US Charges Six Over Madagascar NFT Romance Scam

The US Justice Department’s Scam Center Strike Force says it has now restrained $1,006,460,156.82 in cryptocurrency linked to fraud and scams, and on Tuesday it unsealed charges against six people accused of taking part in a romance-and-NFT investment scam aimed at Americans from compounds in Madagascar. The charges are allegations. None of the six has been convicted, and all are presumed innocent.

The case matters less for its size than for where it points. US Attorney Jeanine Ferris Pirro, who runs the strike force from the District of Columbia, used the announcement to say the unit is widening its remit beyond Southeast Asia, following scam groups she says are moving into Africa and Europe. Madagascar is her example: a scam operation that, prosecutors say, likely relocated from Cambodia and was raided by local police before its alleged organisers left the country.

In brief

Six people were charged by criminal complaint with wire fraud conspiracy over an alleged NFT romance scam run from Madagascar; Pirro has asked Madagascar to extradite them.
The Scam Center Strike Force says it has restrained $1,006,460,156.82 in crypto, seized 700 scam websites and taken down thousands of Starlink terminals.
Still unknown: how much of the restrained money has gone back to victims, and whether any of the six will face a US court.

A billion dollars held, 700 sites seized

The headline figure comes from a joint announcement published by the US Secret Service, and the strike force’s own page on the Justice Department website, updated on 27 October, now carries the same number. When TSN looked at that page last week, in a version dated 15 October, it said $938,460,156.82. The total has risen by exactly $68m since then.

The release lists what else the unit says it has done over the past year. It has seized 700 fake crypto investment websites, and “thousands of Starlink terminals have been taken down” after scam centres used them for internet access. It says it carried out the first-ever seizure of a Telegram channel used to recruit trafficking victims into scam compounds, and seized two more channels hosting the Xinbi Guarantee Network, which it describes as a marketplace selling websites and money-laundering services to scam centres. With foreign partners, it says it has seized and reviewed “tens of thousands of devices”.

Private companies feature heavily. “Meta reports that 17.3 million scam accounts have been deplatformed in the last year,” the release says. It thanks Microsoft, Meta, Google, Tether, TRM, Elliptic, Chainalysis, Infoblox and Block6IQ for voluntary help on the matters announced, and says “OpenAI has committed to working with the Strike Force to counter this threat”. It gives no detail of what that work involves.

The same release covers two cases outside the strike force’s crypto work. Three people were arrested in Nigeria over the RaccoonO365 phishing kit after a referral from Microsoft’s Digital Crimes Unit, a case that echoes Microsoft’s court-backed action against other phishing services this month. In South Africa, Ifeel Simango has been charged with 52 offences, including fraud, money laundering and murder, over the alleged sextortion of at least 54 victims.

Raids in Madagascar, but the leaders went home

The Madagascar case grew out of raids by local police. According to a redacted FBI affidavit filed in federal court in Washington, an FBI team from Honolulu flew out in August 2026 at the invitation of Madagascar’s justice ministry and national police. It helped triage about 3,200 electronic devices seized from 13 scam compounds. Malagasy authorities told the FBI they had taken about 400 people into custody, including about 40 Chinese nationals.

The US side did not get the people it most wanted. The affidavit says the FBI was unable to interview the Chinese nationals identified as leaders, because it was told they had been repatriated to China or were no longer in custody. Pirro called on Madagascar to cooperate and to extradite the six defendants. The release does not say any of them is in custody.

The affidavit names the six as Chui Kok Wa, Gislen Neukeu, Shamusa Ninsiima, Clement Mugiraneza, Merveille Mudacumura and Nicodemus Hingima Monyancha. Each is accused of conspiracy to commit wire fraud between at least January 2025 and April 2026. Prosecutors describe Wa as the scheme’s leader. The release says a group with links to Malaysia and China opened compounds in Madagascar in early 2025, “likely” after moving from Cambodia following police action there.

The release also says prosecutors obtained a material witness warrant to interview 15 of the scheme’s employees, who claimed they were trafficked and abused by Wa and are believed to be in jail in Madagascar. The affidavit is more cautious: it says the FBI has been unable to speak to Wa’s employees and “has been unable to substantiate these claims”.

How the scheme allegedly worked

The method is worth knowing because it is simple. Scammers posing as attractive women met victims on US dating sites, then talked them into NFT “investments” that required connecting a crypto wallet to a website. Once connected, the affidavit says, the scammers could pull money out without the victim’s consent. They kept the romance going to encourage further deposits, then emptied the wallet. One victim’s account showed a small gain before a withdrawal failed and funds vanished from the wallet. A script on Wa’s phone, quoted in the release, called it “an emotional scam”.

The two primary documents differ on scale. The release says investigators found about 74 wallets associated with about 800 victims across the country. The affidavit describes about 74 victims’ wallets, with estimated losses of at least about $516,695. The websites, including inftvault.com and inftmeta.xyz, were seized earlier under a court order.

Restraint is the easy number; repayment is the hard one

The $1bn milestone is real, but it measures money frozen, not money returned. Neither the release nor the Justice Department page says how much of the $1,006,460,156.82 has reached victims; both describe returning funds as an aim. That was the gap TSN flagged when the total stood at $938m, and it remains the figure that would show whether this approach works for the people who lost money.

The Madagascar affidavit shows where the leverage lies. Alongside the phones handed over by Malagasy police, it leans on records investigators could reach from the US: domains seized by court order, legal process to US companies, crypto exchange login histories and the wallets employees used to get paid. The physical compound was a dead end once the alleged organisers left the country. For compliance teams at exchanges and stablecoin issuers, that is the lesson. Scam groups can move from Cambodia to Antananarivo in months, but they still need regulated on-ramps to pay staff and cash out, and those records travel with them.

The case also fits a pattern TSN has tracked across Africa, from Interpol’s Serengeti III operation to Meta’s joint action against West African scam networks. Both paired national police forces with outside partners. When suspects are sent home before interview, as here, the financial tracing is what survives. Britain is already part of this effort: in September the strike force signed a memorandum of understanding with the Crown Prosecution Service and the National Crime Agency, covering parallel investigations into shared targets and which country brings particular cases.

The next test is in Madagascar. Whether its government acts on Pirro’s extradition request will show whether the strike force’s wider remit can produce defendants in a courtroom, not just figures in a release.