Santa Ana Resident Receives 78-Month Sentence for Involvement in Quarter-Billion Dollar Cryptocurrency Heist
A 20-year-old Santa Ana resident, Marlon Ferro, received a prison sentence of 78 months for participating in a criminal network that stole $250 million in cryptocurrency through tactics involving social engineering paired with home invasions.
A California resident aged 20 has received a federal prison sentence of six and a half years for participating in a cryptocurrency theft operation that successfully defrauded individuals of over $250 million.
Santa Ana's Marlon Ferro, who went by the online alias "GothFerrari," received a 78-month prison sentence along with a three-year period of supervised release and an order to pay $2.5 million in restitution, according to a Wednesday announcement from the US Attorney's Office for the District of Columbia. In October 2025, Ferro entered a guilty plea to charges of participating in a conspiracy under the Racketeer Influenced and Corrupt Organizations (RICO) Act.
"Marlon Ferro served as the criminal enterprise's instrument of last resort," according to US Attorney Jeanine Ferris Pirro's written statement, who further explained that whenever fellow conspirators failed to convince victims to hand over their cryptocurrency or were unable to remotely compromise their accounts, Ferro would be dispatched to physically break into properties and take the hardware wallets containing the digital assets.
During an incident in February 2024, Ferro made a trip to Winnsboro, Texas, where he forcibly entered a residence and left with a hardware wallet containing approximately 100 Bitcoin valued at over $5 million during that period. Several months afterward, he took a flight to New Mexico, conducted surveillance on a target residence for multiple days, and employed a brick to break through a window while fellow conspirators tracked the victim's whereabouts via his iCloud account. His criminal actions were recorded by the home's surveillance camera system.
When hacking didn't work, they sent a burglar
The criminal conspiracy operated between late 2023 and early 2025, involving participants located in California, Connecticut, New York, Florida and international locations. Each member of the conspiracy performed specific functions, such as compromising databases, locating potential targets, executing fraudulent telephone calls and processing stolen funds. Whenever victims secured their digital assets on hardware wallets that were inaccessible through remote means, the criminal organization deployed Ferro.
The stolen cryptocurrency was spent by Ferro and his fellow conspirators on high-end merchandise, including Hermès Birkin handbags, timepieces valued at up to $500,000, chartered private aircraft and luxury automobiles worth as much as $3.8 million. A single night's spending at nightclubs totaled $500,000.
Additionally, Ferro engaged in money laundering activities using fraudulent identification documents, spent over $255,000 on luxury designer merchandise for fellow conspirators, and assisted an incarcerated conspiracy ringleader by exchanging cryptocurrency for cash to fund legal representation.
The FBI and IRS Criminal Investigation led the investigative efforts.
Crypto hack losses top $630 million in April
The month of April represented the most severe period for cryptocurrency security breaches in more than a year, with total losses reaching $629.7 million, based on data from DefiLlama. The $293 million exploitation of KelpDAO and the $280 million security breach at Drift Protocol were responsible for the majority of the financial damage, collectively representing more than 90% of the month's total losses.
Yaniv Nissenboim, who serves as security head at Chainalysis, indicated that the spike in hacking incidents during April demonstrates a transition toward more advanced attacks that focus on the infrastructure bridging onchain protocols with offchain systems.