U.S. Unveils $263M Social Engineering Scheme

U.S. unveils $263M social engineering scheme, Evan Tangeman pleads guilty to participating in the Social Engineering Enterprise, and the Second Superseding Indictment expands the circle of defendants and confirms the RICO focus on the entire chain from data theft to the laundering of assets.

Learn our comprehensive reviews about the top legit exchanges, their features, benefits, and special offers!

Join BloFin and qualify for up to $1,000 today

Start Trading

More Details on the Scheme and the Defendants in the Social Engineering Enterprise

Twenty-two-year-old Evan Tangeman of Newport Beach, California, pleaded guilty to participating in a conspiracy that used social engineering to steal hundreds of millions of dollars in cryptocurrency from victims across the country. Tangeman admitted that he helped launder at least $3.5 million for other members of the group and entered a plea agreement on a RICO charge before U.S. District Court Judge Colleen Kollar-Kotelly. Sentencing is scheduled for April 24, 2026. He is the ninth defendant to plead guilty in this investigation, underscoring the scale of the Enterprise and the priority federal authorities assign to the case.

More broadly, according to the Second Superseding Indictment, the Social Engineering Enterprise began operating no later than October 2023 and by May 2025 had turned into a multi-layered network that grew out of acquaintances on online gaming platforms. The Enterprise included individuals from California, Connecticut, New York, Florida, and other jurisdictions, giving its schemes a distinctly multi-state character. The scheme also featured a clear division of roles: some participants obtained and exploited stolen databases to target victims, others organized social engineering attacks and communicated with victims, still others were responsible for holding and moving cryptoassets, and a separate group consisted of residential burglars who stole hardware, virtual currency wallets, and other equipment at physical locations. According to the case materials, Tangeman acted as a money launderer within this configuration and interacted with several segments of the chain.

The cryptoassets obtained through social engineering were quickly converted into offline assets and, in classic fashion, high-end services. Court documents describe how members of the Enterprise spent the funds on nightlife services with individual tabs of up to $500,000 per night, luxury handbags, watches, and clothing worth tens of thousands of dollars, luxury rentals in Los Angeles, the Hamptons, and Miami, private jet rentals, private security services, and a fleet of at least 28 exotic cars costing between $100,000 and $3.8 million.

Get our comprehensive breakdown about the DYOR Сrypto Сhecklist: Evaluate Crypto Projects Before Investing

Tangeman's Role, the 4,100 BTC Episode, and the Expanding Circle of Defendants

The Second Superseding Indictment pays particular attention to Tangeman's role in laundering cryptocurrency and supporting the Enterprise's infrastructure. In late 2023, he met Malone Lam and other group members when they relocated to Los Angeles and required rental housing and living expenses to be funded by stolen cryptocurrency. Tangeman used a bulk-cash convertor to exchange cryptocurrency for cash, helped them rent houses in upscale neighborhoods, and arranged lease agreements in nominee names to make it harder to identify the true beneficiaries.

The key episode described in the Second Superseding Indictment took place on August 18, 2024. According to the prosecution, Tangeman's co-conspirator, Malone Lam, together with Danish Zulfiqar and other individuals, contacted a victim in the District of Columbia and, through communications with that victim, fraudulently obtained over 4,100 Bitcoin, which at the time of the theft was worth approximately $263 million, with its current value stated as over $368 million. After the theft, Tangeman helped Lam receive about $3 million in fiat cash in exchange for a portion of the stolen cryptocurrency to pay for housing, further solidifying his role in laundering and converting the stolen funds.

Importantly, the Enterprise did not limit itself to a purely digital channel. In August 2024, after the theft from the DC victim, Tangeman helped Lam rent a house in Miami, and on September 18, 2024, he obtained remote access to the victim's home security systems to search for and seize digital devices. He also instructed another member of the Enterprise to go to Lam's house in Los Angeles, retrieve digital devices, and destroy them, signaling the group's systematic efforts to eliminate digital traces and complicate the investigation. Against this background, the Second Superseding Indictment adds three new defendants to the case, including Nicholas Dellceva, Mustafa Ibrahim, and Danish Zulfiqar, who are charged with participating in the RICO conspiracy alongside previously charged members of the Enterprise. Dellceva was arrested in Miami on December 3, 2025, and Zulfiqar and Ibrahim were arrested in Dubai on related charges, underscoring the cross-border nature of the investigation and coordination among different law enforcement agencies.

Join BloFin and qualify for up to $1,000 today

Start Trading

Conclusion

The case against the Social Engineering Enterprise shows how fairly classic social engineering techniques can be scaled up to hundreds of millions of dollars. All of this once again demonstrates that, as technologies become more resilient and secure, they are still insufficient for comprehensive security, and the human factor remains the primary vulnerability. Get more insights from our guides for beginners and professionals, and stay tuned for the latest updates and opportunities in the new economy, crypto industry, and blockchain developments!