One of the largest Bitcoin thefts in U.S. history is linked to kidnapping, large bar bills, and exotic cars.

• A Washington, D.C., resident was defrauded out of $230 million in cryptocurrency by two young men, who then went on a lavish spending spree, according to court records.
• The kidnapping of a Connecticut couple may have been part of a ransom demand plot involving their son, who is being investigated for his involvement in a crypto heist.
• At least $100 million in bitcoin stolen from the victim is still missing, according to a recent court filing by prosecutors.

According to new court records, two young men accused of one of the largest person-to-person crypto thefts in U.S. history went on a brazen spending spree, buying exotic cars, a $2 million wristwatch, renting mansions, and running up nightclub tabs of hundreds of thousands of dollars apiece.

At least $100 million of the $230 million stolen in a Washington, D.C., resident's cryptocurrency on Aug. 18 remains unaccounted for, according to a recent court filing in D.C. federal court.

The kidnapping of a Connecticut couple on August 25th during a house hunting trip may be linked to the Washington crypto theft, according to police.

The couple's son is being investigated for possible involvement in a crypto heist, and authorities are examining whether the kidnapping was linked to a ransom demand.

Detective Sgt. Steven Castrovinci of the Danbury, Connecticut, Police Department said to CNBC, "I've never seen anything like this in 20 years."

The carjacking of the couple in Danbury, while driving a Lamborghini rented by their son, happened a week after the theft of more than 4,100 bitcoin.

In Connecticut, six Florida men are currently facing both state and federal charges for their involvement in the kidnapping.

The couple and their unidentified son have not been charged in connection with the cryptocurrency theft.

Castrovinci exclaimed, "It's incredible to witness this thing's growth of limbs."

In September 2021, one month after the crypto heist, the U.S. Attorney's Office for the District of Columbia declared that the FBI had apprehended two individuals, Malone Lam, 20, and Jeandiel Serrano, for conspiracy charges related to their alleged theft and laundering of the stolen bitcoin.

At the time of his arrest in Los Angeles, Serrano, who uses the online monikers "VersaceGod" and "@SkidStar," was wearing a $500,000 watch, according to prosecutors.

In court filings, prosecutors stated that both men, who are being held without bail, confessed to their involvement in the theft.

Paulette Pagan, Serrano's lawyer, declined to comment on his case. CNBC sought a lawyer's comment on behalf of Lam, a Singaporean resident who had been residing in L.A. and Miami for several months beyond the 90-day visa waiver that permitted him to visit the U.S. as a tourist.

The largest cryptocurrency theft from a private individual in the history of the United States is the subject of a federal court filing, according to the scheme at the center of the bizarre case.

A cyber heist in Washington

Court filings reveal that a month before their arrest, Serrano, Lam, and other unnamed co-conspirators targeted a man in Washington due to their belief that he possessed a substantial amount of virtual currency. They identified him as a high net-worth investor from the early days of cryptocurrency.

In August, an unauthorized Google account access notification was sent to the victim, indicating that the attempts had taken place abroad, according to a court filing.

Prosecutors stated in a filing that this was merely the conspirators preparing for their imminent theft through intricate social engineering.

On August 18, the man received a call from individuals claiming to be from Google's security team, inquiring about recent unauthorized access attempts.

The co-conspirators successfully manipulated the man into revealing his Google drive login credentials through a series of prompts and misrepresentations. Once they gained access, they quickly found his personal financial information, including the location of his virtual currency holdings with Gemini, a crypto exchange, according to a filing.

Prosecutors claimed that Serrano and other scheme participants contacted the man and posed as members of Gemini's support team.

As Serrano conversed with the victim, he and his accomplices were simultaneously discussing their plans to deceive the victim into revealing his private keys and granting them access to his virtual currency holdings, with the ultimate goal of stealing his entire savings, according to the filing.

The man was tricked by the schemers into downloading a program onto his computer to safeguard his Gemini holdings.

Prosecutors claim that the program granted the co-conspirators real-time access to the victim's desktop.

The court filing stated that Serrano was able to manipulate the victim into opening private files containing over 4,100 Bitcoin.

"As Serrano controlled the victim, his accomplice seized the opportunity to swiftly pilfer the entirety of the victim's virtual currency."

Prosecutors said the co-conspirators split the theft's proceeds five ways.

According to a court filing, the schemers employed "intricate money laundering methods to conceal their earnings and maintain anonymity."

Serrano believed that the cryptocurrency deposited on TradeOrgre.com was clean and successfully laundered, as stated in the filing.

A spending spree in Los Angeles

Serrano had failed to use a VPN when creating his account, despite using a VPN to mask his location when accessing it.

The account was created from an IP address registered to Serrano's $47,500 per month rental home in Encino, California, according to TradeOgre records.

"Serrano was already out of the country, vacationing in the Maldives, when he was identified by federal authorities," the filing said.

Prosecutors wrote that Malone Lam, his co-conspirator, was spending hundreds of thousands of dollars per night at Los Angeles night clubs and accumulating an impressive collection of custom Lamborghinis, Ferraris, and Porsches.

In Miami, a Singaporean native who was arrested after traveling there from Los Angeles on a private jet was reportedly renting several homes, as per the filing.

The monthly rental cost of one mansion in that location was $68,000, according to the filing.

Prosecutors claimed that Lam, who went by the online aliases "Anne Hathaway" and "$$$," had bought a $2 million watch and a Lamborghini Revuelto worth over $1 million.

Prosecutors wrote that "many of Lam's vehicles, including his $3,800,000 Pagani Huayra, have not been located as of yet."

Prosecutors wrote that Lam admitted to purchasing 31 luxury automobiles, 22 of which have not been recovered by law enforcement.

Prosecutors wrote that Lam "admitted to doing additional hacks and making millions from those separate cryptocurrency fraud schemes, which he states have supported his entire lifestyle since arriving in the United States in October 2023."

"Serrano has not yet found the three vehicles he admitted to buying."

According to a court filing, the federal government captured Lam on a spending spree of the victim's assets, which included sightings of him at Los Angeles nightclubs and gifting handbags valued at tens of thousands of dollars.

According to the filing, Lam attempted to settle his tabs at L.A. nightclubs using cryptocurrency and was spending around $400,000 to $500,000 per night. A receipt from one L.A. club revealed that Lam spent $569,528.39 in a single night.

An FBI agent interviewed Serrano's girlfriend after his arrest at L.A. International Airport on Sept. 18, who also denied any knowledge of his involvement in crimes, according to a court filing.

The FBI Agent informed her that calling Serrano's associates and revealing the arrest would worsen the situation, according to the filing.

According to the filing, Serrano's girlfriend immediately called his criminal associates after leaving the interview and informed them of his arrest. As a result, these associates deleted their Telegram accounts and all incriminating evidence found in saved chats.

In a court filing, prosecutors stated that about $70,000,000 has been recovered or frozen on different exchanges up to now.

"Despite the millions of dollars spent on automobiles and jewelry by Serrano and his accomplices, over $100,000,000 remains unaccounted for."

According to a court filing, Serrano had approximately $20 million of the victim's stolen bitcoin on his phone and agreed to transfer those funds back to the FBI.

A kidnapping in Connecticut

On Aug. 25, three weeks before Serrano and Lam were arrested, police in Danbury, Connecticut received multiple 911 calls reporting the abduction of a couple by two men.

According to Det. Sgt. Castrovinci, the victims were driving a 2024 Lamborghini Urus that had been rented by their son when they were rear-ended by a white Honda Civic.

A Lamborghini was surrounded by a group of men in black masks who had cut in front of a work van.

The two victims were forcibly removed from the car by the perpetrators, who then assaulted the husband, punching him in the face and striking him with a baseball bat, according to authorities.

FBI Agent Matthew Loucks wrote in an affidavit that the suspects repeatedly told the couple they would "kill them."

According to Loucks' affidavit, the suspects pushed the victims into the back of the work van and held them down. They then bound both victims' arms and feet with silver duct tape, which they also used to cover the husband's face. The suspects forced the husband's wife to lie face down and ordered her not to look at them.

According to the FBI agent, the couple heard police sirens soon after the van started moving, and one of the suspects shouted, "Call Rick ... we are in deep s***," before the van crashed and the suspects escaped on foot, leaving the victims behind.

Six suspects from the Miami area were arrested in total, with four being apprehended on the first day and two on the second.

The couple, who were briefly hospitalized after the incident, were clueless about why they had been kidnapped, according to Castrovinci.

"They kept asking us, 'Why?' Castrovinci said.

A family connection

The couple who were abducted were known to Danbury police because their home had been targeted by "swatting" calls, according to Castrovinci.

The act of making a false police report that a crime is taking place at someone else's property, resulting in the police being dispatched to that location.

The swatting calls were suspected to be made by individuals familiar with the couple's son from his online gaming, as stated by Castrovinci.

On October 11th, the Danbury News-Times reported that the Danbury police had intended to speak with the couple's son, but decided not to proceed at the request of the FBI.

The FBI contacted us about an ongoing investigation into the son regarding a cryptocurrency theft that took place.

We knew he was involved in the crypto heist to some extent, but we didn't know the full extent of his involvement at the time. We only knew that there was an investigation into him regarding the heist.

The six Florida men were able to determine that the kid they were targeting had a significant amount of money, despite not knowing how they arrived at this conclusion. As a result, they decided to pursue the parents due to the kid's involvement in something illegal.

It is "certainly a possibility" that the kidnappers planned to hold the couple for ransom, believing their son could pay, according to Castrovinci's statement to CNBC.

The U.S. Attorney's Office in Connecticut refused to comment on the possible link between the carjacking and kidnapping of the couple and their son's potential involvement in the August crypto heist.

The U.S. Attorney's Office in D.C. declined to provide a comment.