Madagascar Scam Compounds: US Charges Six Over a $516K Fake NFT Dating Scam That Fled Cambodia

The shift started at 7pm in Antananarivo, the capital of Madagascar, and ended at 7am. That is midday to midnight in New York. According to an FBI affidavit unsealed in Washington on 27 October 2026, the people working those hours were pretending to be attractive women on American dating sites, and their job was to empty the crypto wallets of the men who wrote back.

The US Attorney's Office for the District of Columbia has charged six men with conspiracy to commit wire fraud. The alleged boss is Chui Kok Wa, a Malaysian national whom the scammers' own phones called "Ken" and "boss". The other five, described as his employees, are Gislen Neukeu, Shamusa Ninsiima, Clement Mugiraneza, Merveille Mudacumura and Nicodemus Hingima Monyancha. Prosecutors say the group came from Cameroon, Rwanda, Kenya and Uganda; the affidavit cites a Cameroonian passport for Neukeu and a Kenyan one for Monyancha. All six are accused, not convicted, and none is known to be in American custody.

By the FBI's count, the scheme drained at least $516,695 from 74 victims' crypto wallets in 127 separate transfers. The Secret Service, announcing the case, linked those 74 wallets to about 800 victims across the United States. The affidavit names victims by town: Greenbelt in Maryland, Portland, Las Vegas, Eagan in Minnesota, Kalamazoo in Michigan, Ben Lomond in California and Douglas in Massachusetts. The Eagan victim reported losing $31,343.88.

The pig, the pitch and the NFT

The method is the one the industry calls pig butchering, from the Chinese phrase sha zhu pan: the scammer fattens the victim with weeks of friendly or romantic chat, then slaughters the victim with a fake investment. Most of these operations run from scam compounds, guarded office blocks where hundreds of workers sit at phones in shifts, often recruited with fake job adverts and sometimes held against their will.

In this case the investment was an NFT. An NFT, or non-fungible token, is a digital collectible: a one-off item recorded on a blockchain, the shared public ledger that crypto runs on, rather like a numbered certificate for a piece of art. The "woman" on the dating site, and later on WhatsApp, talked the victim into buying NFTs on a marketplace called NFTWEB3, using sites such as inftvault.com, inftmeta.xyz and inftx.pro, under the banner "Everyone's Favorite NFT marketplace".

The theft itself was quieter than a fake deposit. Victims were told to connect their own wallet to the site. The site then asked them to approve a "spending cap", which in practice gave a wallet controlled by the scammers permission to take an unlimited amount of USDT, a stablecoin, which is a digital dollar issued by Tether. In stock-market terms, it is like signing a standing direct debit for any amount to a broker you have never checked. An FBI agent tried it on 28 August 2026 with a new MetaMask wallet and got exactly that request.

The money stayed in the victim's own wallet, so everything looked safe. The scammer kept up the romance, encouraged the victim to top the wallet up, then took the lot. The Greenbelt victim, according to the affidavit, put in 900 USDT on 24 August 2026, saw a paper gain of $15, and could not withdraw. Over the next two days the victim added more. One deposit of 9,067.64 USDT vanished 33 minutes after it arrived.

Inside the boss's phones

The case rests on phones. In August 2026 an FBI team from its Honolulu field office flew to Madagascar at the invitation of the country's Ministry of Justice and the Madagascar National Police, which had raided 13 scam compounds and seized about 3,200 devices. Two iPhones, the FBI says, belonged to Wa. One held a photo of his Malaysian passport and his Madagascar visa, and an itinerary from Dubai to Antananarivo, arriving on 27 December 2024.

The phones also held the business. There was an "Expatriate Staff Contract" with night hours, fines for failing to bring in new "clients", and a clause handing the worker's passport to the company for "temporary custody". There was a staff roster listing salaries, discipline fines and each worker's crypto wallet. The Record, which reported on the court papers, said workers were paid $900 a month plus a share of what they took. One script, according to the Secret Service, told workers plainly that they were running "an emotional scam, using the [victim's] feelings for us to get him to invest." Another, "DAY 1-5", scripted the first five days of chat down to the fake persona's restaurant investments.

Pay ran through Binance, the world's largest crypto exchange. Each worker had to open a Binance account, and the FBI matched those accounts, their identity documents and their Madagascar login records to the roster. Stolen USDT, the affidavit says, flowed to wallets used by Wa and his staff, and on to accounts at Binance and OKX registered to people in China. One OKX account converted about 268,779 USDT into Chinese yuan and sent it to Alipay. Another, logging in from Madagascar, sometimes over a Starlink satellite connection, converted about 41,570 USDT and paid it to Alipay and WeChat Pay. Tether and the tracing firm Chainalysis helped follow the money, according to The Record.

From Cambodia to an island off Africa

The FBI says the operation is part of a migration. Three Brazilians interviewed in Antananarivo said they had answered online job adverts, ended up in a compound in Cambodia, and were moved to Madagascar in early May 2026, partly because of the border fighting between Cambodia and Thailand and partly because of police raids on Cambodian compounds. Binance records showed two of the conspirators logging in from Cambodia and later from Madagascar, and two others from Myanmar and then Madagascar. The affidavit adds that most such compounds are run by families and business partners from Fujian province in China.

Malagasy police told the FBI they had detained about 400 people in the 13 compounds, including about 40 Chinese nationals. The FBI never got to question the Chinese leaders. It was told they had been sent back to China or were no longer in custody. On 8 September 2026 Madagascar flew 50 convicted Chinese scammers home through Addis Ababa to serve sentences of two to ten years in Chinese prisons, according to Africanews. The Justice Department said US efforts had been "stymied", and US Attorney Jeanine Ferris Pirro called on Madagascar to extradite the six defendants.

The trafficking question is unresolved. Lawyers in Antananarivo say 25 African workers held there were lured by job adverts and then abused by Wa and prevented from leaving; the government has a material witness warrant to interview 15 of them. The affidavit notes that the FBI has not been able to speak to them and cannot confirm the claims, and points out that the workers were paid and kept their own exchange accounts, which trafficked compound workers usually are not allowed to do.

The billion-dollar number

The case was announced alongside a milestone. Pirro's Scam Center Strike Force, launched in November 2025, says it has now restrained $1,006,460,156.82 in crypto, up from the $938,460,156.82 it had published as of 22 October. Restrained is the first and weakest of three steps. Restrained money is frozen, like a bank account under a court hold. Seized means the government has taken possession of it. Forfeited means a court has ruled that it now belongs to the government, which can then return it to victims through a process called remission. Restrained is not the same as recovered.

The Strike Force also says it has seized 700 fake investment websites and thousands of Starlink terminals. The FBI's Internet Crime Complaint Center puts reported US losses to crypto investment fraud at $8.65 billion in 2025, up 89% from 2023. The Madagascar case, by comparison, is small: half a million dollars that the FBI could trace, while a single collection wallet that received money from victims of the scheme took in 980,166 USDT between November 2025 and March 2026.