How a fake Google support call stole 4,100 bitcoin from one person

One phone call from someone claiming to be Google support ended with a single person in Washington, D.C. losing more than 4,100 bitcoin, worth over $230 million at the time.^[1][2] This case file covers how the fake support call worked, how the thieves' spending helped bring them down, and the one habit that would have stopped it.

What happened

How it worked

This was not a technical break-in. It was a performance. Prosecutors described a group with assigned jobs: people who pulled personal details from leaked databases, people who picked targets, callers who played the support agents, launderers who turned crypto into cash, and in some cases burglars who went after hardware wallets in people's homes.^[3]

The call itself relied on three tricks. First, a spoofed caller ID, so the number on the screen looked like it came from a real company. Second, urgency: the victim was told their account was already under attack, which pushes people to act before thinking. Third, a request that feels routine to anyone who has ever had tech help, which is to share your screen so the agent can see the problem.^[1][4] Once a stranger can see or control your screen, anything displayed there, including passwords and wallet keys, belongs to them too.

Real support teams at large tech companies generally do not call customers out of the blue to report a hacked account. The warning itself was the scam.

How it was caught

The spending was hard to miss. Prosecutors say proceeds went on nightclub evenings costing up to $500,000, luxury watches, designer handbags handed out at parties, rental homes in Los Angeles, the Hamptons and Miami, private jets, a private security team, and a fleet of at least 28 exotic cars worth from $100,000 to $3.8 million each.^[2][3] An independent crypto investigator publicly traced the stolen funds and highlighted the group's flashy lifestyle within weeks.^[4]

In September 2024, about a month after the theft, the FBI arrested 2 men in Miami and Los Angeles and seized luxury cars in a raid on a Miami property.^[4] In May 2025 prosecutors charged 12 more people, and said the stolen coins had been swapped into harder-to-trace currency and moved through mixers and pass-through wallets to hide their origin.^[1]

What it cost

On September 8, 2026, Malone Lam, a 22-year-old Singaporean citizen living in Miami, pleaded guilty to a racketeering conspiracy in federal court in Washington, D.C. Prosecutors described him as the leader who coordinated the thefts and picked targets, and put the group's total take at more than $245 million.^[2] The charge carries up to 20 years in prison. No sentencing date had been set; a status hearing was scheduled for December 8, 2026.^[5]

By then, 11 of 18 defendants charged in the investigation had pleaded guilty, according to press coverage of the plea.^[5] Earlier, in December 2025, a 22-year-old California man, Evan Tangeman, pleaded guilty for his role laundering proceeds.^[3]

The missing control

The missing control: hang up and call back on a number you already know.

A call-back rule breaks this kind of scam at its first step. If the victim had ended the call and dialed Google or Gemini using a number from the company's own website or account page, the real company would have said there was no problem. Spoofed caller ID only works while the scammer controls the line. A second rule, never share your screen with anyone who contacted you first, would have closed the door even if the call-back was skipped.

What to do in your business

• Write down the call-back rule. Any unexpected call about a hacked account, a payment problem or a bank change gets a hang-up and a call back on a number from your own records, never one the caller gives.
• Ban screen sharing on inbound calls. Staff should only share screens or allow remote access with IT or vendors they contacted first, through a known channel.
• Distrust caller ID. Tell everyone in the office that the name and number on the screen can be faked and prove nothing.
• Keep secrets off screen. Store passwords, recovery codes and wallet keys in a password manager or offline, not in open documents or notes.
• Slow down big moves. Require a second person to approve large transfers or changes to security settings, so one pressured employee cannot act alone.

Facts are drawn from court records, government reports, company statements and reputable reporting, listed below. People are named only where they were convicted, pleaded guilty or spoke publicly in an official role.