The Justice Department unsealed a criminal complaint on October 27 accusing six people of operating a cryptocurrency-investment fraud from Madagascar. An accompanying FBI affidavit says the alleged scheme used dating profiles and fake nonfungible-token investment sites to obtain control over victims’ USDT.
The affidavit’s blockchain review identified at least 74 unique Ethereum addresses that had signed unlimited USDT spending approvals. Investigators attributed 127 transfers and an estimated loss of 516,695.46 USDT to those approvals as of the affidavit filed for the complaint. The figure is an investigative estimate based on public blockchain data, not a final judicial loss calculation or evidence that an equivalent amount of dollars has been recovered.
How the alleged wallet drain worked
According to the affidavit, operators posing as women developed relationships with prospective victims through dating and messaging services. They then directed targets to websites presented as NFT-investment platforms and persuaded them to connect self-custodied cryptocurrency wallets.
The important technical step was the token approval. On Ethereum, an approval can authorize another address or smart contract to transfer a holder’s tokens without requiring a new signature for every transfer. The FBI says the reviewed victims signed approvals that did not impose a USDT spending ceiling. Investigators allege that an address controlled by the operation could therefore remove tokens after victims added funds to their wallets.
An unlimited approval is not inherently fraudulent; decentralized exchanges and other applications commonly request broad allowances to reduce repeated transactions. The risk depends on who controls the approved spender and what code or interface prompted the authorization. In this case, prosecutors allege that fraudulent websites concealed the operators’ intent and that transfers occurred without the victims’ informed consent.
The complaint names Chui Kok Wa, Gislen Neukeu, Shamusa Ninsiima, Clement Mugiraneza, Merveille Mudacumura and Nicodemus Hingima Monyancia. It seeks to establish probable cause for a wire-fraud-conspiracy charge. The Justice Department describes Wa as the alleged leader and says records recovered from his phones included work schedules, personnel information, wallet addresses and scripts for manipulating victims.
Enforcement reaches beyond Southeast Asia
The Justice Department says the group established operations in Madagascar in early 2025 and had connections to Malaysia and China. Prosecutors believe the move followed enforcement pressure against scam compounds in Cambodia, although that account remains an allegation rather than a court finding.
The announcement matters beyond one complaint because it shows U.S. investigators following cryptocurrency-enabled investment fraud into a new operating region. The government said it is seeking Madagascar’s cooperation and extradition of the defendants. The reviewed records do not establish that the six have been arrested, transferred to the United States or entered pleas.
The DOJ also said its broader Scam Center Strike Force has restrained 1,006,460,156.82 dollars in cryptocurrency-related fraud and scam assets since the task force’s November 2025 launch. That aggregate is a restraint total across the task force’s wider portfolio through October 27, 2026. It is not the alleged loss in this case, a measure of funds returned to victims or a final forfeiture amount.
What remains unproven
A criminal complaint and supporting affidavit present the government’s evidence for probable cause; they are not convictions. The defendants retain the presumption of innocence, and the blockchain attribution, loss estimate and alleged organizational roles can be contested in court.
The next verifiable milestones are arrests or extradition proceedings, initial court appearances and any indictment or judicial findings. Until then, the strongest supported conclusion is that federal prosecutors have charged six people and documented a specific wallet-approval mechanism and preliminary USDT loss estimate—not that the alleged conspiracy has been proved or its victims made whole.
The complete source packet and revision history are retained with the newsroom record.
Automated systems may have assisted with source organization and drafting. Coinburn is accountable for the published text and maintains a revision record.
This article provides news and analysis, not investment, legal or tax advice. Digital assets are volatile and may result in total loss.