"Marlon Ferro served as the criminal enterprise's instrument of last resort," U.S. Attorney Pirro said Wednesday, describing a scheme that paired sophisticated online fraud with targeted home invasions to extract millions in cryptocurrency.
The operation and its methods
Court documents describe a criminal ring that, between late 2023 and early 2025, targeted individuals believed to hold significant cryptocurrency. Members used social engineering to trick victims into surrendering access to digital wallets. When that failed and victims stored funds in hardware wallets, the conspiracy relied on residential burglaries carried out by Marlon Ferro — known online as GothFerrari and Marlo — to seize physical devices containing private keys.
Two burglaries singled out in filings
The records name two specific break-ins. In February 2024, Ferro traveled to Winnsboro, Texas, where he broke into a victim's home and stole a hardware wallet containing approximately 100 Bitcoins, then valued at more than $5 million. In July 2024, Ferro flew to New Mexico, monitored a victim's home for several days using a cell phone, and — after accomplices, "tracking the victim's location through his iCloud account," confirmed the residence was empty — smashed a window with a brick to gain entry.
Arrest, plea, sentence, and restitution
Ferro was arrested on May 13, 2025, while carrying two firearms and a fake identification document. He pleaded guilty in October and has now been sentenced to 78 months in prison. The court ordered Ferro to pay $2.5 million in restitution and to serve three years of supervised release after his prison term.
Financial laundering, accomplices, and related sentences
Beyond forced entry, Ferro also opened a fraudulent digital payment card account using fake identification to enable accomplices to spend stolen funds at nightclubs and retail locations, and to buy more than $255,000 in designer clothing on their behalf. After one of the criminal ring's leaders was jailed in September 2024, Ferro continued laundering cryptocurrency to fund that leader's legal defense.
Last month, 22-year-old Evan Tangeman of Newport Beach, California, was sentenced to 70 months in prison for laundering funds stolen in the same heist. In all, fourteen suspects were charged in September 2024 and May 2025 with a RICO conspiracy involving over 4,100 Bitcoin — worth more than $230 million at the time — and laundering the stolen funds through mixing services and crypto exchanges.
Lavish spending tied to the thefts
The court filings say the stolen cryptocurrency financed expansive, high-end expenditures. Alleged uses of the proceeds included private security guards, nightclub outings ranging up to $500,000 per evening, international travel, high‑end watches, and designer handbags for girlfriends. The group rented homes in the Hamptons, Los Angeles, and Miami for $40,000 to $80,000 per month, secured private jets, and amassed a fleet of at least 28 cars valued from $100,000 to $3.8 million.
What this means for victims, exchanges, and investigators
- Victims: The record underscores the dual risk to cryptocurrency holders who rely on both online and physical security; hardware wallets were specifically targeted and stolen in-person when digital defenses held.
- Cryptocurrency exchanges and mixers: The filings show laundering through exchanges and mixing services played a central role in converting stolen assets into spendable funds and luxury purchases, keeping the funds in motion even after arrests of ring leaders.
- Law enforcement and prosecutors: The use of a RICO charge across two waves of indictments (September 2024 and May 2025) highlights an approach that bundles multiple actors and techniques — social engineering, device theft, fraudulent financial accounts, and cross‑jurisdictional movement of both people and funds — into a single conspiracy case.
Taken together, the filings and sentences portray a criminal enterprise that combined digital deception with traditional burglary to extract and monetize large cryptocurrency caches. Ferro's 78‑month term and the ongoing prosecutions of a wider group of defendants represent a legal response to that hybrid threat; fourteen suspects have been charged, and multiple sentences already imposed. How much of the alleged proceeds will ultimately be recovered, and how ongoing investigations will trace funds moved through mixing services and exchanges, remain central questions laid out by the court records.
Original story
