The suspects, aged 20 to 25, face up to 20 years in prison for crypto theft and identity fraud following a two-year phishing spree