Federal prosecutors in Washington on Tuesday 27 October charged six Africa-based people over a crypto romance scam run from scam compounds in Madagascar, according to a press release from the US Attorney’s Office for the District of Columbia. The alleged leader, Chui Kok Wa, is charged with conspiracy to commit wire fraud. The FBI tied about 74 crypto wallets to roughly 800 victims across the United States, and the United States is now asking Madagascar to hand all six over.
The pitch was not a new token or a hacked app. Workers allegedly posed as attractive women on dating websites, built up a relationship, then steered each victim to a website selling NFT investments. Once the victim connected a crypto wallet and kept topping it up, the money was pulled out without the owner knowing, prosecutors say.
US Attorney Jeanine Ferris Pirro announced the case with Michael J. Heyman, the US Attorney for the District of Alaska, Heith Janke, assistant director of the FBI’s Criminal Division, and Tara McLeese, who runs the Secret Service’s Washington Field Office. Affidavits supporting the arrest of the six were unsealed the same day (the department has posted a redacted affidavit), along with an earlier warrant that seized the scheme’s websites. All six are presumed innocent; the charges are allegations that have not been tested in court.
Six charged, one named: what the DOJ says about Chui Kok Wa
Only one defendant is named in the release. Chui Kok Wa is described as the leader of the NFT investment scheme. The other five names, the court docket and any maximum sentence are not given, and the release does not say that anyone is in US custody.
Much of the case rests on Chui Kok Wa’s phones. According to the DOJ, they held employment contracts for overnight shifts in Madagascar, timed to match daytime and evening hours in the United States. Bonuses were tied to the amount of money taken from victims. Scripts on the devices told workers they were running “an emotional scam”, in the words the department quotes from them.
The phones also held a staff roster. It listed each employee’s name, passport details, salary, working hours, disciplinary record and wallet addresses, the release says.
Victims’ wallets were linked to Maryland, Oregon, Nevada and Minnesota, WJLA (7News) reported from the announcement. Prosecutors say the stolen funds moved on to crypto accounts associated with actors based in China.
74 wallets, about 800 victims and at least $516,695 in losses
The release gives two numbers for the scale: about 74 wallets and about 800 victims who reported losses. It gives no dollar total. That figure comes from the FBI affidavit, as reported by The Defiant: losses of at least $516,695 across the 74 victim-linked wallets. The same report says victims were induced to grant unlimited spending approvals on USDT, Tether’s dollar stablecoin.
The Defiant headlined the story as an NFT wallet-draining scheme. The DOJ’s own wording is narrower. It speaks of fake NFT investment scams and fraudulent investment websites, names no NFT collection and no drainer software. The NFTs, in the government’s telling, were the shop window for a con built on the relationship.
That puts the case closer to the long-running “pig butchering” model than to the drainer kits sold as a service in 2023 and 2024. Our step-by-step guide to pig butchering romance scams describes the same sequence: contact on a dating or social app, weeks of trust, then an investment platform the victim cannot verify.
How one wallet approval can empty a USDT balance
Connecting a wallet to a website does not by itself move funds. What matters is what the victim signs next. On networks such as Ethereum, a token like USDT lets the owner sign an “approve” transaction that authorises another address to spend a set amount on their behalf. Many sites ask for an unlimited amount, so the user does not have to sign again later.
If that other address belongs to a scammer, the approval works like a standing order. The scammer can move the approved token out of the wallet at any time, without a new signature. That would explain why prosecutors say victims were encouraged to keep funding their wallets: every new deposit of USDT sat within reach of an approval already given. The Defiant’s report on the affidavit does not name the blockchain.
Approvals can be revoked. Block explorers and most wallet apps let users see which addresses hold a spending allowance on their tokens and cancel it with one transaction, paid for in network fees. Revoking does not bring back funds already taken, but it closes the door for the next deposit.
Madagascar became the scam compounds’ new base after Cambodia
According to the release, a criminal group with ties to Malaysia and China opened scam compounds in Madagascar in early 2025. It most likely moved there from Cambodia after law enforcement action in that country.
In August 2026, an FBI team went to Madagascar at the invitation of the country’s Ministry of Justice and National Police. It helped local forces take down 13 scam compounds, and more than 3,200 electronic devices were seized, the DOJ says.
Speaking in September, Pirro put the arrests from that operation at 500, AFP reported via Gulf News. The DOJ said then that 50 people had been tried and convicted in Madagascar. Madagascar’s justice ministry called them a first wave of Chinese citizens sent back to China, where they are to serve two to ten years in prison.
The new release shows the cost of that outcome for US investigators. After the raids, US investigators could not get access to the people involved, and Madagascar returned many suspects to China before the investigation was finished, the DOJ says.
The United States asks Madagascar to extradite all six
Pirro publicly called on Madagascar to cooperate and extradite the six defendants. The government also obtained a material witness warrant to interview 15 employees of the operation. They say they were trafficked and abused by Chui Kok Wa, and they are believed to be held in a jail in Madagascar.
Heyman, whose Alaska office worked the case with the FBI’s Honolulu Field Office, said: “Operating from overseas does not place those who target Americans beyond the reach of U.S. law enforcement.” McLeese said scam-center operators “wrongly assume they can relocate to escape our reach”.
Extradition is a slower track than the August raids. Its outcome depends on Madagascar’s courts and government, and the release gives no timetable. Washington has used that route before in USDT fraud: Zheng Zhao was extradited from the Netherlands in a separate case, as we reported in our story on the $36.9 million USDT scam extradition.
Scam Center Strike Force passes $1 billion in restrained crypto
The case was announced as part of a wider update from the Scam Center Strike Force, the DOJ unit launched in November 2025 and directed by Assistant US Attorney Karen P. Seifert in Washington. The task force now reports more than $1 billion in cryptocurrency restrained. These are task-force-wide totals, not figures from the Madagascar case.
| Scam Center Strike Force and IC3 figure | Value | Source |
|---|---|---|
| Crypto restrained since November 2025 | $1,006,460,156.82 | DOJ, 27 Oct 2026 |
| Fraudulent crypto investment websites seized | 700 | DOJ, 27 Oct 2026 |
| Scam accounts removed by Meta in the past year | 17.3 million | Meta, cited by DOJ |
| Crypto investment fraud losses reported to IC3, 2023 | $4.57 billion | FBI IC3, cited by DOJ |
| Crypto investment fraud losses reported to IC3, 2025 | $8.65 billion (+89%) | FBI IC3, cited by DOJ |
| Share of 2025 reported losses from cyber-enabled fraud | almost 85% | FBI IC3, cited by DOJ |
The release also lists seized Starlink terminals, the first seizure of a Telegram channel used to recruit trafficking victims, and two channels that hosted the Xinbi Guarantee Network, an illicit marketplace. It thanks private partners including Tether, Chainalysis, TRM and Elliptic, as well as Microsoft, Meta and Google, and says OpenAI has committed to work with the Strike Force.
The same announcement covered two unrelated cases: arrests in Nigeria tied to the RaccoonO365 phishing kit and sextortion charges in South Africa. The policy backdrop is Executive Order 14390, signed on 6 March 2026, on cybercrime, fraud and predatory schemes. The White House has been pressing the same message, as covered in our report on the crypto scam crackdown, though restrained funds are not the same as money returned to victims.
What is still unknown about the case
Several basic facts are missing from the public record so far. The release does not name five of the six defendants or say whether any of them is detained. It gives no maximum penalty. Neither the release nor the reporting on the affidavit names the blockchain or lists the wallet addresses. Nothing has been said about whether any of the at least $516,695 has been frozen or could be returned.
The next markers are procedural: a response from Madagascar to the extradition request, the interviews with the 15 material witnesses, and any further unsealed filings in the District of Columbia.
How to avoid a crypto romance scam like this one
Pirro’s warning to the public, as reported by WJLA, was direct: “Never connect your cryptocurrency wallet to a website recommended by someone that you met online.” The pattern alleged in this case gives a few concrete checks.
- Treat any investment site introduced by a new online contact as hostile, whatever it sells: NFTs, trading bots or yield.
- Read what a wallet asks you to sign. An approval for an unlimited token amount lets the other side spend that token later without asking again.
- Check your token approvals in your wallet or on a block explorer and revoke the ones you do not recognise.
- In the United States, report losses to the FBI’s Internet Crime Complaint Center (IC3) and keep transaction hashes and chat records.
Our guide on how to avoid crypto scams and where to report them covers the other common variants and the reporting channels outside the United States.