A Maryland cryptocurrency investor added 9,067.64 USDT to a wallet connected to what appeared to be an NFT investment platform. About 33 minutes later, the funds disappeared in an unauthorized transfer, according to a sworn FBI affidavit.
Federal prosecutors announced charges against six people on October 27, 2026, after an investigation into alleged romance and cryptocurrency fraud conducted from scam compounds in Madagascar. Malaysian national Chui Kok Wa is accused of leading the operation.
Investigators say workers used fictitious romantic identities to gain trust on dating platforms, then sent victims to websites that requested broad cryptocurrency-wallet permissions. The FBI identified 127 transactions involving 74 victim wallets and estimated losses of 516,695.46 USDT, while the Justice Department separately described approximately 800 victims connected to the operation.
The evidence came partly from thousands of devices seized in Madagascar and included employee contracts, rosters and detailed instructions for chatting with potential victims. Wa and five other defendants face federal wire fraud conspiracy allegations, which have not been established by a conviction.
Fake Dating Profiles Led Victims to NFT Websites
The Justice Department alleges that workers approached Americans using dating profiles that appeared to belong to women seeking relationships. Some conversations moved to WhatsApp, where the purported romantic partners encouraged the people they contacted to invest in non-fungible tokens, or NFTs.
According to the sworn FBI affidavit, a Greenbelt, Maryland, victim reported losing $11,926.12. The person initially deposited about 900 USDT in a cryptocurrency wallet and saw what appeared to be a $15 profit on the NFT website, but an attempted withdrawal failed.
Investigators traced two unauthorized transfers from that wallet to the same recipient address. They also described a victim in Portland, Oregon, who said tokens disappeared after connecting a wallet to another version of the purported NFT marketplace.
The FBI Tested a Wallet Permission Request on the Fake Platform
An FBI investigator visited one of the websites, identified in the affidavit as inftchain.xyz, using a new MetaMask wallet. After connecting the account, the investigator received a request from inftvault.com for permission to spend USDT tokens. The requested authorization could have allowed a third party to transfer an unlimited amount of those tokens, according to the affidavit.
A reproduced message in the court filing shows a user being instructed to share screenshots while navigating the wallet-connection process. FBI investigators identified several similarly branded NFT domains and said the relevant sites had been seized under an earlier federal court order, case 26-sz-53.
A Recovered Contract Listed Overnight Shifts and an $800 Base Salary
Phones attributed to Wa contained an employment contract specifying work from 7 p.m. until 7 a.m. in Madagascar, with a daily break. The FBI said those overnight shifts corresponded to daytime and evening hours in the United States, where the alleged victims were located.
The contract listed a basic monthly salary of $800, commissions of 3% to 6% based on the amount of money brought in by newly recruited clients, and penalties for missing targets. It also described deductions for workers who failed to recruit paying clients and required employees to submit passports for temporary custody.
Other files contained employee names, wallet addresses, salary records, disciplinary deductions and cryptocurrency payments. The FBI alleged that Wa’s accounts both received funds tied to victims and sent payments to people listed in the recovered staff records.
One Dating Script Explicitly Called It an Emotional Scam
Investigators recovered written instructions describing how workers should communicate with people they met on dating applications. One passage explicitly called the strategy an “emotional scam” and instructed workers to use a person’s feelings to encourage an investment.
Other instructions urged workers to exchange photographs and arrange video calls before introducing NFTs. The files advised workers to create believable details about their daily lives, ask about previous relationships and avoid pressing for an investment too early in the conversation.
One separate document supplied an emotional story about a husband’s leukemia diagnosis, while another described how a supposed entrepreneur could gradually introduce cryptocurrency as a source of financial security.
Six Defendants Charged After Investigators Examined 13 Compounds
The FBI affidavit identifies five additional defendants: Gislen Neukeu, Shamusa Ninsiima, Clement Mugiraneza, Merveille Mudacumura and Nicodemus Hingima Monyancha. Prosecutors allege that Wa managed the operation and that the five other defendants participated as workers; the affidavit links individuals to employment records and cryptocurrency accounts.
In August 2026, the FBI’s Honolulu Field Office traveled to Madagascar at the invitation of the country’s Ministry of Justice and National Police. American investigators assisted in reviewing approximately 3,200 electronic devices seized from 13 suspected scam compounds. The FBI affidavit says Malagasy authorities reported detaining approximately 400 people during the wider operation.
The FBI affidavit also describes three Brazilian witnesses who said they were moved from a scam compound in Cambodia to Madagascar in May 2026. The Justice Department called on Madagascar to cooperate with U.S. authorities and extradite the six charged defendants.
Worker Abuse Claims Remain Unverified
The affidavit recounts a report prepared by eight attorneys in Madagascar who said they represented 25 detained African nationals. The report alleged that those individuals had responded to job advertisements and later experienced abuse, intimidation and restrictions on leaving the operation associated with Wa.
The FBI said it had been unable to interview the workers or substantiate those allegations, and noted other information that might be inconsistent with coercion in some cases. Separately, the Justice Department announced that it had obtained a material-witness warrant to interview 15 employees and asked Madagascar to cooperate with the investigation.
How to Check Whether an NFT Site Still Has Wallet Access
The Federal Trade Commission warns against cryptocurrency investment offers introduced by someone met only through a dating application or social media. An attractive investment dashboard or a displayed profit is not evidence that a platform is legitimate, particularly when the person recommending it controls where the investor connects a wallet.
Anyone who connected a wallet to a suspicious website should review existing token approvals. MetaMask explains that disconnecting a website does not itself cancel smart-contract allowances; revoking a permission may require an on-chain transaction and a network fee.
People reporting cryptocurrency theft should preserve relevant wallet addresses, transaction hashes, website addresses and chat records for the FBI’s Internet Crime Complaint Center. Avoid paying someone who promises to recover stolen cryptocurrency for an advance fee.