Key takeaway: Merchants, processors and crypto platforms should treat romance-based social engineering as a direct pipeline into wallet-draining investment fraud. They should tighten verification around crypto wallet connections and NFT investment onboarding flows accordingly.
The Justice Department’s Scam Center Strike Force announced Oct. 27, 2026, that the U.S. Attorney’s Office for the District of Columbia had charged six Africa-based defendants in a fake NFT investment scheme. Prosecutors say the scheme drained cryptocurrency wallets belonging to roughly 800 victims across the United States, stealing more than $516,000, according to the unsealed indictment.
Prosecutors say the defendants ran the scheme from scam compounds in Madagascar. The operation relocated there in early 2025, likely after law enforcement action shut down similar compounds in Cambodia.
The group has ties to Malaysia and China. Investigators traced roughly 74 crypto wallets linked to the victims and found that the scammers moved the stolen funds into accounts tied to China-based actors.
Scammers posed as women on dating websites, using fictional models and fake personas. They built relationships with victims before steering them toward NFT investment platforms. Once a victim connected a crypto wallet to one of the fraudulent sites, the scammers secretly withdrew the funds.
Prosecutors charged Chui Kok Wa, the Malaysian national accused of leading the operation, with conspiracy to commit wire fraud. Investigators say Wa’s phones held scripts that described the approach as an “emotional scam.” The phones also held employment contracts scheduling overnight shifts in Madagascar, timed to match U.S. daytime and evening hours, with bonuses tied to how much money a worker stole.
The six defendants are believed to remain in Madagascar. U.S. Attorney Pirro has called on the Madagascar government to extradite them, citing earlier cooperation problems after a separate FBI deployment to the country in August 2026.
U.S. Attorney Jeanine Ferris Pirro, who leads the Strike Force, said the charges reflect its expanded reach into Africa, India and Europe. She said the expansion follows Chinese-linked transnational criminal organizations as they shift operations across regions. “Operating from overseas does not place those who target Americans beyond the reach of U.S. law enforcement,” said Michael J. Heyman, the U.S. Attorney for the District of Alaska. FBI Criminal Division Assistant Director Heith Janke added, “We will hold you accountable and justice will find you.”
Why it matters: The case lands alongside a sharp rise in the losses tied to this fraud pattern. The Justice Department says cyber-enabled fraud made up almost 85% of all losses reported to the FBI’s Internet Crime Complaint Center in 2025. Within that category, reported losses from cyber-enabled investment fraud climbed from $4.57 billion in 2023 to $8.65 billion in 2025, an 89% increase.
Sources: Justice.gov (USAO-DC), and The Record