Social Engineering Enterprise
Social Engineering Enterprise is a cybercriminal organization involved in large-scale cryptocurrency theft and related money laundering. According to the provided reporting and court-described facts, the group was formed in 2023 by Singaporean Malone Lam and operated with members from California, Connecticut, New York, Florida, and other countries. Law enforcement and prosecutors described it as responsible for stealing more than $260 million in cryptocurrency between October 2023 and May 2025, including more than $263 million from a victim in Washington, D.C. The group targeted wealthy cryptocurrency holders using stolen databases and databases purchased on the dark web, including a shared database of more than 1,000 targets. Its tactics included social engineering calls, impersonation of customer service personnel and representatives from Apple, Google, and cryptocurrency exchanges, and use of fake push notifications to trick victims into revealing account details, credentials, or private keys. The group also conducted physical thefts and home break-ins to steal hardware wallets and devices containing cryptocurrency access. The operation included database hackers, organizers, target identifiers, callers, residential burglars, and money launderers. Stolen cryptocurrency was laundered through exchanges and mixers and converted to fiat currency. Members used fake or stolen identities to rent or purchase luxury homes in locations including California, Florida, Los Angeles, the Hamptons, and Miami, which were used to support theft operations. Reporting states the group spent proceeds on private jets, expensive cars, luxury goods, vacations, and other lavish purchases. Members coordinated using Telegram and Signal and changed usernames to evade law enforcement. After arrests of leaders in 2024, members took steps to destroy devices and conceal activity. Known associated figures directly mentioned in the content include Malone Lam and Evan Tangeman, who pleaded guilty to RICO conspiracy charges for laundering funds and supporting the enterprise. No other aliases or sub-group names are directly provided in the content.
Know when an actor pivots toward your sector
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Targeting
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Who they target
Sectors the actor has been observed targeting.
- Financial Services
Where they target
Geographies tied to known operations.
- 🇺🇸 United States
Where they're from
Attributed origin per open-source reporting.
- SG
- US
Tradecraft
4 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
Recent activity
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A cybercriminal organization focused on identifying and robbing high-value cryptocurrency owners through social engineering, stolen or dark-web-purchased databases, digital theft, physical theft, and cryptocurrency laundering.
Criminal group accused of large-scale cryptocurrency theft via social engineering: using hacked databases to identify wealthy targets, impersonating cryptocurrency exchanges to trick victims into transferring funds, and in some cases organizing home break-ins to steal hardware wallets/keys.
A criminal gang conducting large-scale cryptocurrency thefts through social engineering, database hacking, physical burglaries, and money laundering. They targeted individuals with significant crypto holdings, using a mix of online and physical tactics to steal funds and launder proceeds.
The version that knows your environment.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.