"In the scheme, scammers posed as beautiful women who met victims on dating websites, eventually enlisting them to connect their cryptocurrency wallets to fraudulent websites associated with the NFT investments," the Justice Department said in a news release.
The six charged and the Madagascar compound
Prosecutors announced criminal charges against six people — Chui Kok Wa, Gislen Neukeu, Shamusa Ninsiima, Clement Mugiraneza, Merveille Mudacumura and Nicodemus Hingima Monyancha — accused of running an NFT-investment fraud rooted in a scam compound established in Madagascar early last year. The affidavit for the arrests links the criminal group to China and Malaysia and places the compound at the center of a cross-border operation that targeted Americans.
How the fraud worked: dating profiles, NFTs, and connected wallets
According to the Justice Department, the group used online dating websites, posing as women to form relationships with victims and then persuade them to participate in what were presented as NFT investments. The scammers allegedly enlisted victims to connect their cryptocurrency wallets to fraudulent websites associated with those NFT investments. "Once connected, the scammers willed the victims to continue to fund their cryptocurrency wallets, and then surreptitiously pulled money from the victims’ wallets without their knowledge," the department said.
Nobody's watching your logs at 2 AM.
Full SOC coverage without building one. Nubivance deploys and manages Rapid7 InsightIDR and MDR for organizations that need detection and response, not another dashboard.
Get coverageEvidence seized, devices reviewed, and regional links
Investigators say the FBI identified approximately 74 cryptocurrency wallets tied to roughly 800 victims, with an estimated loss of at least approximately $516,695, according to the affidavit and the Justice Department news release. In August, the U.S. District of Columbia’s Scam Center Task Force, the FBI’s field office in Honolulu and the U.S. Attorney’s Office for the District of Alaska traveled to Madagascar to review electronic devices seized from the scam compounds.
Officials reported that phones attributed to the alleged scheme leader, Wa, contained employment contracts and scripts instructing workers how to speak to victims, including direction that they would be committing "an emotional scam." Devices and interviews also established connections between the operation and locations in Southeast Asia and China. Interviews with workers at the Madagascar compound stated that prior Cambodian police action and armed conflict between Thailand and Cambodia prompted a move of operations to Madagascar.
After those initial on-site interviews, the Justice Department said Madagascar repatriated some suspects to China before the U.S. investigation was complete.
D.C. U.S. Attorney Pirro, material witness warrant, and alleged trafficking
The D.C. U.S. Attorney Pirro publicly called on the Madagascar government to cooperate with the United States and to extradite the six charged defendants. The Justice Department said the government had obtained a material witness warrant to interview 15 employees of the scheme who claimed they were human trafficked and abused by Wa, but who are believed to be held in jail in Madagascar.
What this means for technologists and security teams, policymakers and regulators, and end users
- Technologists and security teams: The case underscores a social-engineering pathway that pairs romance-based scams with cryptocurrency wallet interactions and fake NFT sites; teams responsible for fraud detection and transaction monitoring will want to flag wallet connections initiated through third-party links presented during personal chats.
- Policymakers and regulators: The cross-border movement of suspects and the reported repatriation of some individuals to China before the U.S. review was complete highlight diplomatic and law-enforcement coordination challenges; advocates in the release asked Madagascar to cooperate and consider extradition to allow interviews tied to alleged human trafficking claims.
- End users and the general public: The FBI trace in this case attributed approximately 74 wallets and about 800 victims, with losses of at least approximately $516,695 — a reminder that requests to connect wallets to unfamiliar websites, even when presented through trusted-feeling personal relationships, can be the prelude to theft.
The Justice Department also noted a broader operational milestone: the Scam Center Strike Force had crossed the $1 billion threshold in cryptocurrency recovered in its first year. For this case, the immediate questions left on the table are concrete: whether Madagascar will extradite the six charged defendants, whether investigators will be allowed to interview the 15 employees identified under a material witness warrant, and how the repatriation of some suspects to China will affect the pending U.S. prosecutions. The facts on record point to a sophisticated blending of romance fraud and cryptocurrency mechanics, and to investigative work that is still seeking full cooperation from foreign authorities.
