GothFerrari gets 78 months for role in $250M crypto theft

A federal judge sentenced Marlon Ferro, 20, of Santa Ana, to 78 months in prison, ordered $2.5 million in restitution and imposed three years of supervised release after Ferro pleaded guilty to participating in a racketeering conspiracy tied to large-scale cryptocurrency thefts.

A multi-year investigation found the criminal enterprise drained more than $250 million in cryptocurrency between late 2023 and early 2025. The group operated in California, Connecticut, New York and Florida, and had links overseas. Members carried out database intrusions, identified targets, made fraudulent phone calls and laundered stolen funds. When online social engineering failed, Ferro was deployed to enter homes and seize hardware wallets.

U.S. Attorney Sandra J. Pirro described Ferro as the criminal enterprise’s ‘instrument of last resort.’ Court records detail several incidents linked to Ferro. In February 2024, he broke into a home in Winnsboro, Texas, and seized a hardware wallet that held about 100 Bitcoin, which was worth more than $5 million at the time. In July 2024, Ferro surveilled a New Mexico residence with a hidden cellphone and later smashed a window with a brick after co-conspirators used the victim’s iCloud account to report the house was empty.

Prosecutors say Ferro also helped launder and spend proceeds from the thefts. He allegedly used a fake identity tied to a foreign national to open a geo-blocked payment card account that routed more than $255,000 in designer clothing to other conspirators. Court filings link stolen funds to high-end purchases and travel, including Hermès Birkin bags, private jet flights, exotic cars valued as high as $3.8 million, and nightclub charges reportedly reaching hundreds of thousands of dollars on single nights.

Ferro was arrested in May 2025 and was found in possession of two firearms at the time. He pleaded guilty in October 2025 to one count of conspiracy to participate in a racketeering-influenced and corrupt organization. At sentencing, the court imposed the prison term, restitution and supervised release.

Authorities say the group used technical attacks and deceptive communications to gain remote access to victims’ accounts, and relied on in-person burglaries when digital methods were blocked. Law enforcement agencies across multiple jurisdictions coordinated the probe and linked activity to individuals in several states and locations overseas.