A 22-year-old California man has become the ninth defendant to plead guilty in a RICO-style crypto theft ring that drained around $263 million in Bitcoin from a single Washington, D.C., victim and hundreds of millions more from numerous targets across the United States.
The Justice Department announced on Thursday that Evan Tangeman had pleaded guilty to a federal court in Washington, D.C., to participating in a racketeering conspiracy related to the “Social Engineering Enterprise,” or SE Enterprise.
Tangeman admitted to assisting the organization in laundering at least $3.5 million and is scheduled to be sentenced on April 24, 2026, before a United States District Judge.
Prosecutors are relying on RICO charges, a provision originally intended for the mafia and drug cartels, to prosecute the SE Enterprise as a unified criminal organization rather than a series of individual hacks.
Along with Tangeman’s plea, the court released a second superseding indictment, which included three new defendants: Nicholas “””Nic”/”Souja” Dellecave, Mustafa “Krust” Ibrahim, and Danish “””Danny”/”Meech” Zulfiqar, all charged with RICO conspiracy.
The indictment describes how the SE Enterprise began in October 2023 and continued until at least May of this year, stemming from friendships formed on online gaming platforms.
Members are then divided into specialized jobs, such as database hackers, organizers, target identifiers, “callers” who pose as support workers for large exchanges and email providers, money launderers, and even in-person thieves deployed to steal hardware wallets from victims’ houses.
In last year’s attack on the D.C. victim, co-defendants Malone Lam, Zulfiqar, and others reportedly took more than 4,100 BTC, which was valued at approximately $263 million at the time and is now worth more than $370 million.
Last September, police arrested suspected ringleader Lam and co-defendant Jeandiel Serrano on fraud and money-laundering charges after detectives, backed by crypto sleuth ZachXBT, tracked the stolen cash down through mixers and peel chains.
Prosecutors claim the group laundered the stolen cryptocurrency by first converting it into the privacy coin Monero, then routing it through opaque exchanges and “crypto-to-cash” brokers, all while spending the gains lavishly.
Tangeman’s involvement, they claimed, was to convert stolen cryptocurrency into mass fiat, acquire luxury rental residences using fictitious names, and assist Lam in collecting around $3 million in cash immediately following the 4,100 BTC theft.
He also watched home-security feeds while FBI officials raided Lam’s Miami house and then directed another member to retrieve and destroy digital devices to impede investigators.
“The speed of crypto allows stolen assets to be moved at the speed of the internet, while the use of violence or threats adds an immediate physical layer of risk for victims, creating a hybrid threat model that law enforcement and the private sector are now confronting head-on,” TRM Labs’ Global Head of Policy Ari Redbord told Decrypt.
“Having prosecuted both violent and cyber crimes, this mix is particularly harrowing,” he added.
According to Redbord, prosecuting RICO in this context demonstrates that prosecutors are increasingly viewing these cases as “a single, organized operation”—an approach that allows them to charge fraud, laundering, and related violence “under one unified legal theory.”
