The California crypto theft jailing handed down this week closed a case that mixed remote hacking with actual breaking and entering. Marlon Ferro, 20, from Santa Ana, got 78 months in federal prison for his part in a conspiracy that lifted more than $250 million in digital assets. The US Attorney’s Office for the District of Columbia announced the sentence Wednesday. Three years supervised release. $2.5 million in restitution.
Ferro traded online as GothFerrari. His job in the ring was straightforward. When the rest of the crew couldn’t talk victims into handing over their crypto or break into their accounts remotely, they sent him to steal the hardware wallets in person.
The California crypto theft jailing: what the sentence covered
The California crypto theft jailing followed a guilty plea in October to participating in a RICO conspiracy. US Attorney Jeanine Ferris Pirro called Ferro the criminal enterprise’s instrument of last resort. February 2024, he travelled to Winnsboro, Texas, broke into a home, walked out with a hardware wallet holding about 100 Bitcoin. Worth north of $5 million at the time. Months later he flew to New Mexico, spent days watching a residence, used a brick to smash his way in whilst co-conspirators tracked the victim’s location through his iCloud account. A home surveillance camera caught it.
| Incident | Location | Method | Value |
|---|---|---|---|
| February 2024 | Winnsboro, Texas | Break-in, hardware wallet theft | 100 BTC (~$5m) |
| Later 2024 | New Mexico | Brick entry, iCloud tracking | Undisclosed |
| Total conspiracy | Multiple states | RICO operation | $250m+ |
| Sentence | Federal court | 78 months, $2.5m restitution | – |
The conspiracy ran from late 2023 to early 2025. Members spread across California, Connecticut, New York, Florida, and overseas. Each had a role. Hacking databases. Identifying targets. Making fraudulent calls. Laundering money. When victims kept their funds on hardware wallets the gang couldn’t access remotely, they sent Ferro.
How the ring spent the money
The sentence in the California crypto theft jailing included 78 months in federal prison, three years supervised release, and $2.5 million in restitution. The gang spent the stolen funds on Hermès Birkin bags, watches up to $500,000, private jets, exotic cars worth as much as $3.8 million. Nightclub tabs hit $500,000 in a single evening. Ferro also laundered money using fake identification, purchased over $255,000 in designer goods for co-conspirators, and helped a jailed conspiracy leader by converting crypto to cash to cover legal fees.
The FBI and IRS Criminal Investigation led the investigation. The case sits within a wider pattern of crypto theft that has escalated this year. April was the worst month for crypto hacks in over a year, with losses totalling $629.7 million according to DefiLlama. KelpDAO’s $293 million exploit and Drift Protocol’s $280 million hack drove the bulk of the damage, together accounting for more than 90% of monthly losses.
The infrastructure angle
The California crypto theft jailing reflected the scale of the operation and Ferro’s role as the physical enforcement arm. Chainalysis security head Yaniv Nissenboim noted that April’s hack surge reflects a shift toward sophisticated attacks targeting the infrastructure connecting onchain protocols to offchain systems. The Ferro case shows the other end of the sophistication spectrum. When the technical route fails, send someone with a brick.
Hardware wallets are supposed to be the secure option. Offline. Air-gapped. Not connected to anything a remote attacker can reach. The Texas job in February showed the limit of that logic. If the wallet is in a house and someone knows where the house is, the security model changes. The conspiracy identified targets, mapped their holdings, tracked their movements, and dispatched Ferro when the moment came. Home surveillance caught him in New Mexico. By then the pattern was clear.
What comes next
Six and a half years puts Ferro inside until 2031. The $2.5 million restitution order is a fraction of the $250 million the conspiracy lifted. The rest of the ring’s members face separate proceedings. The luxury purchases and nightclub spending suggest most of the funds are gone. Tracking crypto once it’s been laundered through multiple wallets and converted to cash or hard assets is difficult. The IRS Criminal Investigation team will chase what they can recover.
The April hack figures from DefiLlama show the broader environment Ferro’s conspiracy operated in. $630 million in a single month. KelpDAO and Drift Protocol accounted for most of it, but the sheer volume of smaller incidents points to an ecosystem under sustained pressure. Nissenboim’s comment about infrastructure attacks is accurate. The bridge between onchain and offchain is where the cracks show. Ferro’s role was cruder but effective. Break the door, take the wallet, fly home.
This article is for information purposes only and does not constitute investment advice. Readers should not act on any information contained here without first consulting an authorised financial adviser. Past performance is not a reliable indicator of future results.
