California crypto theft case brings 78-month sentence in $250 million conspiracy

Traders Union
All News
Crypto
California crypto theft sentence

Highlights

Marlon Ferro received a 78-month federal prison sentence, three years’ supervised release, and $2.5 million restitution for participating in a $250 million RICO crypto theft conspiracy.
Ferro physically burglarized residences in Texas and New Mexico, stealing hard wallets containing over 100 Bitcoin ($5 million) and enabling co-conspirators to bypass remote security barriers.
The conspiracy, active from late 2023 to early 2025, involved U.S. and overseas participants and highlights broader crypto security risks, with April hacks reaching $629.7 million according to DefiLlama.

Sentence details and burglary role

As reported by the U.S. Attorney’s Office for the District of Columbia and Cointelegraph, Marlon Ferro, a 20-year-old from Santa Ana, California, was sentenced on Wednesday to 78 months in federal prison, followed by three years of supervised release and $2.5 million in restitution. Ferro, who used the online name “GothFerrari,” pleaded guilty in October 2025 to taking part in a Racketeer Influenced and Corrupt Organizations, RICO, conspiracy.

Prosecutors say Ferro acted as the group’s fallback option when victims could not be persuaded to hand over crypto assets and when remote intrusions failed to unlock accounts. U.S. Attorney Jeanine Ferris Pirro says co-conspirators sent him to physically break into homes and steal hardware wallets containing digital assets.

In February 2024, Ferro traveled to Winnsboro, Texas, and stole a hardware wallet holding about 100 Bitcoin, valued at more than $5 million at the time, prosecutors say. In a separate incident months later, he flew to New Mexico, watched a residence for days and used a brick to force entry while other members of the conspiracy tracked the victim through an iCloud account; a home surveillance camera recorded the break-in.

Scale of the scheme and broader crypto security risks

The conspiracy runs from late 2023 to early 2025 and includes members in California, Connecticut, New York, Florida and overseas, according to prosecutors. Investigators say participants split responsibilities across database hacking, target selection, fraudulent calls and money laundering, while Ferro was used when assets were stored on wallets that could not be accessed remotely.

Authorities say the stolen funds paid for luxury purchases including Hermès Birkin bags, watches priced as high as $500,000, private jets and exotic cars worth up to $3.8 million. Prosecutors also say nightclub spending reached $500,000 in a single evening, and that Ferro used fake identification documents in laundering activity, bought more than $255,000 in designer goods for co-conspirators and converted crypto into cash to help cover legal fees for a jailed conspiracy leader.

The FBI and IRS Criminal Investigation led the case. The sentencing comes as crypto-related theft remains elevated, with DefiLlama data showing April losses from hacks reached $629.7 million, driven largely by the KelpDAO and Drift Protocol incidents.

Chainalysis security head Yaniv Nissenboim says the April surge points to increasingly sophisticated attacks focused on the infrastructure linking onchain protocols with offchain systems. That pattern suggests security risks for the crypto sector now extend beyond wallet compromise and deeper into the systems that connect digital platforms with user data and account controls.

In our earlier article on the Samourai Wallet case, we covered co-founder Keonne Rodriguez’s post-sentencing appeal for donations after saying legal fees and court penalties left him more than $2 million in debt. We also outlined how he and William Lonergan Hill received multi-year prison sentences after pleading guilty to operating an illegal money-transmitting business, and why the prosecution has become a flashpoint in the broader debate over crypto privacy tools and developer liability.

This material may contain third-party opinions, none of the data and information on this webpage constitutes investment advice according to our Disclaimer. While we adhere to strict Editorial Integrity, this post may contain references to products from our partners.