‘GothFerrari’ cybercriminal sentenced in $263 million crypto theft ring

play

The spoils of their digital plundering funded lavish parties and luxury splurges. But when the operators of a sprawling cryptocurrency racketeering ring needed old-fashioned muscle to steal from their victims, they called on GothFerrari.

This week, GothFerrari – whose real name is Marlon Ferro, a 20-year-old from Santa Ana, California – was sentenced to 78 months in federal prison for his role in a vast conspiracy of fraud that fleeced U.S. victims out of more than $263 million in cryptocurrency. He was also ordered to pay $2.5 million in restitution and serve three years of supervised release.

“Marlon Ferro served as the criminal enterprise’s instrument of last resort,” said Jeanine Pirro, U.S. Attorney for the District of Columbia, in a news release issued by the U.S. Justice Department. “When his co-conspirators couldn’t deceive victims into handing over access to their cryptocurrency or hack their way into digital accounts, they turned to Ferro to break into homes and steal hardware wallets outright.”

Ferro pleaded guilty in October 2025 to conspiracy to participate in a racketeer influenced and corrupt organization.


According to the department, ring members and associates spent their stolen virtual currency on $500,000-a-night nightclub services, exotic cars worth up to $3.8 million, luxury watches and handbags, private jets and security, and rental homes in Miami, Los Angeles and the Hamptons. Bulk cash was sometimes shipped to members through the U.S. mail, hidden in plush stuffed animals.

Among the items authorities listed as subject to forfeiture from the group, according to a superseding indictment, were more than two dozen vehicles including multiple Lamborghinis, Porsches, Rolls-Royces, BMW’s and Ferraris, in addition to dozens of designer clothing items and nearly $170,000 in a Louis Vuitton bag.

The group’s criminal activities occurred from October 2023 to March 2025, the justice department said, with members in California, Connecticut, Florida, New York and abroad playing specialized roles that included target identification, database hacking, fraudulent phone calls, money laundering and residential burglary. According to a previous department release, the group had developed out of friendships formed on online gaming platforms.

The enterprise targeted people believed to hold significant cryptocurrency holdings. Members cold-called the victims and used psychological manipulation to make them believe their accounts had been hacked and that enterprise callers were attempting to help secure them, thus gaining access to their digital wallets.

However, victims occasionally stored their crypto in hardware wallets, physical devices that couldn’t be remotely accessed. That’s when the group turned to Ferro, the department said.

By summer 2024, Ferro – who had already stolen more than $5 million of bitcoin from a victim in Texas, according to the department – had ingratiated himself with racketeering ring leaders and offered his residential burglary services for future ring operations.

In July 2024, Ferro flew to New Mexico, where he positioned a cell phone outside a residence to monitor the victim’s movements for several days while co-conspirators tracked the victim’s location through an iCloud account, justice officials said.

When his co-conspirators indicated the victim had left, Ferro used a brick to smash a window and broke into the residence and searched for the victim’s hardware wallet, his presence recorded by home surveillance cameras, federal prosecutors said.

In addition to his burglary skills, the justice department said Ferro was also a key money launderer for the operation, using fake ID’s obtained abroad to open a digital payment card account that allowed enterprise members to spend stolen currency. Ferro himself spent more than $250,000 on designer clothing with stolen funds, they said.

After a leader of the enterprise was arrested and jailed in September 2024, Ferro continued to help him from the outside, illicitly converting hundreds of thousands worth of cryptocurrency into cash that he used to pay the leader’s attorneys. He also arranged for the purchase of designer bags that were shipped to the arrested leader’s girlfriend, the department said.

Ferro was arrested in May 2025 and found in possession of two firearms and a fake ID.

“This scheme blended sophisticated online fraud with old-fashioned burglary to drain victims of millions of dollars in digital assets,” Pirro said. “Cryptocurrency fraud is not a victimless, consequence-free crime carried out safely behind a screen—it is serious criminal conduct that will lead to federal prison.”