# Six charged in Madagascar NFT investment scam Author: Abdullah Özkurt Language: English Published: 2026-10-28T16:18:11+03:00 Updated: 2026-10-28T16:18:11+03:00 ![A red connection runs behind an iridescent glass artwork to a metal wallet module on a gallery wall.](https://kriptometa.com/uploads/madagaskar-da-nft-dolandiriciligi-alti-kisiye-suclama-1f379af227ba_article.webp) ## Key takeaways - Documents supporting the criminal complaint and arrest warrants were unsealed on October 27. - Prosecutors reported about 800 victims; the FBI agent’s loss estimate covers at least about 74 wallets. - The US is seeking extradition of the six defendants; the charges are not convictions. US prosecutors allege that a network built fake romantic relationships, pitched NFT investments and drained victims’ wallets. An FBI agent describes a separate USDT spending request after connection and messages urging victims to add more funds. The US Justice Department [announced charges on October 27](https://www.justice.gov/usao-dc/pr/scam-center-strike-force-expands-reach-target-global-crime-syndicates-charges-scammers) against six people linked to an alleged fake NFT investment network operating from Madagascar. Prosecutors accuse them of conspiring to commit wire fraud. The unsealed FBI affidavit supports a criminal complaint and arrest warrants for Chui Kok Wa, the alleged leader, and five other defendants. According to prosecutors, the group had ties to Malaysia and China and established scam compounds in Madagascar in early 2025. Authorities say it may have moved from Cambodia following law-enforcement action there. ## Victim estimates and the wallets investigators traced In the [FBI affidavit sworn on October 23](https://www.justice.gov/usao-dc/media/1468811/dl?inline), the investigating agent says public blockchain tracing identified at least approximately 74 [victim wallets](https://kriptometa.com/en/glossary/crypto-wallet) and estimated losses of at least about $516,695. Prosecutors’ October 27 announcement refers to approximately 800 victims across the United States. One person can use several wallets. The FBI’s loss estimate covers the wallets it traced; prosecutors did not give a combined loss for all 800 victims. People, wallets and losses reported by the FBI and prosecutors | Figure | What it measures | |---|---| | 6 people | Defendants charged in the United States | | At least about 74 wallets | Victim wallets identified by the FBI agent’s blockchain tracing | | At least about $516,695 | Estimated losses calculated in the same affidavit | | About 800 people | Prosecutors’ nationwide victim estimate announced on October 27 | A person in Greenbelt, Maryland, reported losing $11,926.12 to the FBI, according to the affidavit. On August 24, the person put about 900 USDT into their own Ethereum wallet, believed they held an NFT worth around $980 and saw a $15 gain displayed on the platform. An attempt to withdraw failed. The displayed gain was not a payment the user had received. According to the affidavit, the victim added about 1,958.92 USDT on August 25 and then noticed an unauthorized transfer of 2,858.02 USDT to another address. The next day, the victim added 9,067.64 USDT for an NFT staking offer. The agent found that the entire amount went to the recipient of the first unauthorized transfer about 33 minutes after the deposit. ## A USDT spending request followed the wallet connection Prosecutors say workers posed as women on dating platforms, built relationships and then directed people to sites resembling NFT marketplaces. [NFTs](https://kriptometa.com/en/glossary/nft) are blockchain tokens with separate identities. A website’s claim to offer NFT investments does not guarantee a return. On August 28, the FBI agent connected a newly created account to the fake site through [MetaMask’s browser](https://kriptometa.com/en/metamask-review). After approving the connection, the agent saw a second request for an unlimited USDT spending cap, according to the affidavit. Signing that request would have authorized a third party to transfer USDT from the wallet. The spending authority required this separate [token approval](https://kriptometa.com/en/glossary/token-approval) in addition to the connection. A user who disconnects an app leaves previously granted token approvals in place. According to [MetaMask’s official guide](https://support.metamask.io/more-web3/learn/how-to-revoke-smart-contract-allowances-token-approvals), [revoking those approvals](https://kriptometa.com/en/revoke-token-approvals) requires an on-chain transaction and a [network fee](https://kriptometa.com/en/glossary/gas-network-fees) for each revocation. It does not recover money already taken. [Before approving a request](https://kriptometa.com/en/crypto-phishing-fake-token-checks), users should check the token, the address receiving spending authority and the allowance, rather than trust a displayed profit. ## Night shifts and scripted relationships The FBI reports finding employment contracts, staff rosters and scripts for building emotional relationships on Wa’s phones. A contract reproduced in the affidavit sets Madagascar working hours of 7 p.m. to 7 a.m. and monthly commissions of 3%–6% based on funds brought in. Prosecutors say the night shifts aligned with daytime and evening hours in the United States and that bonuses were tied to money taken from victims. Under the contract, workers who fail to bring in customers depositing new money can lose part of their base pay. Those who leave early must reimburse flight and visa costs, and workers must leave their passports with the company during employment. Rosters reportedly extracted from the phones include salaries, working hours, disciplinary records and [wallet addresses](https://kriptometa.com/en/glossary/wallet-address). The FBI links the listed workers to cryptocurrency transfers. An internal document quoted by prosecutors calls the method an “emotional scam.” Scripts describe discussing family and personal life to build trust during the first days before moving to an investment pitch. Prosecutors allege that workers kept the relationship going after an initial transfer to persuade victims to replenish their wallets. ## The US is seeking extradition of six defendants An FBI team travelled to Madagascar in August 2026 at the invitation of its Ministry of Justice and National Police and helped examine more than 3,200 electronic devices seized at 13 suspected compounds. The Justice Department says Madagascar sent numerous people back to China before investigators had finished their work, making it harder for the FBI to interview them. US Attorney Jeanine Ferris Pirro said she had requested extradition of the six defendants. Officials have not announced that the defendants have been brought to the United States. Pirro also said authorities had obtained material-witness warrants for 15 people who worked with Wa, seeking their testimony in the investigation. They claimed to have been trafficked and abused and were believed to be held in Madagascar, she said. Their allegations are separate from the charges against the six defendants; the unsealed documents are not findings of guilt. The department said the Scam Center Strike Force, launched in November 2025, had restrained a total of $1,006,460,156.82 in cryptocurrency and seized 700 scam websites. That total covers its wider work, rather than money seized solely in the Madagascar case or repaid to its victims. Officials have not announced whether or when the Madagascar victims will receive repayments, or when extradition will be completed. The [10:55–13:38 section of the October 27 press conference](https://www.youtube.com/watch?v=sdc5flFB118&t=655s) describes the Madagascar device examination and victim estimate. U.S. Attorney DC’s October 27 post at 17:22 UTC announces the charges against six people and their alleged links to Southeast Asia and China. [Read the US Attorney’s statement on X](https://x.com/USAO_DC/status/2115131932094628260)