Federal prosecutors charged six individuals in Madagascar on October 27, 2026, with running a romance scam operation that utilized fake dating profiles to direct American victims toward malicious non-fungible token sites designed to drain their cryptocurrency wallets.
The Mechanics of the Digital Lure
The technical reality of these attacks relies on exploiting the trust built through social engineering rather than brute force hacking. Investigators say workers used fictitious romantic identities to gain trust on dating platforms, then sent victims to websites that requested broad cryptocurrency-wallet permissions. According to a sworn FBI affidavit, a Greenbelt, Maryland, victim reported losing $11,926.12 after interacting with one of these platforms. The person initially deposited about 900 USDT in a cryptocurrency wallet and saw what appeared to be a $15 profit on the NFT website, but an attempted withdrawal failed.
The Justice Department alleges that workers approached Americans using dating profiles that appeared to belong to women seeking relationships. Some conversations moved to WhatsApp, where the purported romantic partners encouraged the people they contacted to invest in non-fungible tokens, or NFTs. A reproduced message in the court filing shows a user being instructed to share screenshots while navigating the wallet-connection process. This step was essential for the scammers to verify that the victim had followed instructions before executing the theft.
The FBI identified 127 transactions involving 74 victim wallets and estimated losses of 516,695.46 USDT. The Justice Department separately described approximately 800 victims connected to the operation beyond those identified in the specific transaction list. While the headline numbers focus on the confirmed cases, the scope of the fraud suggests a wider pattern of exploitation targeting cryptocurrency holders globally.
The Technical Vulnerability Exploited
An FBI investigator tested a wallet permission request on the fake platform to understand the threat vector under the hood. An FBI investigator visited one of the websites, identified in the affidavit as inftchain.xyz, using a new MetaMask wallet. After connecting the account, the investigator received a request from inftvault.com for permission to spend USDT tokens.
The requested authorization could have allowed a third party to transfer an unlimited amount of those tokens, according to the affidavit. This mechanism works because many cryptocurrency wallets allow users to sign transactions that grant smart contracts or external addresses broad permissions. Once a victim approves these permissions, the wallet effectively hands over control of its funds to the scammer’s designated address.
FBI investigators identified several similarly branded NFT domains and said the relevant sites had been seized under an earlier federal court order, case 26-sz-53. The evidence came partly from thousands of devices seized in Madagascar and included employee contracts, rosters and detailed instructions for chatting with potential victims. These documents revealed how the operation was structured to maximize efficiency while minimizing the risk of detection by law enforcement.
The Human Cost and Operational Details
A recovered contract listed overnight shifts and an $800 base salary, detailing the grueling conditions imposed on the workers in Madagascar. Phones attributed to Wa contained an employment contract specifying work from 7 p.m. until 7 a.m. in Madagascar, with a schedule designed to keep the operators constantly active during peak hours when victims are likely to be online.
Malaysian national Chui Kok Wa is accused of leading the operation. The detail that matters here is not just the financial loss, but the systematic nature of the fraud. The FBI identified 127 transactions involving 74 victim wallets and estimated losses of 516,695.46 USDT, while the Justice Department separately described approximately 800 victims connected to the operation.
The charges involve federal wire fraud conspiracy allegations, which have not been established by a conviction as of this report. The technical reality is that once the wallet permissions are granted, the funds disappear in an unauthorized transfer, often within minutes of the initial deposit. As ever, the lesson for informed readers remains clear: verifying the source of any request to sign a transaction, especially one prompted by a romantic advance, is the only effective defense against such schemes.
The Recruitment and Compensation Structure
Evidence recovered from seized devices in Madagascar revealed the organizational framework behind the fraud. Thousands of phones attributed to the operation contained employment contracts detailing the conditions under which workers were hired. A recovered contract listed overnight shifts and an $800 base salary, detailing the grueling conditions imposed on the workers. These documents specified work schedules from 7 p.m. until 7 a.m. in Madagascar, with a roster system designed to keep operators constantly active during peak hours when victims are likely to be online.
The recruitment strategy relied on fictitious romantic identities to gain trust on dating platforms. According to the sworn FBI affidavit and court filings, workers approached Americans using dating profiles that appeared to belong to women seeking relationships. Some conversations moved to WhatsApp, where the purported romantic partners encouraged the people they contacted to invest in non-fungible tokens, or NFTs. A reproduced message in the court filing shows a user being instructed to share screenshots while navigating the wallet-connection process, a step essential for scammers to verify that the victim had followed instructions before executing the theft.
Geographic Scope of Victimization
The reach of this fraudulent operation extended across the United States, impacting individuals far beyond the initial reports from Maryland. Federal investigators identified a victim in Portland, Oregon, who reported that their tokens vanished immediately after they connected a digital wallet to a version of the purported NFT marketplace. This incident aligns with the broader patterns discovered by law enforcement, which suggest that the scammers maintained multiple versions of these deceptive platforms to target cryptocurrency holders globally.
The FBI’s analysis of the operation’s infrastructure highlighted the systematic nature of these thefts. By tracing transactions, investigators identified 127 specific instances involving 74 unique victim wallets, resulting in estimated losses totaling 516,695.46 USDT. While these figures represent confirmed cases, the Justice Department has separately described approximately 800 victims connected to the wider operation. The investigation into these unauthorized transfers, which often saw funds disappear to recipient addresses within minutes of a deposit, remains ongoing as prosecutors pursue the wire fraud conspiracy allegations against the six defendants.
Sources
- Fake Dating Profiles Led Americans to NFT Sites That Drained Their Crypto. Six Charged in Madagascar Scam
- Non-fungible token
- Fake Dating Profiles Led Americans to NFT Sites That Drained Their Crypto. Six Charged in Madagascar Scam
Photo: Shubham Dhage / Unsplash (Unsplash License)
