California Man Gets 78 Months for Role in $250M Crypto Ring

Marlon Ferro, 20, of Santa Ana and known online as ‘GothFerrari,’ received a 78-month federal prison sentence, three years of supervised release and an order to pay $2.5 million in restitution after pleading guilty in October 2025 to participating in a RICO conspiracy tied to a crypto theft ring that stole more than $250 million.

Court filings described Ferro as the group’s “instrument of last resort,” carrying out physical burglaries when other members could not access victims’ hardware wallets remotely, the U.S. Attorney’s Office wrote in court documents.

In February 2024 Ferro traveled to Winnsboro, Texas and removed a hardware wallet holding roughly 100 Bitcoin, worth more than $5 million at the time. Months later he flew to New Mexico, spent days staking out a residence and used a brick to break in while co-conspirators monitored the owner’s location through the victim’s iCloud account. A home surveillance camera captured that break-in.

Court records state the conspiracy operated from late 2023 into early 2025 and included members based in California, Connecticut, New York, Florida and overseas. Participants had roles that included hacking databases, identifying targets, making fraudulent calls to trick victims and laundering stolen funds. When targets stored cryptocurrency on hardware wallets that could not be accessed electronically, Ferro was sent to obtain the devices by force or stealth.

Investigators traced substantial spending of the stolen proceeds. Court filings list purchases of Hermès Birkin bags, watches priced up to $500,000, private jet travel and exotic cars valued as much as $3.8 million. One night of nightclub spending reached about $500,000.

Ferro used fake identification to launder money, purchased more than $255,000 in designer goods for co-conspirators and assisted in converting cryptocurrency to cash to cover legal fees for an incarcerated ring leader, according to prosecutors’ filings.

The investigation was led by the FBI and IRS Criminal Investigation, which traced transactions and coordinated arrests and prosecutions across multiple jurisdictions. Prosecutors used RICO charges to link individual acts to a broader pattern of racketeering activity.

The sentence and restitution address only part of the alleged losses. Security firms reported that recent months saw a rise in large cryptocurrency thefts and protocol exploits, with industrywide losses exceeding $600 million in April driven by several major attacks targeting both on-chain infrastructure and the systems that connect digital wallets to users.