A $240M Bitcoin theft ended in a spending spree. Who missed it?

According to DataBreaches.net, a network of young men pulled off one of the largest cryptocurrency thefts in U.S. history. They duped a stranger out of bitcoin worth over $240 million. They tried to hide their digital fingerprints, running the proceeds through a sophisticated laundering scheme.

Then, according to the same report carried by DataBreaches.net, the party started.

What is known so far

The theft itself was elaborate. Someone was persuaded to hand over control of bitcoin worth more than $240 million to strangers running a scheme built for exactly that purpose. The scammers then moved to cover their tracks, laundering the stolen funds through channels designed to make the money hard to trace back to them.

Other outlets have since filled in pieces of what happened next. Malone Lam, a 22 year old Singaporean national, pleaded guilty to racketeering charges for leading the group. He is due in U.S. District Court in Washington D.C. on December 8, when more will be said about sentencing.

The gap between stealing and spending

A theft this size required patience and technical skill. Hiding the money required more of the same. But somewhere between laundering the funds and pleading guilty, the group stopped being careful. They spent. That spending is what eventually surfaces in court filings and news reports, long after the theft itself.

This is the part the available reporting does not explain. A group capable of executing one of the largest crypto thefts in U.S. history, and capable of running the proceeds through a laundering operation sophisticated enough to be called that by investigators, then apparently spent the money in a way visible enough to help bring the case together.

Laundering money and spending it without drawing attention are different skills. The first buys time. The second decides whether that time gets used well or wasted. Somewhere in this case, the group had one and not the other.

The open question

What did the spending actually look like, and which purchase or transaction was the one that first drew investigators' attention to this group?