California Man Sentenced for Laundering Millions From Social-Engineering Crypto Heists
Evan Tangeman, a 22-year-old from Newport Beach, California, was sentenced to 70 months in prison after pleading guilty to a RICO conspiracy tied to a cybercriminal network that stole roughly $230 million to $260 million in cryptocurrency from victims. Prosecutors said Tangeman laundered at least $3.5 million between October 2023 and May 2025 for the group, which allegedly stole more than 4,100 Bitcoin from a Washington, D.C., victim in August 2024 and used the proceeds to fund luxury homes, private jets, high-end vehicles, private security, and other lavish purchases.
Authorities said the organization, identified by law enforcement as the Social Engineering Enterprise, targeted wealthy cryptocurrency holders using stolen and dark-web-sourced data, spoofed phone numbers, impersonation of Google and Gemini support staff, and remote-access tools including AnyDesk to obtain Bitcoin Core private keys. Investigators alleged the group then obscured the proceeds through mixers, exchanges, peel chains, pass-through wallets, and VPNs, while Tangeman also helped rent properties under false identities and destroy devices after arrests of key members. Another alleged launderer, Kunal Mehta, has also pleaded guilty and is awaiting sentencing.
Timeline
Apr 27, 2026
Evan Tangeman sentenced to 70 months in prison
On April 27, 2026, Tangeman was sentenced to 70 months in prison for laundering funds tied to the cryptocurrency theft enterprise. The sentence followed his guilty plea and admissions about helping conceal and spend stolen proceeds.
Dec 1, 2025
Tangeman pleads guilty to RICO conspiracy
Evan Tangeman pleaded guilty in December 2025 to RICO conspiracy charges connected to laundering proceeds from the cryptocurrency theft enterprise. He admitted laundering at least $3.5 million in stolen cryptocurrency.
Nov 1, 2025
Kunal Mehta pleads guilty in related case
Another alleged money launderer, Kunal Mehta, pleaded guilty in November 2025 in the same broader case. He was reported to be awaiting sentencing.
May 31, 2025
Tangeman's laundering activity period ends
Prosecutors said Tangeman's admitted laundering conduct continued through May 2025. His role included helping conceal operations and arranging luxury home purchases and rentals under false identities.
Sep 1, 2024
U.S. charges 14 suspects in RICO conspiracy
Authorities charged 14 suspects across September 2024 and May 2025 in a RICO conspiracy tied to the cryptocurrency theft and laundering scheme. Prosecutors alleged the network stole roughly $230 million to $260 million in cryptocurrency from victims.
Sep 1, 2024
Authorities arrest several enterprise leaders
According to prosecutors, several leaders of the organization were arrested in 2024. After those arrests, Tangeman allegedly ordered the destruction of devices and other evidence.
Aug 1, 2024
Victim loses more than 4,100 Bitcoin in social-engineering theft
In August 2024, the group allegedly stole more than 4,100 Bitcoin from a Washington, D.C., victim. Authorities said the theft involved spoofed phone numbers, impersonation of Google and Gemini support, and AnyDesk access to obtain Bitcoin Core private keys.
Oct 1, 2023
Tangeman launders millions for the crypto theft enterprise
Between October 2023 and May 2025, Evan Tangeman allegedly helped launder at least $3.5 million for the criminal enterprise. Prosecutors said the group used mixers, exchanges, peel chains, pass-through wallets, and VPNs to conceal proceeds.
Jan 1, 2023
Social Engineering Enterprise forms to target crypto holders
Prosecutors said the criminal organization later dubbed the Social Engineering Enterprise was formed in 2023 by Malone Lam in Singapore. The group allegedly used stolen and dark-web-purchased databases to identify wealthy cryptocurrency holders for theft and fraud.
See the full picture in Mallory
Mallory subscribers get deeper analysis on every story, including:
Who’s affected and how
Deep-dive technical analysis
Actionable next steps for your team
IPs, domains, hashes, and more
Ask questions and take action on every story
Filter by topic, classification, timeframe
Get matching stories delivered automatically
Related Entities
Threat Actors
Affected Products
Sources
Related Stories
US Law Enforcement Actions Targeting Crypto-Enabled Crime and Illicit Marketplaces
US authorities reported multiple enforcement actions tied to **crypto-enabled crime**. In the Empire Market case, prosecutors said co-creators **Raheim Hamilton** and **Thomas Pavey** designed the dark web marketplace to help users evade law enforcement and launder proceeds; the market allegedly facilitated about **$430M** in transactions (drugs, stolen payment data, counterfeit currency) before disappearing in 2020 in what investigators described as an exit scam that stole an estimated **$30M** in bitcoin. Hamilton pleaded guilty to federal drug conspiracy charges and agreed to forfeit roughly **1,230 BTC** plus **24.4 ETH** and real estate; Pavey previously pleaded guilty and agreed to forfeit about **1,584 BTC** and other assets. Separately, reporting highlighted alleged misuse and laundering of digital assets in other contexts. On-chain investigator **ZachXBT** traced movements from wallets associated with **US-seized crypto** (held under U.S. Marshals Service custodianship) to wallets allegedly linked to **John Daghita**, the son of a federal contractor executive, with claims of roughly **$23M** in diverted cryptocurrency and another wallet holding about **$36M** in Ethereum; ZachXBT said he alerted the **U.S. Marshals Service**. In another DOJ case, **Jingliang Su** (a Chinese national) was sentenced to **46 months** for laundering proceeds from a cryptocurrency investment fraud that authorities said victimized **174** people for **$36.9M**, using social engineering via social media/dating platforms and counterfeit trading sites, with **$26.9M** restitution ordered and multiple US agencies involved in tracing funds and dismantling the network.
1 months ago
Social Engineering Enterprise Cryptocurrency Theft and Prosecution
A criminal group known as the Social Engineering Enterprise orchestrated large-scale cryptocurrency thefts using social engineering tactics and physical attacks to gain access to victims' digital assets. The group targeted individuals with significant cryptocurrency holdings, either deceiving them into revealing access credentials or physically breaking into their homes to steal devices containing private keys. Law enforcement efforts have led to multiple arrests and guilty pleas, including a California man who admitted to laundering millions in stolen cryptocurrency and facilitating the group's operations by renting luxury properties for their activities. In related developments, a key participant in a $263 million social engineering ring pleaded guilty, and additional members have been indicted and arrested in various locations, including Miami and Dubai. The group's operations began in late 2023 and involved members from the United States and abroad, who coordinated attacks and laundered proceeds through real estate and other means. The ongoing investigation highlights the growing threat of organized cybercrime targeting cryptocurrency holders through both digital and physical means.
1 months ago
Daren Li Sentenced in Absentia for $73M Pig-Butchering Crypto Laundering Scheme
A U.S. federal court sentenced **Daren Li** (42), a dual citizen of **China** and **St. Kitts and Nevis**, to **20 years in prison in absentia** for conspiring to launder proceeds from an international **“pig butchering”** cryptocurrency investment/romance-baiting fraud that stole more than **$73 million** from victims. Li pleaded guilty in **November 2024** and admitted that at least **$73.6 million** in victim funds was deposited into accounts controlled by his group, with a significant portion routed through **U.S.-based shell companies**; the operation was tied to scam centers in **Cambodia** and relied on a network of money launderers to move funds through U.S. bank accounts and onward to domestic/international accounts and crypto platforms to obscure origins. Li was arrested in **April 2024** at **Hartsfield-Jackson Atlanta International Airport**, but fled before sentencing in **December 2025** after cutting off his ankle monitor; U.S. authorities have not publicly confirmed his current whereabouts and indicated they will work with international partners to return him to serve the sentence. The court also imposed **three years of supervised release** following imprisonment, and reporting noted that multiple co-conspirators have pleaded guilty, with Li described as the first sentenced defendant directly involved in receiving victim funds.
1 months ago