The US Justice Department's Scam Center Strike Force announced charges on Tuesday, October 27, 2026, against six Africa-based scammers accused of running a fake cryptocurrency investment scheme from compounds in Madagascar that drained the digital wallets of Americans who thought they had found love online. Prosecutors say the group posed as women on dating websites and social apps, built emotional relationships with victims, and then steered them into fraudulent NFT investment websites that quietly emptied their crypto wallets.
The charges were unsealed on Tuesday in Washington, where Pirro appeared alongside the FBI and the US Secret Service to announce the latest actions by the Scam Center Strike Force, the interagency unit she launched in November 2025 to fight Chinese organised crime syndicates running scam centres. The six defendants are accused of targeting Americans with fake nonfungible token, or NFT, investment scams, and the US has asked Madagascar to extradite them.
The Justice Department says a prior warrant also seized the websites associated with the scheme. Only one defendant is named in the release: Chui Kok Wa, accused of leading the NFT scheme and charged with conspiracy to commit wire fraud. The other five charged people are not named in the material released on Tuesday. Charges are allegations, not convictions, and the defendants have not yet faced the charges in a US courtroom.
The Madagascar case did not come out of nowhere. The group opened its Madagascar compounds in early 2025, likely moving from Cambodia after law enforcement action there. In August 2026, the FBI sent a team to Madagascar at the invitation of the country's Ministry of Justice and National Police to help take down 13 scam compounds, seizing more than 3,200 electronic devices. But the Justice Department says the US effort was then frustrated: American investigators were blocked from interviewing the people involved, and Madagascar repatriated numerous suspects to China before the investigation was complete.
On Tuesday, Pirro publicly called on Madagascar to cooperate with the United States and extradite the six charged defendants. She also said the government has obtained a material witness warrant to interview 15 employees of the scheme who say they were trafficked and abused by Wa, but who are believed to be held in jail in Madagascar.
The Strike Force itself was created to confront a fraud economy that has grown far beyond Southeast Asia. On March 6, 2026, President Donald Trump signed Executive Order 14390, directing the administration to prioritise cybercrime, fraud and predatory schemes draining American families of their savings. The FBI's Internet Crime Complaint Center says cyber-enabled fraud accounted for almost 85 percent of all losses reported to it in 2025, and that reported crypto investment fraud losses rose from $4.57 billion in 2023 to $8.65 billion in 2025. Officials stress those figures almost certainly understate true losses, because most victims never report.
The mechanics described by prosecutors are a textbook "pig-butchering" style romance scam, adapted for NFTs. First came the persona: scammers used photographs of beautiful women to meet US victims on dating sites, then moved the conversation to social and messaging apps where trust could be built over days or weeks. Then came the pitch: a supposedly lucrative NFT investment opportunity, complete with professional-looking websites. Then came the trap: victims were told to connect their cryptocurrency wallets to those sites, a step that, prosecutors say, gave the scammers the ability to drain funds once victims kept topping up their balances.
Wa's phones, as described in the affidavits, tell the story in the scammers' own paperwork. They contained employment contracts setting overnight Madagascar shifts that matched US daytime and evening hours, and bonus payments tied to money stolen from victims. They contained scripts telling workers exactly what to say, including an instruction describing the work frankly as "an emotional scam, using the [victim's] feelings for us to get him to invest." They also held a roster of employees' names, passport information, salaries, hours and wallet addresses, plus "contact cards" tracking US victims by name, location and work.
FBI investigators identified approximately 74 cryptocurrency wallets associated with victims in Maryland, Oregon, Nevada and Minnesota who reported losses after interacting with the fraudulent platforms. The money taken from those wallets was moved to cryptocurrency accounts associated with China-based actors, prosecutors say. The Justice Department has not published a total dollar loss for this specific Madagascar scheme, and the number of victims beyond the identified wallets is not yet clear.
Pirro framed the case as proof that scam networks cannot simply outrun American law enforcement by moving countries. "Chinese TCOs are sending scammers into your dating network, your social network, and your messaging applications, all to steal Main Street America's bank accounts," she said. "My Strike Force will expand and grow, and follow the scammers to Africa, India, Europe, and wherever they try to plant their operations."
She also spoke directly to the human cost for victims. "These cases devastate the victims financially, and they devastate them emotionally because the victim feels that not only have they lost everything, but they feel ashamed," Pirro said at the announcement, a remark that underlines why prosecutors believe so many victims stay silent.
US Attorney Michael J. Heyman for the District of Alaska, who joined the announcement, said: "The defendants allegedly operated a sophisticated fraud scheme from Madagascar, exploiting the trust of Americans to steal their hard-earned money. Operating from overseas does not place those who target Americans beyond the reach of US law enforcement." Secret Service Special Agent in Charge Tara McLeese added that scam-centre criminals "wrongly assume they can relocate to escape our reach," while FBI Criminal Division Assistant Director Heith Janke said: "These scam compounds don't stop at borders. There is no safe harbor for scammers who target Americans."
The Madagascar charges matter for three reasons. First, they show the geography of the scam-centre industry shifting: prosecutors say Chinese-connected groups are now planting operations in Africa and Europe, and the Strike Force says it is expanding to follow them. Second, they show the scale of the response: the Strike Force says it has restrained $1,006,460,156.82 in cryptocurrency, seized 700 fraudulent crypto investment websites and Starlink terminals used by scam centres, and seized and reviewed tens of thousands of devices. It also seized a Telegram channel used to recruit trafficking victims into compounds, plus two more channels hosting the Xinbi Guarantee Network, an illicit marketplace supplying websites and money-laundering services to scam centres. Meta told the Strike Force that 17.3 million scam accounts have been deplatformed in the last year.
Third, the case is a warning to anyone dating or investing online. The red flags are consistent: a fast-moving online romance, a stranger who quickly raises investment opportunities, pressure to move to private messaging apps, and any request to connect a crypto wallet to an unfamiliar website. Legitimate investments never require handing a stranger control of your wallet. Anyone who believes they have been targeted can report it to the FBI's Internet Crime Complaint Center, preserving messages, wallet addresses and transaction records.
The same announcement also highlighted two other cases: a sextortionist charged in South Africa, Ifeel Simango, accused of extorting at least 54 victims, including one victim in Switzerland who died by suicide; and three people arrested with Nigerian police over RaccoonO365 phishing kits that stole at least 5,000 credentials from 94 countries and disrupted surgical care in American hospitals.
The immediate next step is diplomatic: Madagascar must decide whether to extradite the six charged defendants and allow interviews with the 15 employees covered by the material witness warrant. If extradition is refused or delayed, the charges will remain pending and the defendants will stay beyond US custody. If they are brought to the United States, the wire-fraud conspiracy case would proceed in federal court, where prosecutors must prove the scheme beyond a reasonable doubt.
The Strike Force also announced a national consumer awareness campaign with the US Postal Inspection Service, the FBI and the Secret Service. Its research partner, the Ad Council Research Institute, is studying how scammers target Americans, especially older adults, and which warnings actually help people recognise fraud, with findings expected over the coming months. OpenAI has also committed to working with the Strike Force, joining companies including Microsoft, Meta, Google and Tether that have assisted specific cases.
For victims of the Madagascar scheme, the practical question is whether any money can be recovered. The Strike Force says its work aims to return stolen funds, but crypto traced through multiple wallets and across borders is difficult to claw back in full, and officials have not said how much from this scheme has been frozen for return.
Prosecutors say scammers posing as women on dating sites built relationships with Americans, then got them to connect crypto wallets to fake NFT investment websites and secretly drained the wallets.
Six Africa-based scammers were charged, including alleged ringleader Chui Kok Wa, charged with conspiracy to commit wire fraud. The Justice Department release names only Wa.
Investigators identified about 74 victim crypto wallets in Maryland, Oregon, Nevada and Minnesota. The total loss for this scheme has not been published.
Not as far as the announcement states. The US has asked Madagascar to extradite the six defendants, and 15 alleged trafficked employees are believed to be held in jail in Madagascar.
Never connect a crypto wallet to a website promoted by an online romantic partner, be wary of fast-moving online romances that turn to investment advice, and report suspected fraud to the FBI's Internet Crime Complaint Center with messages and transaction records preserved.
Related coverage on US News Pulse: DOJ charges green card holders with illegal voting in 5 states ahead of midterms, Ohio auditor cyberattack: foreign actors blamed as state website goes offline, and Samuel Sey ICE arrest: pro-ICE blogger detained at Ohio airport faces removal.
Leave a Comment
| Today's Date:
