WASHINGTON – Today, U.S. Attorney Jeanine Ferris Pirro, together with major federal law enforcement and in concert with interagency partners, announced actions taken by the Department of Justice’s Scam Center Strike Force to secure America against cyber and cryptocurrency investment scams perpetrated by Transnational Criminal Organizations (TCOs) groups.
The Strike Force announced charges against six Africa-based scammers, with connections to Southeast Asia and China, which targeted Americans with fake Nonfungible Token (NFT) investment scams.
U.S. Attorney Pirro also reviewed the Strike Force’s actions to date, noting that it had surpassed $1 billion in cryptocurrency restrained, and announced that the Strike Force has expanded its personnel and its reach to cover a global portfolio, following the expansion of Chinese connected TCOs to Africa and Europe.
Joining in the announcement were U.S. Attorney Michael J. Heyman for the District of Alaska, Assistant Director Heith Janke of the FBI Criminal Division, and Special Agent in Charge Tara McLeese of the United States Secret Service (USSS) Washington Field Office.
“Chinese TCOs are sending scammers into your dating network, your social network, and your messaging applications, all to steal Main Street America’s bank accounts. For the last year, the Strike Force has fought hard against the compounds in Southeast Asia facilitating these scammers, to the tune of $1 billion in cryptocurrency restrained,” said U.S. Attorney Pirro. “My Strike Force will expand and grow, and follow the scammers to Africa, India, Europe, and wherever they try to plant their operations. We will work with international partners to stop the cancerous spread of TCOs perpetrating scams on Americans.”
As alleged in affidavits in support of an arrest of six individuals unsealed today, a criminal group with connections to Malaysia and China opened scam compounds in Madagascar in early 2025, likely having moved those operations from Cambodia after law enforcement action in that country.
In the scheme, scammers posed as beautiful women who met victims on dating websites, eventually enlisting them to connect their cryptocurrency wallets to fraudulent websites associated with the NFT investments. Once connected, the scammers willed the victims to continue to fund their cryptocurrency wallets, and then surreptitiously pulled money from the victims’ wallets without their knowledge.
Images of beautiful women, used by scammers to meet U.S. victims on dating sites.
Instructions provided to human models (i.e., fake personas of a real person) to perpetrate the scheme.
FBI investigators identified approximately 74 cryptocurrency wallets associated with approximately 800 victims throughout the country who reported financial losses after interacting with fraudulent investment platforms online. The funds stolen from the victims were moved to cryptocurrency accounts associated with Chinese-based actors. Additionally unsealed today was a prior warrant wherein the government seized the websites associated with the scheme.
Among the charges unsealed, Chui Kok Wa, was charged with conspiracy to commit wire fraud, as the leader of the NFT Scheme. Wa’s phones contained employment contracts, detailing overnight work schedules in Madagascar corresponding with daytime and evening hours in the United States, and providing employees with bonus payments tied to money stolen. Wa’s phones also included “scripts” or guides for what scammers should say to victims, which specifically told the workers that they were committing “an emotional scam, using the [victim’s] feelings for us to get him to invest.” Wa’s phone also had a roster that included the employees’ names, passport information, salary, hours, disciplinary actions taken against them, and a list of cryptocurrency wallet addresses for the employees.
“The defendants allegedly operated a sophisticated fraud scheme from Madagascar, exploiting the trust of Americans to steal their hard-earned money,” said U.S. Attorney Michael J. Heyman for the District of Alaska. “Operating from overseas does not place those who target Americans beyond the reach of U.S. law enforcement, and we will continue working with our domestic and international partners to aggressively hold those responsible accountable. I’m happy to be joining U.S. Attorney Pirro in collaborating and sharing the work on these important cases.”
“Cybercriminals running scam centers wrongly assume they can relocate to escape our reach,” said Special Agent in Charge Tara McLeese of the U.S. Secret Service Washington Field Office. “Our agents and investigative analysts continue to show that these criminals can be identified, their money can be seized, and they can be held accountable.”
“These scam compounds don’t stop at borders — they target Americans’ vulnerabilities and hard‑earned money,” said Assistant Director Heith Janke of the FBI Criminal Division. “The FBI, along with our partners at the Scam Center Strike Force, the Department of Justice, and the Secret Service have shown that there is no safe harbor for scammers who target Americans. We will hold you accountable and justice will find you.”
Scammers kept track of their U.S. victims by listing their name, location, work, and other personal details in the Contact Cards on their phones.
U.S. Attorney Pirro also noted that this case is emblematic of the spread of TCO actors from Asia spreading into other regions of the world. In August 2026, the FBI deployed a team to Madagascar at the invitation of the Madagascar Ministry of Justice and the Madagascar National Police (MNP) to assist MNP in the take down of 13 scam compounds and the more 3,200 electronic devices seized therein. After deploying, however, the U.S. government was stymied in efforts to interview the individuals involved, and Madagascar repatriated to China numerous suspects before the investigation was complete. Today, U.S. Attorney Pirro called on the Madagascar government to cooperate with the United States, extradite the six charged defendants, and further noted that the government had obtained a material witness warrant to interview 15 employees of the scheme, who claimed they were human trafficked and abused by Wa, but are believed to be held in jail in Madagascar.
Also today, U.S. Attorney Pirro announced other actions taken by her Office in the last year, all related to efforts to protect Americans from scams and covered by President Trump’s Executive Order 14390—Combating Cybercrime, Fraud, and Predatory Schemes Against American Citizens:
-
The Strike Force has restrained $1,006,460,156.82 in cryptocurrency-related fraud and scams.
-
The Strike Force has seized 700 fraudulent crypto investment websites, shutting down pipelines used to lure victims.
-
The Strike Force has seized Starlink terminals used by scam centers to maintain internet access. In fact, thousands of Starlink terminals have been taken down.
-
The Strike Force conducted the first‑ever seizure of a Telegram channel used to recruit human trafficking victims into scam compounds. It also seized two additional Telegram channels hosting the Xinbi Guarantee Network, an illicit marketplace setup to provide websites and money laundering services that allows the scam centers to operate.
-
The Strike Force, working with foreign partners, has seized and reviewed tens of thousands of devices used in scam compounds, to include computers, servers, hard drives and cell phones.
-
The Strike Force, working in collaboration with private industry, had identified millions of scam accounts on U.S. networks. Meta reports that 17.3 million scam accounts have been deplatformed in the last year.
-
The Strike Force is leading a national consumer awareness campaign, together with U.S. Postal Inspection Service (USPIS), FBI, and USSS. As part of that effort, the Strike Force has engaged the Ad Council Research Institute (ACRI), the research arm of the nonprofit Ad Council. ACRI’s study will