News Desk · Crypto crime

US Scam Center Strike Force charges six Africa-based scammers over crypto NFT scheme

Federal prosecutors in Washington, DC have charged six Africa-based scammers with connections to Southeast Asia and China over a fake NFT investment scheme that, they say, was run from scam compounds in Madagascar and drained victims' cryptocurrency wallets.

Crypto crimeUS27 Oct 20262 min read

On 27 October 2026 the US Attorney's Office for the District of Columbia announced charges against six Africa-based scammers who, it says, have connections to Southeast Asia and China. The office says Chui Kok Wa was charged with conspiracy to commit wire fraud as the leader of the scheme. The charges are allegations, and the release describes the facts as alleged in affidavits.

According to the release, a criminal group with connections to Malaysia and China opened scam compounds in Madagascar in early 2025, likely after moving those operations from Cambodia. The scammers allegedly posed as women who met victims on dating websites and persuaded them to connect and keep funding cryptocurrency wallets linked to fraudulent NFT (non-fungible token) investment websites. Prosecutors say FBI investigators identified about 74 cryptocurrency wallets associated with about 800 victims, and that stolen funds were moved to cryptocurrency accounts associated with China-based actors.

The release says that in August 2026 an FBI team went to Madagascar at the invitation of its Ministry of Justice and helped take down 13 scam compounds, where thousands of electronic devices were seized.

The Scam Center Strike Force was launched in November 2025. According to the release, it targets cryptocurrency investment fraud, cyber-enabled fraud, human trafficking and money laundering. The release says it has restrained $1,006,460,156.82 in cryptocurrency-related fraud and scams and has seized 700 fraudulent crypto investment websites.

Why it matters to AML professionals

Scam centers are moving to new countries when pressure rises in one region, so geography alone is a weak risk signal. AML professionals need to follow the money flow: victim funds converted to crypto and pushed through many wallets to a small set of cash-out accounts. Early detection at the victim's bank or exchange is often the best chance to stop losses.

Red flags in this case

If this landed in your queue

  1. Contact the customer to understand who they are paying and how they met them, and look for romance or investment scam signs
  2. Trace the receiving wallets with blockchain analytics and check for links to known scam clusters
  3. Consider holding or delaying further payments while the case is reviewed, within your firm's policy
  4. Document findings and file a SAR describing the scam typology, wallets and timeline

Key terms

Scam compound
A guarded site where organized groups run online fraud at scale, sometimes using trafficked workers.
Wallet drainer scheme
A fraud where victims are tricked into linking or approving access to their crypto wallet, letting scammers move the funds out.
Wire fraud conspiracy
A US federal charge for agreeing with others to use electronic communications to carry out a scheme to defraud.

Interview angle

A customer in their sixties starts sending crypto to a platform recommended by an online partner. What do you do?

Explain how you would combine customer contact, payment pattern review and wallet tracing, consider protective holds under policy, and file a SAR that names the romance and investment scam typology.

Sources

Go deeper on AMLift

Get the next story in your feedFollow AMLift on LinkedIn for new enforcement breakdowns, the weekly AML challenge and new tools.
Follow on LinkedIn

Found this useful? Share it with your network, or tell us if something looks wrong.

Every fact in AMLift News Desk stories comes from an official source: a regulator, court, government gazette or the company's own filing.