A young man who laundered $3.5 million for a crime syndicate dubbed the Crypto Kids has been sentenced to 70 months by a federal judge in the United States District Court for the District of Columbia. Investigators said the group formed through online gaming platforms and squandered its loot on an extravagant lifestyle. The U.S. Attorney said the multi-state enterprise scammed more than $263 million in cryptocurrency from investors.

1. Introduction

On December 8, 2025, the U.S. Attorney’s Office, District of Columbia, in Washington, D.C. announced that Evan Tangeman of Newport Beach, California pleaded guilty before U.S. District Court Judge Colleen Kollar-Kotelly in connection with his role in a conspiracy that deployed social engineering to steal $263 million in cryptocurrency from targets throughout the United States. (here) On April 24, 2026, Mr. Tangeman was sentenced to 70 months imprisonment and three years of supervised release for laundering $3.5 million for members of the enterprise. Describing the enterprise as “so brazen it borders on the cartoonish”, U.S. Attorney Jeanine Ferris Pirro said the proceeds were used to support “fantastically extravagant lifestyles”. (here)

2. Background

A second superseding indictment filed on October 29, 2025, charged nine defendants as associates of an enterprise called the Social Engineering Enterprise. (here) Social engineering is a type of fraud scheme designed to trick targets into providing passwords, PINs and other information used to gain access to cryptocurrency accounts and other personal files that I discussed in previous posts to On The Wire. (here and here) The associates performed different roles including database hackers, organizers, callers, money launderers and residential burglars targeting hardware virtual currency wallets. The money launderers, such as Mr. Tangeman, received stolen virtual currency and turned it into fiat U.S. currency in the form of bulk cash or wire transfer.

The purposes of the enterprise included: (a) stealing virtual currency from victims throughout the United States by “fraudulent pretenses”; (b) disguising the source and ownership of the stolen funds through the use of virtual currency laundering techniques; and, (c) converting laundered virtual currency into fiat currency and wire transfers at nightclubs, to purchase exotic cars, and rent private jets and mansions in Los Angeles, the Hamptons and Miami. Here are six of the alleged means and methods deployed by the defendants:

• obtaining stolen databases primarily related to virtual currency assets in order to identify potential victims who held large amounts of virtual currency across different exchanges;
• causing unauthorized account access push notifications to be sent to potential victims in the leadup to a social engineering attack in order for the fraudulent “support” call to seem more legitimate;
• making fraudulent “support” calls and identifying themselves as employees from major exchanges or email account providers and tricking victims into providing email account passwords, cloud storage account passwords, seed phrases, private keys and logins for exchanges;
• using stolen seed phrases and private keys to access victims’ virtual currency and transfer the virtual currency into their possession;
• executing home break-ins to recover physical hardware wallets when associates identified substantial virtual currency holdings on cold-storage physical devices; and,
• laundering stolen virtual currency through off shore exchanges and converting it to Monero (XMR) to conceal its ownership and location.

The stolen virtual currency was used to purchase, among other things, nightclub services ranging up to $500,000 an evening, luxury watches valued up to and over $500,000, and a fleet of exotic cars ranging in value up to $3,800,000.

3. The RICO Count

Count One of the second superseding indictment alleged that the nine defendants conspired to participate “in the conduct of the affairs of the enterprise through a pattern of racketeering activity” consisting of multiple acts including wire fraud and money laundering. It was the core allegation because the Racketeer Influenced and Corrupt Organizations Act (RICO) makes it unlawful to acquire, operate or receive income from an enterprise through a pattern of racketeering activity. (here)

The underlying principle of RICO is the prohibition of a pattern of crimes conducted through an enterprise which the statute defines as “any individual, partnership, corporation, association, or other legal entity, and any union or group of individuals associated in fact although not a legal entity”. Here are three overt acts alleged to have involved Mr. Tangeman:

• in March 2024 Mr. Tangeman assisted two co-conspirators to obtain a rental home in Encino, California. The two co-conspirators, and a third co-conspirator Malone Lam, paid for the home with stolen cryptocurrency which Mr. Tangeman received and changed into fiat currency for cash payments to the property owners;
• in July 2024 Mr. Tangeman directed Mr. Lam to send $194,000 in stolen virtual currency to Mr. Tangeman’s “cash guy” so that Mr. Tangeman could receive fiat cash and use it to pay a security deposit at one of Mr. Lam’s Los Angeles rental homes; and,
• in August 2024 Mr. Tangeman assisted Mr. Lam in securing another Los Angeles rental home in exchange for stolen virtual currency. Mr. Tangeman directed Mr. Lam to send $337,050 in USDT to Mr. Tangeman’s “exchanger” which included a 7% commission for unlicensed crypto-to-cash services.

The RICO count also alleged it was part of the conspiracy that each defendant agreed that a conspirator would commit at least two acts of racketeering activity in the conduct of the affairs of the enterprise. Again, this was an important allegation because the statute provides that a “pattern of racketeering activity” requires at least two acts of racketeering activity.

4. Conclusion

According to federal investigators the group impersonated employees and security technicians of cryptocurrency exchanges such as Coinbase and Gemini to steal from their targets. Writing for the Los Angeles Times, Ruben Vives said an unidentified associate of the group called them the “crypto kids”. The group included fixers who set them up with homes, cars, clothes and other luxuries. “Among the fixers was Tangeman, who federal authorities said not only converted the stolen cryptocurrency into cash but worked with real estate agents in Los Angeles to obtain large mansions for members,” Mr. Vives said. (here) The group was comprised of unemployed young men, many of them teenagers, who feared drawing attention from authorities for renting high end homes with no source of income.