Hamza Doost is 6-foot-3, with a chubby, bearded face, black hair, and an ankle monitor. For the past year, the 21-year-old has been confined to his father’s home in Hayward, an East Bay suburb. He’s allowed a computer, but the government tracks every keystroke.

Curiously — given the circumstances — he’s allowed one cryptocurrency account. 

Not long ago, he sat for a photo wearing a cheerful Hawaiian print shirt, surrounded by gleeful friends aboard a luxurious private jet.

According to federal prosecutors, Doost was a key figure in a sophisticated crime ring known as “SE Enterprise,” responsible for what was the largest single private theft of cryptocurrency in U.S. history: a $246 million heist pulled off not with guns or elaborate technical exploits but with phone calls and psychological pressure directed at one early bitcoin investor in Washington, D.C., who made the mistake of trusting the group.

More than a dozen defendants are awaiting trial or sentencing for their part in the two-year scheme, which included dozens of thefts. 

“This criminal enterprise was built on greed so brazen it borders on the cartoonish,” U.S. Attorney Jeanine Pirro said after the April 24 sentencing of one defendant in a Washington, D.C., federal court.

In the summer of 2024, prosecutors say, the group homed in on a whale — crypto slang for an investor sitting on a huge stash. The target was an early bitcoin investor, identified in court documents as R.W., who lived in Washington.

Their first contact was an email to R.W. claiming his Google account had been targeted by an unauthorized access attempt. Then one of the gang called R.W., posing as a member of Google’s security team, warning that unless he verified his account, it would be shut down.

It worked. Once inside his Google account, the group found the login information for his Gemini crypto exchange account.

A member called again, posing as Gemini support staff. While R.W. was kept on the line, others sent messages about how to extract his private information.

“Trick him into Googling his own pkey, saying it could be leaked somewhere,” wrote Malone Lam, referencing the private key used to access a cryptocurrency wallet, according to court documents. “That could be a play,” responded Veer Chetal, who along with Lam, was one of the group’s founders, prosecutors allege.

The third founder, Jeandiel Serrano, then convinced R.W. to download a program meant to protect his crypto funds, according to federal authorities. In reality, the program handed the group remote control of his computer. They watched live as he accessed private files and logged into various systems.

When the moment was right, they drained $246 million worth of bitcoin from his account, prosecutors say.

It was the single largest private crypto theft in U.S. history.

The next day, the crew celebrated at Lam’s rented mansion in Miami, where they talked about what to buy. Court records allege Lam purchased 30 exotic cars, including McLarens and Pagani, using a fake holding company called Crypto Administration LLC to obscure his ownership. Over the following weeks, the group partied like rock stars. In Miami, they tossed $10,000 Hermes Birkin bags to women in clubs. In a single blowout club night in Los Angeles, they dropped $4 million.

Doost was one of those who made these extravagances possible — converting the stolen crypto into the cash that paid for it.

The heist was unique in scale, but crypto theft has been booming nationally. Incidents (opens in new tab)increased by (opens in new tab) 22% between 2024 and 2025, resulting in nearly $12 billion in stolen funds, according to the FBI. San Francisco is a hot spot, with reports of residents victimized by a violent crime called “wrenchings,” in which thieves physically force crypto owners to hand over their account information. 

Last year, a man was tied up in his Mission home after thieves posing as deliverymen forced their way inside and coerced him into giving up $11 million in crypto. Another local case involved billionaire Chris Larsen, who admitted that he lost nearly $150 million in 2024 when his crypto accounts were hacked (opens in new tab).

Court records indicate the SE Enterprise scam was part of that wave, but it didn’t start with $246 million. It started with a video game.

“Minecraft” is a game targeted at children in which players create fantasy worlds by extracting raw materials from the earth. 

Around November 2023, Chetal, an immigrant from India, met Singaporean national Lam and Serrano, a resident of Encino, California, while playing the game, according to court records. They quickly discovered a shared talent — and appetite — for something more lucrative than virtual world-building.

Prosecutors say the scheme was simple. They would target individuals with large cryptocurrency holdings, often buying stolen personal data off the dark web. They hooked their prey with a phishing email claiming passwords had been exposed in a data breach. In follow-up phone calls, crew members would pose as company employees and convince victims to hand over passwords or provide remote access to their computers. Once inside, they would empty the crypto accounts.

Hackers call the technique “social engineering” — manipulation via psychological pressure. Unlike a bank robbery with guns, masks, and heavy bags of cash, crypto theft can be less risky and much faster.

The crew dubbed themselves SE Enterprise — for social engineering — and moved to Texas, where they committed their first thefts, according to court records, then to Los Angeles, where they expanded their ranks and rented an 11,000-square-foot house as a base of operations, wiring up computer terminals like the trading floor of a stock brokerage. Straw renters — someone who rents on behalf of another party — were used to obscure who lived there.

They gave themselves handles. Prosecutors say Lam called himself “Anne Hathaway” and “King Greavys.” Chetal went by “Swag” and “Wiz.” Serrano used “VersaceGod.”

They allegedly recruited members and honed their operation, taking bigger and bigger scores. In March 2024, Lam and another member stole $600,000 from one victim, prosecutors say. Two months later, the crew stole $2.9 million from another, breaking into the person’s home to steal a physical crypto key, according to court documents. 

It was relatively easy and clearly profitable. But the group had an obstacle: how to turn millions in stolen crypto into hard cash without leaving virtual fingerprints.

That’s where Doost came in.

In December 2023, Doost met a new member of the crew, Conor Flansburg, at an exotic rental car business in Los Angeles. Doost said he could hook them up with private jets and luxury travel with little or no documentation. But it was when he met crew member Marlon Ferro on Instagram that the money-laundering hustle began to take shape. 

Both Ferro and Flansburg pleaded guilty in federal court this year to a RICO conspiracy charge. 

Doost began exchanging cash for Ferro’s crypto, taking a cut in the process. It started with $80,000 and a $25,000 bundle that Doost hand-delivered to a nightclub where Ferro, Flansburg, and Lam were partying, according to prosecutors. Once he learned what the group did, Doost joined as a “money exchanger,” taking the handle “Scyllia.”

He quickly became indispensable. 

In addition to laundering money, Doost became the crew’s quasi travel agent — organizing private jet travel to New York and planning a blowout trip to the Hamptons that included 10 luxury sports cars and two mansions. He also adopted their brash lifestyle. In April 2024, he was ticketed for speeding over 100 mph in Orange County.

To cover his tracks, he incorporated a Wyoming-based company, FlyStopGo LLC, that advertised discreet private jet travel and mansion and car rentals.

The money was used mainly for the kinds of daydream purchases boys scribble in their notebooks. One paid $1.8 million for a watch, and there were dozens of Porsches, Ferraris, and Lamborghinis purchased. They were so close to one car dealer, Shawn Desilva of the Exotic Car Factory, that he was invited on a Hamptons trip. Asked about his relationship with the group, Desilva did not deny traveling with them or selling them cars and admitted to putting up $25,000 for one crewmate’s bail. “Print whatever story you want,” he said. De Silva has not been charged and denies involvement in anything illegal.

Soon, the crimes became bolder. During a New Mexico robbery in July 2024, prosecutors say, Lam tracked a victim in a wheelchair while Ferro broke into the person’s home to steal a physical crypto wallet, with a camera livestreaming from across the street. They escalated their efforts, pulling off a $1.7 million theft later that month, followed by a $14 million heist.

The problem of moving massive amounts of cash across a sprawling network requires creative solutions. They once allegedly hid $50,000 in cash inside Squishmallow stuffed animals.

Money and danger started to breed paranoia. Some members armed themselves against rival cybercrime organizations. Word of the $246 million heist had spread in those circles. “He knows where we got the target from,” one member messaged Doost. “How the fuck?” Doost replied.

In September 2024, Doost was robbed of $400,000 in crypto during a cash exchange, according to court documents. He was also growing nervous about their leader. “I genuinely think Malone has a huge chance of getting caught compared to you,” he wrote to another alleged member. “Keep your profile the way that you do.” He recommended deleting Telegram chats and getting a new phone.

He was right to worry. An off-duty police officer told them that federal law enforcement was closing in. That same day, prosecutors say, Lam walked into the backyard of his Miami home and dropped his phone into Biscayne Bay.

Chetal was arrested first, on Sept. 9, 2024, in New Jersey, found with $37 million in stolen crypto. He cooperated and pleaded guilty to wire fraud and money-laundering conspiracies. Serrano was picked up at LAX on Sept. 17, returning from the Maldives. His girlfriend, questioned by agents at the airport, allegedly alerted the rest of the group, who began deleting Telegram accounts. The next day, the feds came for Lam, who had just flown from Los Angeles to Miami. He has yet to be convicted. 

While Lam was in custody, prosecutors say, crewmembers returned to his house to destroy electronic evidence and collect his designer clothing. Lam allegedly continued to direct operations. “Ya’ll have the money. You know how it works, the lawyers care about the money,” he said in a recorded phone call. “We have Hamza helping everyone out too.”

Court records say that as they laundered more stolen funds to pay for Lam’s legal defense, the group continued stealing. Chetal, while on house arrest, allegedly helped conduct a $2 million theft from a woman in October 2024. As recently as January 2025, arrested members were using code in phone calls to plan schemes, according to the records.

That same month, a federal grand jury handed down a sealed jury indictment of 12 members of the crew, including Doost. Still, he and other members set off on trips to Thailand and Dubai.

By early spring, the FBI began arresting the remaining members. Doost, who had been living in an Orange County hotel, was arrested May 13, 2025, in Santa Ana after voluntarily returning from the United Arab Emirates. He was released on $30,000 bail, put up by a car detailer friend from Southern California, to home detention in Hayward, at his parents’ home, which was also used as collateral.

Three months later, he signed a plea agreement and pleaded guilty to one count of RICO conspiracy. He faces up to 11 years in prison.

Doost is taking online classes at San Jose State while he waits to be sentenced. His ankle monitor is still on. The government tracks his every keystroke.

At least 11 people have pleaded guilty so far. Lam and Serrano have yet to be convicted. 

Somewhere in the group’s Telegram chats — recorded by federal investigators before the crew got around to deleting them — is a line one member typed about the people they targeted:

“They just stupid, just gota find the right one.”