US Froze $1 Billion in Crypto Scam Money: 6 Charged in Fake-NFT Dating Scam — 7 Checks Before You Connect Your Wallet

United States prosecutors have now restrained more than $1 billion in cryptocurrency tied to scam centres — and the newest charges show exactly how the trap works. Six people were charged on October 27, 2026, over an alleged fake-NFT investment scam run from Madagascar that prosecutors say used fake dating profiles to lure Americans into connecting their crypto wallets to fraudulent websites, after which funds were drained without the victims' knowledge. Investigators linked about 74 wallets to roughly 800 reported US victims in that one case alone.

If you hold crypto, this is not a distant crime story. It is a working playbook that is still being reused today, and the single most dangerous moment in it is one you control: the second you connect your wallet to a website you have not verified. This article explains what the Justice Department actually announced, how the alleged Madagascar scheme worked step by step, why the $1 billion figure matters — and does not matter — for your safety, and gives you a 7-point checklist to run before you ever connect a wallet or approve a transaction again.

What the Justice Department announced on October 27

On October 27, 2026, the US Attorney for the District of Columbia, Jeanine Ferris Pirro, announced a new wave of enforcement actions by the Justice Department's Scam Center Strike Force, a task force launched in November 2025 that brings together federal prosecutors, the FBI, the Secret Service and other agencies to pursue cryptocurrency investment fraud. The announcement said the Strike Force had now restrained more than $1 billion in cryptocurrency connected to fraud, and had seized 700 fraudulent investment websites.

Those headline numbers need careful reading, because they are easy to misunderstand. The $1 billion is a cumulative figure across the Strike Force's investigations over roughly a year, not the amount frozen in the Madagascar case. Within its first three months the task force had already reported more than $580 million in crypto freezes, seizures and forfeitures, and a September operation against Xinbi Guarantee, a marketplace allegedly serving scam operators, took cumulative restraints to approximately $938 million. The October announcement pushed the total past $1 billion. "Restrained" also has a specific legal meaning: it restricts the use or transfer of assets pending legal proceedings and potential victim compensation. It is not the same as money already returned to victims, and it is not a guarantee that every victim will be made whole.

The same announcement said the Strike Force is expanding beyond Southeast Asia, where raids have disrupted large scam compounds, into Africa, India, Europe and wherever the networks move next. Pirro said the task force would "follow the scammers" to those regions. The Madagascar charges are presented as the first visible result of that expansion — and as a warning that the geography of crypto fraud is shifting, not shrinking.

How the alleged Madagascar fake-NFT scam worked

According to the Justice Department announcement and the unsealed FBI affidavit reported in coverage of the case, the alleged scheme operated from at least January 2025 until April 2026. Prosecutors identified Malaysian national Chui Kok Wa as its alleged leader, and charged five others — Gislen Neukeu, Shamusa Ninsiima, Clement Mugiraneza, Merveille Mudacumura and Nicodemus Hingima Monyancha — with conspiracy to commit wire fraud. All six are defendants facing allegations; they are presumed innocent unless proven guilty, and the charges have not been tested in court.

The alleged method followed a pattern investigators call pig-butchering, because victims are "fattened up" with trust before the theft. First, the conspirators allegedly posted attractive female profiles on US dating sites. Once contact was established, the supposed women moved conversations to WhatsApp, built a relationship over time, and gradually introduced the idea of investing in non-fungible tokens. If you are unsure what an NFT actually is — and why a legitimate one never needs you to hand over wallet control — read our beginner guide to what an NFT is and how NFTs work before you go further.

Next, victims were directed to websites that resembled legitimate NFT marketplaces and encouraged to connect their cryptocurrency wallets. That connection step is where the alleged theft happened: the sites tricked victims into granting the scammers permission to access their wallets and transfer funds out without their knowledge or consent. Blockchain analytics firm Chainalysis, which said it assisted the investigation, shared an example in which one victim believed a site called inftvault.com was a legitimate NFT investment platform and lost more than $30,000.

Investigators identified approximately 74 cryptocurrency wallets associated with the scheme, with estimated losses of at least $516,695 in the Madagascar case itself and around 800 victims who reported losses after encountering fraudulent investment platforms linked to the operation. That $516,695 figure is important context: it is far smaller than the $1 billion Strike Force total, because the billion covers many investigations. The danger of the Madagascar case is not its dollar size. It is that a small, repeatable script — a dating profile, a chat app, a lookalike website, one wallet permission — produced hundreds of victims from a single compound.

Why this case matters more than its $516,695 price tag

Three things make this announcement worth your attention even if you never use a dating site. First, the scam did not rely on hacking anyone's wallet. It relied on the victim voluntarily connecting a wallet and approving a permission. That is why standard advice like "use a strong password" is not enough on its own: the attack targets trust and interface design, not cryptography. Understanding how a crypto wallet actually works — and what a connection approval really grants — is now basic self-defence, not advanced knowledge.

Second, the operation shows how industrialised the fraud has become. The Strike Force's wider record — 700 seized websites, plus Telegram channels supporting the schemes, and assistance acknowledged from Microsoft, Meta, Google, Tether, TRM Labs, Elliptic, Chainalysis, Infoblox and Block6IQ — describes an ecosystem of fake platforms, payment rails and laundering routes, not a lone scammer in a bedroom. When a fake platform looks polished, has a working dashboard and even shows fake "profits", that polish is part of the product.

Third, the timing matters. The announcement landed in a nervous market. On the morning of November 3, 2026, Bitcoin was trading near $76,900, down about 1.65% in 24 hours, with Ethereum near $2,256 and total crypto market capitalisation around $2.674 trillion. Fear is high, and fear is exactly when "guaranteed recovery" and "exclusive opportunity" pitches work best. After every major hack or crash, fake refund and recovery scams follow within days — our own coverage of fake Binance hack refund traps shows how quickly criminals repackage a real event into a second theft. Treat any message that arrives right after bad market news with extra suspicion, not less.

Real platform vs fake platform: the comparison that exposes the trap

Most victims in romance-investment scams do not miss an obvious red flag. They miss a quiet one, because the fake platform is designed to pass a quick glance. Use this comparison before you trust any investment site that someone — anyone — sends you.

Check	Legitimate platform	Fake platform in this playbook
How you found it	You searched for it yourself, from an official app store, regulator listing or well-known source	Sent to you in a chat, dating app or WhatsApp message by a new "friend" or "mentor"
Wallet connection	Explains exactly what permission you are granting, and never needs unlimited access to move your funds	Pushes you to connect fast and approve a broad permission, then drains funds quietly
Profits shown	Fluctuate with the market; losses are visible and possible	Rise smoothly and steadily, encouraging larger deposits
Withdrawals	Work without extra "tax", "verification fee" or "unlock payment"	Blocked until you pay another fee — a classic second theft
Support and identity	Named company, verifiable address, regulator registration where applicable	Anonymous "customer service" on chat apps, no verifiable company behind the domain
Pressure	No deadline to deposit; you can walk away and come back	Urgent deadlines, "limited slots" and romantic or social pressure to act now

If a platform fails even one row of that table, stop. A single failure is enough. Legitimate platforms do not need you to overlook a warning sign, and no genuine investment requires you to connect your wallet through a link sent by a stranger.

The 7 checks before you connect your wallet to anything

This is the original checklist to run every time — not just when something already feels wrong. Print it, save it, or keep it beside your device. It takes about three minutes, and it is the difference between the Madagascar victims' story and yours.

1. Verify the domain yourself, never through a link. Type the platform's address manually or use a bookmark you created yourself. Check for lookalike spellings, extra hyphens and unfamiliar domain endings. If the link came from a chat message, treat the domain as untrusted until you have verified it independently.
2. Separate romance from money completely. If someone you met on a dating site or social app moves the conversation to investing, that is the scam pattern, full stop. End the money conversation, no matter how genuine the relationship feels. Real investment advice does not arrive inside a new romance.
3. Read the exact permission before you approve it. A wallet connection is not a login. It can grant a site the ability to move tokens. If the approval asks for unlimited spending, access to all your assets, or a permission you do not understand, reject it and disconnect immediately.
4. Use a separate wallet for experiments. Keep your main holdings in a wallet you never connect to new sites. Test any unfamiliar platform only with a small, separate wallet holding an amount you can afford to lose. Never connect your life-savings wallet to a site you found this week.
5. Search the platform name plus the words scam, fraud and reviews. Then search its domain registration date. A platform claiming years of success but registered weeks ago, with no independent coverage outside its own marketing, is a warning sign. Also check whether regulators or the FBI have flagged similar sites — the FBI has already shut down 241 crypto scam websites in a related pig-butchering crackdown.
6. Never pay a fee to withdraw your own money. "Unlock fees", "tax payments", "verification deposits" and "account upgrades" demanded before a withdrawal are the second stage of the theft. A legitimate platform deducts fees transparently; it does not hold your balance hostage for a fresh payment.
7. Pause for 24 hours on any urgent opportunity. Scammers manufacture urgency because a pause kills the scam. Tell the person you will decide tomorrow, then verify the platform with a trusted source, a friend, or an official regulator page. If the opportunity is real, it will still exist tomorrow. If it disappears overnight, it was never real.

One more habit closes the loop: regularly review and revoke old wallet permissions. Most wallets let you see which sites can still move your tokens and revoke access in a few taps. Do it monthly, and do it immediately after any interaction you now doubt. For a fuller security routine, see our complete guide to protecting your crypto from hacks and scams in 2026.

What happens next: extradition, trials and the wider crackdown

The Madagascar case is at the charges stage, not the verdict stage, and several practical questions remain open. Extradition of defendants based overseas takes time and depends on the countries involved; the Justice Department has already pursued extradition in related Strike Force work, including a defendant brought before a California court on October 23 after extradition from the Netherlands. Victim compensation, if any assets are ultimately forfeited, will depend on court proceedings and on tracing funds through the 74 identified wallets and beyond — a process that can take months or years and rarely returns everything.

The wider crackdown is also likely to keep expanding geographically. As Southeast Asian compounds are disrupted, networks move — and the Strike Force has explicitly said Africa, India and Europe are next on its map. Expect more announcements of this kind, more seized domains, and, unfortunately, more copycat scams that cite real enforcement news to sound legitimate. A scammer quoting the $1 billion freeze to prove that "the government is cleaning up crypto, so this platform is safe" is using a true headline to sell a false conclusion. Enforcement against criminals does not certify any private platform.

For ordinary holders, the practical takeaway is unchanged: your wallet permission is the asset criminals want most. No regulator, exchange or recovery service will ever ask you to connect your wallet through a chat link, pay a fee to release your funds, or keep a "secret opportunity" away from your family and bank. Anyone who asks for those three things is running the playbook described in this case, whatever logo is on their website.

What most people get wrong about crypto scam crackdowns

The most common misunderstanding after an announcement like this one is: "The government froze $1 billion, so victims will get their money back and the problem is solved." Neither half is true yet. Restraint preserves assets for legal proceedings; it does not automatically distribute them, and in many cases the frozen sum covers many investigations, many victims and assets that are difficult to trace or have already moved. The second misunderstanding is: "I would never fall for a dating scam." The victims in these cases are not careless in general — they are targeted over weeks with a believable relationship, a plausible platform and small early "wins" that build confidence. The defence is not intelligence or scepticism in the abstract. It is a boring, repeatable process: verify the domain yourself, never mix romance with money, read permissions, use a separate wallet, and pause before you pay.

The third misunderstanding is subtler: "Scams only happen on obscure coins." The Madagascar scheme used NFTs as its story, but the mechanism — a fake platform plus a wallet permission — works with Bitcoin, Ethereum, stablecoins and any token your wallet holds. The asset is irrelevant. The permission is everything.

Frequently asked questions

What is the DOJ Scam Center Strike Force?

It is a US Justice Department task force launched in November 2025 that coordinates federal prosecutors, the FBI, the Secret Service and other agencies against cryptocurrency investment fraud and scam centres. It has reported more than $1 billion in cryptocurrency restrained across its investigations and 700 fraudulent investment websites seized.

Who was charged in the Madagascar fake-NFT case?

Six people were charged with conspiracy to commit wire fraud in connection with an alleged scheme run from Madagascar between at least January 2025 and April 2026. Prosecutors named Malaysian national Chui Kok Wa as the alleged leader. The charges are allegations and the defendants are presumed innocent unless proven guilty.

How many victims were affected in the Madagascar case?

Investigators identified approximately 74 cryptocurrency wallets associated with the scheme and around 800 US victims who reported losses after encountering fraudulent investment platforms linked to the operation, with estimated losses of at least $516,695 in that case. The $1 billion figure is the Strike Force's cumulative total across many cases, not this case alone.

What is a pig-butchering scam?

It is a fraud in which a scammer builds a relationship with a victim — often through dating sites or social media — gains their trust over weeks, then introduces a fake investment platform. The victim is encouraged to deposit crypto, sees fake profits, and is then drained or blocked from withdrawing without paying extra fees. Our guide to the FBI shutdown of 241 scam websites explains the pattern in more detail.

Will victims get their money back from the $1 billion frozen?

Not automatically. Restrained assets are held pending legal proceedings and potential victim compensation, and recovery depends on court outcomes, asset tracing and how much remains recoverable. Victims should report losses to the FBI's Internet Crime Complaint Center and beware of fake "recovery services" that charge upfront fees — those are often a second scam.

What should I do if I already connected my wallet to a suspicious site?

Disconnect the site, revoke its permissions in your wallet settings, move your remaining funds to a fresh wallet with a new seed phrase, and do not pay any "unlock" or "tax" fee the site demands. Report the site and wallet addresses to the FBI's Internet Crime Complaint Center and keep screenshots, transaction hashes and chat records for investigators.

Conclusion

The $1 billion headline is real, and it is worth celebrating as enforcement progress. But the more useful number in this story is much smaller and much more personal: 800 victims, 74 wallets, one repeatable script — a dating profile, a chat app, a fake NFT platform, and a single wallet permission. Every one of those victims had a moment when the checklist in this article could have stopped the loss, and most of them had no checklist at all.

Keep yours. Verify the domain yourself, keep romance and money apart, read every permission, use a separate wallet for anything new, search before you trust, never pay to withdraw your own money, and pause for 24 hours whenever anyone pressures you to act now. In a market where Bitcoin trades near $76,900 and fear is running high, that boring discipline is worth more than any hot tip — because the scammers are not betting that you are stupid. They are betting that you will skip one check, just once.

Sources: Bitcoin.com News on the $1 billion freeze, ICLG on the Madagascar charges, Crypto Times on the DOJ charges, and KuCoin's November 3 market flash for Bitcoin's price context.