Scattered Spider Eyes: The $263M Heist Crew of Online Gamers

They met online gaming. They stole $263M. They spent it on Lamborghinis and $500K nightclub tabs. Now they're going to prison one by one.

Between October 2023 and May 2025, a loose network of young men met on online gaming platforms and stole $263 million in cryptocurrency. They called themselves the Scattered Spider Eyes - SEE for short. They were not professional criminals. Most were under 25. Some were under 20. They built relationships in Discord and on game servers, divided the work into hacking, voice phishing, money laundering, and physical theft, and ran the entire operation across multiple US states and overseas territories. They got caught because they could not stop showing off.

The leader was Malone Lam. The FBI arrested him in September 2024 in Los Angeles. He had not been hiding. He had been driving around in supercars with stacks of cash and posting nightlife photos. After Lam was jailed, the rest of the crew did not collapse. They reorganized. Members continued executing thefts and laundering proceeds for months. The DOJ has been picking them off one at a time ever since.

The crew's specialty was the high-touch heist. According to the superseding indictment, they ran three categories of operations. Hackers compromised websites and servers to harvest cryptocurrency-related databases - email addresses, partial wallet info, customer profiles for major exchanges and DeFi platforms. Voice phishers used those databases to call targets pretending to be exchange security teams or hardware wallet support, walking victims through "verification" flows that handed over seed phrases. A separate cell handled money laundering, converting the stolen crypto through chains of swaps and finally into cash. At least two members worked across multiple operations.

The hardware-wallet thefts were the most direct. Members traveled to specific addresses in Texas, California, and elsewhere to physically steal hardware wallets they had identified through prior reconnaissance. Daniel "DirtyDirt" Ferro started his career with the crew this way. In February 2024, he traveled to Winnsboro, Texas, broke into a residence, and stole a hardware wallet containing roughly 100 Bitcoin - worth more than $5 million at the time. He laundered it through online exchanges. The success made him a recruiting candidate.

Ferro relocated to California later in 2024. The move put him in proximity to the rest of the inner circle. SEE members were spread across California, Connecticut, New York, Florida, and overseas territories, but California was effectively the operations hub. Ferro became the crew's general utility man - moving funds, running errands, helping with laundering operations. After Lam's September 2024 arrest, Ferro became something more disturbing. He gathered cryptocurrency from other crew members and used those funds to pay Lam's lawyer. He carried messages from Lam in jail to the rest of the network. He kept the crew functioning while its leader was in custody.

The spending was the part that made jurors hate them. Members ran up half-million-dollar nightclub tabs. They bought Lamborghinis. They wore Rolexes. They flew to Vegas and Miami on weekends. The most cartoonish moment may have been a documented half-million-dollar bottle service tab at a single nightclub. US Attorney Jeanine Pirro, announcing one of the convictions, summed it up: "This criminal enterprise was built on greed so brazen it borders on the cartoonish. They stole millions, spent it on half-million-dollar nightclub tabs, Lamborghinis, and Rolexes."

Evan Tangeman became the ninth member to plead and be sentenced. The 22-year-old from Newport Beach received 70 months on April 24, 2026. He admitted to laundering at least $3.5 million for the crew, converting stolen crypto into cash that other members could spend on the lifestyle. His role was simple in the network's division of labor. He was the off-ramp. Without his work, the stolen money sat as digital tokens. With it, the others could buy real things.

Two weeks later, on May 7, 2026, Daniel Ferro was sentenced to 78 months - 6.5 years. The judge ordered $2.5 million in restitution. Ferro had pleaded guilty to participating in conspiracies behind more than $250 million in cryptocurrency thefts. The judge cited not just the original Texas BTC theft, but his post-arrest role keeping the crew functional and paying Lam's legal bills.

The DOJ's announcement at Ferro's sentencing said the quiet part loud: "Today's sentence sends a clear message: cryptocurrency fraud is not a victimless, consequence-free crime carried out safely behind a screen. It is serious criminal conduct that will lead to federal prison." The federal courts have heard variations on that line for fifteen years now. The SEE Crew prosecutions are different because they target young people who built the operation entirely online and assumed online presence equals online consequences.

Where is the $263 million? Some has been seized through forfeiture. Court records indicate Ferro forfeited specific assets and faces $2.5 million in restitution. Tangeman admitted to laundering $3.5 million; that fraction is being clawed back through similar mechanisms. But most of the proceeds went into consumption - cars, watches, real estate, nightclub bills, travel. The clubs are not refunding bottle service. The dealerships are not unwinding Lamborghini sales. The watches will be auctioned for pennies on the original dollar.

For victims, this is the standard crypto-crime outcome. The original holders of those 100 Bitcoin in Winnsboro lost the coins permanently. Hardware wallet theft is irreversible. Voice-phished seed phrase victims have no recovery. The forfeitures fund some of the operations of US Marshals and federal courts. Restitution orders against people without assets become judgments that pile up interest while the defendants serve their sentences.

The case is far from closed. Tangeman was the ninth conviction. Ferro was the latest sentencing. Lam himself faces years more in court. Other members are still being indicted, charged, plea-negotiated, and sentenced. The geographic spread - California, Connecticut, New York, Florida, and overseas territories - means multiple US Attorney's Offices are running parallel prosecutions. Prosecutor Jay Clayton's SDNY office is among them.

The SEE Crew is the new template for crypto crime in 2026. Not a state actor. Not a single mastermind. A diffuse network of young men who built relationships through online gaming, divided labor like a startup, and ran the entire operation with the casual coordination of a Discord server. They were not particularly sophisticated. They got caught because they could not resist the lifestyle. The next crew that runs this playbook will be slightly smarter about that part.