Crypto gang member gets 6.5 years for role in $230 million heist

A 20-year-old California man was sentenced to 78 months in prison for serving as a home invader and money launderer in a criminal ring that stole over $250 million in cryptocurrency.

Marlon Ferro (also known online as GothFerrari and Marlo) was arrested on May 13, 2025, carrying two firearms and a fake identification document. He pleaded guilty in October and was also ordered to pay $2.5 million in restitution and serve three years of supervised release.

According to court documents, the criminal ring targeted individuals believed to hold significant cryptocurrency between late 2023 and early 2025.

They used social engineering to trick their victims into giving them access to digital wallets, and when victims stored funds in hardware wallets, the conspiracy shifted to Ferro's expertise in residential burglaries.

"Marlon Ferro served as the criminal enterprise's instrument of last resort. When his co-conspirators couldn't deceive victims into handing over access to their cryptocurrency or hack their way into digital accounts, they turned to Ferro to break into homes and steal hardware wallets outright," said U.S. Attorney Pirro on Wednesday.

"This scheme blended sophisticated online fraud with old-fashioned burglary to drain victims of millions of dollars in digital assets."

In February 2024, Ferro traveled to Winnsboro, Texas, broke into a victim's home, stole a hardware wallet containing approximately 100 Bitcoins (then valued at more than $5 million), and laundered the funds through cryptocurrency exchanges.

In July, the same year, Ferro flew to New Mexico, monitored a victim's home for several days using a cell phone, and broke in by smashing a window with a brick after accomplices tracking the victim's location through his iCloud account confirmed they had left the residence.

​He also opened a fraudulent digital payment card account using fake identification to enable his accomplices to spend stolen funds at nightclubs and retail locations, and to buy more than $255,000 in designer clothing on their behalf.

Additionally, after one of the criminal ring's leaders was jailed in September 2024, Ferro continued laundering cryptocurrency to fund the leader's legal defense.

Last month, 22-year-old Evan Tangeman of Newport Beach, California, was also sentenced to 70 months in prison for laundering funds stolen in the same massive cryptocurrency heist.

In all, fourteen suspects were charged in September 2024 and May 2025 with a RICO conspiracy involving over 4,100 Bitcoin (worth more than $230 million at the time) and laundering the stolen funds through mixing services and crypto exchanges.

They used the stolen cryptocurrency to finance lavish lifestyles, including private security guards, nightclub outings ranging up to $500,000 per evening, international travel, high-end watches, and designer handbags for their girlfriends.

The criminal group also rented homes in the Hamptons, Los Angeles, and Miami for $40,000 to $80,000 per month, as well as private jets and a fleet of at least 28 cars valued from $100,000 to $3.8 million.

Security teams log 54% of successful attacks and alert on just 14%. The rest move through your environment unseen.

The Picus whitepaper shows how breach and attack simulation tests your SIEM and EDR rules so threats stop slipping by detection.

Apple sued over fake App Store crypto wallet app stealing $1.8M in Bitcoin

Hackers steal $23.7 million in crypto from Ostium in off-chain attack

US charges two over laundering $43 million from investment fraud

Money launderer accused of stealing seized crypto while in prison

Ransom Cartel ransomware creator sentenced to 16 years in prison

Sergiu Gatlan 
 Sergiu is a news reporter who has covered the latest cybersecurity and technology developments for over a decade. Email or Twitter DMs for tips.

You need to login in order to post a comment

Hotel Wi-Fi attacks use custom malware to breach Microsoft 365 accounts

Massive ChainDrop npm supply-chain attack infects hundreds of packages

OpenAI, Anthropic AI agents targeted real people and systems in cyber tests

Spend four hours inside a fully-simulated underground with DARKROOM.

AI is a data-breach time bomb: Read the new report

Webinar: Shadow AI in 2026 (and how attackers are taking advantage)

Explore ESET’s H1 2026 Threat Report to uncover the latest AI, phishing, and ransomware trends.

Stay one step ahead of new threats in the new year. Join Huntress for the monthly Tradecraft Tuesday.

Help us understand the problem. What is going on with this comment?

Submitting...