A 20-year-old California man known online as “GothFerrari” has been sentenced to 78 months in federal prison for his role in a criminal enterprise that stole more than $250 million in cryptocurrency from victims across the United States over a period of roughly 14 months between late 2023 and early 2025.
Marlon Ferro, of Santa Ana, California, pleaded guilty to conspiracy to participate in a racketeer influenced and corrupt organisation (RICO) following his arrest on May 13, 2025, at which point authorities found him in possession of two firearms and a fraudulent identification document. U.S. District Court Judge Colleen Kollar-Kotelly handed down the sentence on Wednesday. In addition to the prison term, Ferro was ordered to pay $2.5 million in restitution and will serve three years of supervised release upon completing his sentence.
The operation and Ferro’s role
The criminal enterprise relied primarily on social engineering, deceiving victims into handing over access to their digital wallets or hacking into accounts directly. Ferro functioned as what U.S. Attorney Jeanine Ferris Pirro described as the group’s “instrument of last resort.” When online methods failed, Ferro was dispatched to physically break into victims’ homes and steal hardware wallets.
In February 2024, Ferro travelled to Winnsboro, Texas, where he broke into a residence and stole a hardware wallet containing approximately 100 Bitcoin, worth more than $5 million at the time. Five months later in New Mexico, he conducted surveillance on a second property before smashing a window with a brick to search for additional hardware wallets. The willingness to escalate from digital fraud to physical burglary set the group apart from more conventional crypto theft operations and added a layer of personal danger for victims that is uncommon in financial cybercrime.
Beyond the break-ins, Ferro also served as the group’s primary money launderer. Using fraudulent identification, he established a digital payment card on a geo-blocked platform, enabling co-conspirators to spend stolen cryptocurrency on everyday goods and services. Ferro personally used stolen proceeds to fund a lavish lifestyle for the group, spending more than $255,000 on designer goods, including Hermès Birkin bags purchased for the girlfriend of the operation’s leader. Even after that leader was arrested and sentenced in September 2024, Ferro continued operating from the outside, laundering hundreds of thousands of dollars and using the funds to cover the conspiracy leader’s legal fees.
A clear message from prosecutors
U.S. Attorney Pirro was direct in framing the significance of the sentence. “This scheme blended sophisticated online fraud with old-fashioned burglary to drain victims of millions of dollars in digital assets,” she said, adding that the outcome should serve as a warning that cryptocurrency-related crime carries real, serious consequences, not just regulatory risk or civil liability.
The case is notable for several reasons beyond its scale. It illustrates how crypto theft has evolved beyond purely technical exploits into hybrid operations that combine digital manipulation with physical intrusion. It also highlights the vulnerability of hardware wallets, devices that are specifically designed to keep digital assets offline and secure, when adversaries are willing to resort to physical theft to obtain them.
As crypto asset values continue to climb, cases like Ferro’s suggest that the threat landscape for individual holders is expanding in ways that go beyond phishing emails and exchange hacks. Securing private keys in the digital world is no longer enough if the physical location of hardware devices can be identified and targeted.
