as employees of Google and Gemini, tricked the victim into granting access to their Google Drive and stole 4,100 Bitcoin.
Lam then laundered the stolen funds, spending millions in a single month on thirty sports cars, mansions, and nightclubs.

Unfortunately, it’s a story we’ve seen before: people with vast fortunes who keep their private keys stored in all sorts of places that are accessible to everyone or almost everyone. I don’t know how he could have trusted Google Drive with them.
 And history repeats itself with the thieves who then squander it all in nightclubs, on wild parties and superficial things. Perhaps we’d do the same, I’m not saying we wouldn’t, but at least we’d keep a low profile, because it’s possible to live the high life whilst keeping a low profile.

[noorman0]

To me this story remains incomplete, there is an insider who informed them the man stored his keys in his drive, the operation was very specific to compromise his drive and not a random social engineering attempt.

The media won't go into that much detail; once they’ve latched onto something to headline the story, the rest often becomes an afterthought. Mentioning 4,100 bitcoins and Google Drive is enough to entice readers to click on the article.

After all, someone with that much wealth really shouldn't be talking or interacting much on social media.

[Hamza2424]

Why we always heard things like someone pretend to be google employee, someone pretend to be a Google customer service.. Why people trust google so much that they even store their seed phrase in Google cloud. Don't they know that hackers can access their data easily. Google is being used worldwide and billions of user use their products that doesn't mean we can blindly trust their system.

Or maybe they just didn't expect that someone would come after their money thats why they didn't practice or learn how to protect their fund. I saw some people who are so careful that they would buy a HW even if they don't have more that $1K in their balance.

Hmm bro, he did not lose the seed phrase because they impersonated a Google employee. The attackers also impersonated the exchange support, which although they came to learn from the drive to which he gave access.

We should think twice at least and not panic when it is about money, and that's the reason when you have a lot of money that can change your life and you don't care at all because you make it easily by just holding and don't even care about the security, you tend to lose it easily.

Less knowledge is the only explanation that can make someone give away their computer access knowingly.

[Cryptomultiplier]

Malone Lam, a 22-year-old from Singapore, pleaded guilty to stealing $245 million worth of Bitcoin from a Washington resident. The incident occurred two years ago: his accomplices, posing as employees of Google and Gemini, tricked the victim into granting access to their Google Drive and stole 4,100 Bitcoin.
Lam then laundered the stolen funds, spending millions in a single month on thirty sports cars, mansions, and nightclubs.

Unfortunately, it’s a story we’ve seen before: people with vast fortunes who keep their private keys stored in all sorts of places that are accessible to everyone or almost everyone. I don’t know how he could have trusted Google Drive with them.
 And history repeats itself with the thieves who then squander it all in nightclubs, on wild parties and superficial things. Perhaps we’d do the same, I’m not saying we wouldn’t, but at least we’d keep a low profile, because it’s possible to live the high life whilst keeping a low profile.

I still get bewildered when I see such cases of people keeping large sums in online storage despite all this talk of security.
The worst is that I am surprised how people can just trust a total stranger they met online from maybe a platform of sort and even be trusting enough to share their secrets mostly as regards their financial capacity.

It's funny really, but it's still a point to note how fraudsters can be very convincing when they apply their social engineering tactics with even fake proof just to appear legit and anyone can fall victim, but am sure if this victim shared this knowledge with someone they trusted in real life of good reputation, this issue would have been avoided, but am sure the victim is lucky and happy because at least he could recover his possession with the seized and frozen asset found on the perpetrator.

Being discreet with wrong doings is a crime still and if caught, it wouldn't matter if the perpetrator was a lavish spender or a secret spender, what would matter is the punishment and penalty that would be meted out according to law, as a deterrent to others.

[Maslate]

Regardless of what kind of investment you have, the only person you can trust is yourself. Most especially if you are holding massive amount of bitcoin, the more that you have to be cautious and protect yourself from all those tricks and scams where everything is happening online. That is why if you can keep all your investments offline, that would be the best idea so that no one can access your private keys or seed phrase while trying to hack your account.

And also, never flaunt your bitcoin online, or advertise yourself that you are into bitcoin. The more you become open to the public, the higher the chances you'll end up the target of hacking or scamming.

[Ojima-ojo]

Regardless of what kind of investment you have, the only person you can trust is yourself. Most especially if you are holding massive amount of bitcoin, the more that you have to be cautious and protect yourself from all those tricks and scams where everything is happening online. That is why if you can keep all your investments offline, that would be the best idea so that no one can access your private keys or seed phrase while trying to hack your account.

In this case the victim trusted himself enough but he was dumb in a way that he allowed another person access into his Google account to steal his private keys, another bad idea is storing your Bitcoin wallet keys on an online storage like Google.

And also, never flaunt your bitcoin online, or advertise yourself that you are into bitcoin. The more you become open to the public, the higher the chances you'll end up the target of hacking or scamming.

This case point out something very important, is either he got exposed through his own doing, or someone close him, I mean an insider have given him away like sharing his wallet information and other sensitive public informations to the hacker.

[macson]

Spending that much money and thinking he wouldn't be tracked, I think that's the definition of an arrogant brat. He thought he was so clever after outwitting someone so ignorant about security, and he finally got what he deserved.

I really don’t like victim blaming, but when you have that much bitcoin in your wallets you have to be extremely cautious. It beats me how someone accumulated so much money and yet isn’t bothered to learn how to protect their assets.

There are so many people like that. They think storing their seed phrases in cloud storage is perfectly safe, perhaps because it's encrypted and comes from a reputable company. But they don't realize how risky it is. No matter how good cloud storage is, it's not a recommended way to secure your seed phrases. If the victim had a good understanding of security, this could have been prevented.

[JiiBs]

That was a great steal and a lot of money. When you eventually go from zero to millions in dollars to the point that, you are that super reach, you are faced immediately with the rich man problem on how to stay above the radial and not get into government focused. You start to find means to utilize the money and not getting the right means would always result in questions, what’s the source, where are your tax records and more of those.

They might have tried mansions and luxury cars but, the big question of how and tax would always be there, prompting attention, an investigation and an arrest. Didn’t follow up the story in full but again, people just have to be well aware of this support scam techniques to always verify whatever from a source known to them already.

[Churchillvv]

Perhaps this is a very old news but resurfaced as he plead guilty but from what I have read previously this whole scam was not just a single heist, it was from many occasions.

I'm kind of confused about why he had his Bitcoin stored on Google Drive. How and why would anyone store the keys to such a large amount of Bitcoin on Google Drive? Honestly, I feel the victim was partly responsible for what happened because it was unreasonable to keep such sensitive information that way.

Perhaps you are removing some things from the equation, infact it’s not your fault but the media removed some things from the scenario for the news to make more sense and raise interest. But however, the Malone scam was not a single scam nor just a single heist but an accumulation of several heist which only raised concerns after he spent so much money and posted them on social media and that lead to his attention.

But however, I’m not sure anyone will just pull such amount of bitcoin in a single wallet and let alone store there secret phrase on a drive, it’s way more complicated than it’s portrayed to look like. It was a team action and that means they did several operations with similar or same pattern that made the conclusion that it was a heist. So don’t forget that crypto scams like that exist and if you look at them apart form single heist on an institution, individual heist are usually several scams combined.