US prosecutors announced charges against six people on October 27 over a dating site crypto scam run from compounds in Madagascar. According to the Justice Department, the scammers posed as women on dating websites, talked victims into connecting their crypto wallets to fake NFT investment sites, then pulled money out of those wallets without the victims knowing. The FBI tied about 74 wallets to roughly 800 victims across the US. If you ever connected a wallet to a site someone from a dating app sent you, check and cancel its permissions today.

Key facts

  • Who: Six people based in Madagascar; the alleged leader, Chui Kok Wa, is charged with conspiracy to commit wire fraud
  • What: Fake romances on dating sites led victims to connect crypto wallets to fake NFT investment sites, which then drained them
  • When: Charges unsealed October 27, 2026
  • How many: About 74 wallets tied to roughly 800 US victims, per the FBI
  • Source: US Attorney's Office for DC, press release

The script was written down. Phones seized from the alleged leader of a scam crew in Madagascar held guides telling workers they were running "an emotional scam, using the [victim's] feelings for us to get him to invest," the Justice Department said on October 27, as it charged six people over a dating site crypto scam aimed at Americans.

How the scam worked

The scammers posed as attractive women on dating websites, prosecutors say. Once a victim trusted them, the talk turned to investing in NFTs. The victim was walked through connecting their crypto wallet to a fake NFT investment website. After that, the scammers pushed them to keep adding money to the wallet, and quietly pulled funds out of it without the victim knowing.

The FBI identified about 74 wallets tied to roughly 800 victims around the country. The money went to crypto accounts linked to people in China. Workers in Madagascar were on night shifts so they could chat during American daytime, and their contracts paid bonuses tied to the money stolen, the release says. Their phones also kept "contact cards" on each victim: name, location and job.

Why the wallet kept emptying

Connecting a wallet to a website can do more than show your balance. Many scam sites ask you to approve a "permission" that lets the site move your tokens later, sometimes with no limit. You approve it once, and the site can come back for more whenever it likes. That's how a wallet you keep topping up can keep going down.

If you ever connected a wallet for someone you met online

  • Cancel the permissions. Open your wallet's connected-sites or approvals page, or a well-known approvals checker, and revoke anything you don't recognize. Type the address yourself; fake "revoke" sites exist too.
  • Move what's left. If money has already gone missing, send the rest to a new wallet with a new recovery phrase.
  • Stop sending money, however the person explains a "fee" or "tax" to unlock your profits.
  • Report it to the FBI at ic3.gov. Our guide on how to report a crypto scam lists what to gather.

Expect one more trap. After cases like this make the news, fake "asset recovery" firms promise to get victims' money back for a fee. Prosecutors don't charge you to return funds. Here's how recovery scams work.

The scam moved, then got caught

Prosecutors say the group, with ties to Malaysia and China, set up its Madagascar compounds in early 2025, likely after a crackdown in Cambodia. The FBI helped local police raid 13 compounds there in August 2026, but many suspects were sent back to China before they could be questioned. The US is now asking Madagascar to extradite the six charged.

The case came from the Scam Center Strike Force, which the US Attorney's office in Washington says has now restrained more than $1 billion in crypto tied to scams and seized 700 fake investment websites. This is the same playbook as pig butchering: a relationship first, an investment second. Anyone you've only met online who brings up crypto is the warning sign.

Sources: US Attorney's Office for the District of Columbia, Scam Center Strike Force Expands Reach to Target Global Crime Syndicates; Charges Scammers Based in Africa and Tied to China (October 27, 2026), WJLA, 6 Africa-based scammers charged after dating scheme drained Americans' crypto wallets (October 27, 2026).