"This criminal enterprise was built on greed so brazen it borders on the cartoonish. They stole millions, spent it on half-million-dollar nightclub tabs, Lamborghinis, and Rolexes," U.S. Attorney Pirro said on Friday.
The sentence for Evan Tangeman
Twenty-two-year-old Evan Tangeman of Newport Beach, California — also known by aliases including "E," "Tate," and "Evan|Exchanger" — was sentenced to 70 months in prison after pleading guilty to laundering proceeds from a vast cryptocurrency theft. Court documents say Tangeman helped launder at least $3.5 million of funds stolen in a scheme that prosecutors trace to a broader theft of more than $230 million in cryptocurrency. In addition to the prison term, Tangeman was ordered to serve three years of supervised release after his sentence.
How the August 2024 theft unfolded
Prosecutors allege the operation began with a social-engineering attack in August 2024 that targeted a Genesis crypto exchange creditor. Two men arrested and charged in September 2024 — 20-year-old Malone Lam (aka "Greavys," "Anne Hathaway," and "$$$") and 21-year-old Jeandiel Serrano (aka "Box," "VersaceGod," and "@SkidStar") — are accused of stealing more than 4,100 Bitcoin from the victim. According to reporting of the investigation, the suspects used spoofed phone numbers and impersonated customer-support representatives at Google and Gemini.
While impersonating a Gemini support team member, the attackers claimed the victim's account had been compromised and tricked the victim into resetting two-factor authentication and sharing their screen using the AnyDesk remote-desktop application. That remote access, prosecutors say, allowed the attackers to obtain the Bitcoin Core private keys and transfer the funds.
Techniques used to hide the trail: peel chains, mixers, VPNs
After the theft, the suspects allegedly laundered the cryptocurrency through a combination of crypto mixers and exchanges, with assistance from accomplices including Tangeman. The operation used "peel chains" and pass-through wallets — moving small amounts repeatedly to obscure origins — and employed virtual private networks to conceal identities and locations. Fourteen suspects were charged across September 2024 and May 2025 in a RICO conspiracy alleging the theft and laundering of over $230 million; the nine suspects indicted in May 2025 (including Tangeman) face charges that include racketeering conspiracy, money laundering, obstruction of justice, and conspiracy to commit wire fraud.
The group's spending and visible assets
Prosecutors say the stolen funds financed conspicuous consumption. The indictment and court filings describe expenditures on private security guards, high-end watches, designer handbags, and nightclub outings that prosecutors say reached up to $500,000 in a single evening. The defendants are accused of renting homes in Los Angeles, the Hamptons, and Miami at rates of $40,000 to $80,000 per month, chartering private jets, and assembling a fleet of at least 28 cars valued between $100,000 and $3.8 million. Tangeman is specifically tied to a widebody Lamborghini Urus in court documents. According to U.S. Attorney Pirro, when some co-conspirators were arrested, Tangeman attempted to destroy evidence — conduct the office and court treated as "consciousness of guilt."
What this means for crypto exchanges, victims, and law enforcement
- Crypto exchanges and custodial platforms: The scheme reportedly began with an attacker impersonating support at Gemini and exploited a Genesis creditor; exchanges are shown as both targets and channels used in laundering. The case underscores how social engineering that bypasses account controls can lead to catastrophic losses.
- Victims and private holders of large holdings: The victim in this case lost more than 4,100 Bitcoin, valued at over $230 million at the time. The attack highlights risks tied to remote-support workflows and the critical importance of protecting private keys and 2FA mechanisms from social-engineering pressure.
- Law enforcement and prosecutors: Fourteen suspects were charged across separate actions in September 2024 and May 2025. Prosecutors have secured guilty pleas from at least two defendants: Tangeman (guilty plea in December 2025) and 45-year-old Kunal Mehta (aka "Papa," "The Accountant," and "Shrek"), who pleaded guilty in November 2025 to laundering at least $25 million and is awaiting sentencing.
The case threads a familiar pattern — targeted social engineering to seize keys, then layered laundering through mixers and exchanges — but the scale here is exceptional. With multiple guilty pleas and a 70-month sentence for Tangeman, prosecutors have begun to translate the sprawling financial trail into convictions and prison terms. Still pending are the outcomes for other indicted defendants and sentencing for co-conspirators such as Kunal Mehta, leaving open how many more sentences will follow from the indictments returned in 2024 and 2025.
Read the original reporting: Money launderer linked to $230M crypto heist gets 70 months in prison
