Six Charged in Madagascar Scam Compound Case Built on Dating-Site 'Women' and Fake NFT Investments

Published Oct. 28, 2026. Case statuses are current as of that date.

She looks like a model, she found you on a dating site, and after a few weeks of warm messages she has a tip: an NFT investment platform that has been very good to her. Federal prosecutors say that script was run on an industrial scale from scam compounds in Madagascar, and on Oct. 27, 2026, they unsealed charges against six people they say were part of it.

According to the U.S. Attorney's Office for the District of Columbia, Chui Kok Wa was charged with conspiracy to commit wire fraud as the leader of the scheme, which prosecutors say used fake personas of "beautiful women" to steer American daters into fraudulent non-fungible token (NFT) investment websites [1]. The affidavit supporting the criminal complaint, which the Justice Department posted with its release, names five others charged alongside him: Gislen Neukeu, Shamusa Ninsiima, Clement Mugiraneza, Merveille Mudacumura and Nicodemus Hingima Monyancha [3]. The Record, a cybersecurity news outlet, identified Wa as a Malaysian national [2]; Binance account records cited in the affidavit list his nationality as Malaysia.

Important: These are allegations. None of the six has been convicted, and each is presumed innocent unless and until proven guilty in court.

How the scheme allegedly worked, step by step

According to the affidavit in support of the complaint and arrest warrant, as summarized by prosecutors [1] [3] and The Record [2]:

1. The move. A criminal group with connections to Malaysia and China opened scam compounds in Madagascar in early 2025, likely after moving operations out of Cambodia following law enforcement action there, prosecutors said.
2. The persona. Scammers posed as attractive women and met victims on dating websites. Prosecutors released instructions given to "human models," meaning fake personas built around a real person's images.
3. The pitch. Victims were eventually enlisted to connect their cryptocurrency wallets to fraudulent NFT investment websites.
4. The drain. Once connected, victims were urged to keep funding their wallets, while the scammers "surreptitiously pulled money from the victims' wallets without their knowledge," according to the release.
5. The cash-out. The Record reported that stolen funds went to wallets controlled by Wa on platforms such as Binance before moving to accounts belonging to people in China. Prosecutors said the money went to cryptocurrency accounts associated with China-based actors.

Prosecutors said Wa's phones contained employment contracts with overnight shifts matched to U.S. daytime and evening hours, bonuses tied to stolen money, and scripts telling workers they were committing "an emotional scam, using the [victim's] feelings for us to get him to invest." The phones also held a roster of employees with passport information, salaries and wallet addresses, and scammers kept contact cards on U.S. victims listing their names, locations and jobs [1]. The Record reported that the contracts paid workers $900 a month plus a percentage of what they took from victims [2].

How big was it?

The FBI identified about 74 cryptocurrency wallets associated with about 800 victims around the country who reported losses after using fraudulent investment platforms, prosecutors said [1]. The affidavit estimates losses of at least about $516,695 across at least 74 victim wallets [3], and The Record reported that those victims were in Maryland, Oregon, Nevada, Minnesota and other states [2]. The $516,695 is the affidavit's estimate for those wallets, not a total for all of the roughly 800 victims prosecutors cite. The government also unsealed an earlier warrant under which it seized the scheme's websites.

In August 2026, an FBI team went to Madagascar at the invitation of that country's Ministry of Justice and National Police and helped take down 13 scam compounds, where more than 3,200 electronic devices were seized. Prosecutors said U.S. efforts to interview suspects were "stymied," and that Madagascar sent numerous suspects back to China before the investigation was finished [1].

The people charged and their status

• Chui Kok Wa (identified by The Record as a Malaysian national): charged with conspiracy to commit wire fraud as the alleged leader of the NFT scheme [1] [2].
• Gislen Neukeu, Shamusa Ninsiima, Clement Mugiraneza, Merveille Mudacumura and Nicodemus Hingima Monyancha: named with Wa as defendants in the affidavit supporting the complaint, which says they conspired to commit wire fraud against U.S. citizens while located abroad and describes four of them (Neukeu, Ninsiima, Mugiraneza and Monyancha) as employees of Wa; it names Mudacumura as a defendant without further detail we could review [3]. The affidavit describes passport images on a seized phone for Neukeu (Republic of Cameroon) and Monyancha (Republic of Kenya); we do not state the other three's nationalities because we could not confirm them from a primary source.

Custody: status pending. U.S. Attorney Jeanine Ferris Pirro called on Madagascar to "extradite the six charged defendants," which indicates they were not in U.S. custody when the charges were announced. The government also obtained a material witness warrant to interview 15 employees of the scheme who said they had been trafficked and abused by Wa and are believed to be held in jail in Madagascar [1]. The Record reported that it is unclear whether the six are still in Madagascar [2].

A note on the charging documents: the document we reviewed is an affidavit in support of a criminal complaint and arrest warrant in the U.S. District Court for the District of Columbia, and DOJ describes the charges as unsealed "affidavits in support of an arrest." The Record calls them indictments. We use "charged," and an affidavit states allegations that have not been tested in court.

"Chinese TCOs are sending scammers into your dating network, your social network, and your messaging applications, all to steal Main Street America's bank accounts," Pirro said, referring to transnational criminal organizations [1]. U.S. Attorney Michael J. Heyman of the District of Alaska, whose office is also working on the case, said: "Operating from overseas does not place those who target Americans beyond the reach of U.S. law enforcement" [1].

Red flags

These are general warning signs of this kind of scheme; not every one is alleged in this case.

• A dating match who quickly turns to investing. Romance and money talk from someone you've never met in person is the core of this scam.
• A request to "connect your wallet" to a website or app they recommend. Connecting a wallet can give a site permission to move your funds.
• Pressure to keep adding money so a profit can be "unlocked," or to cover fees before a withdrawal.
• Photos that look professional and a person who won't do a live, unscripted video call.
• Messages at odd hours or with a rehearsed feel, which fits the scripts prosecutors described.

What to do if you're targeted

1. Stop sending money and don't connect your wallet to any site a new online contact suggests.
2. Revoke wallet permissions you may have granted, using your wallet's own settings or a trusted approval-revocation tool, and move remaining funds to a new wallet.
3. Save everything: profiles, chats, website addresses, wallet addresses and transaction IDs.
4. Report it to the FBI at ic3.gov and to the FTC at ReportFraud.ftc.gov. Report the profile to the dating site.
5. Watch for "recovery" scams. People who offer to get your crypto back for a fee are often scammers too.
6. Older adults can call the National Elder Fraud Hotline at 1-833-372-8311.

Case status (as of Oct. 28, 2026)

Defendant	Court	Status	Source
Chui Kok Wa	U.S. District Court, D.C. (complaint and arrest warrant; cases handled with the U.S. Attorney's Office for D. Alaska)	Charged (conspiracy to commit wire fraud, as alleged leader); custody status pending; presumed innocent	[1] [3]
Gislen Neukeu, Shamusa Ninsiima, Clement Mugiraneza, Merveille Mudacumura, Nicodemus Hingima Monyancha	Same	Charged (conspiracy to commit wire fraud, per the affidavit); custody status pending; presumed innocent	[3]

Statuses can change.

Sources

1. U.S. Attorney's Office, District of Columbia, "Scam Center Strike Force Expands Reach to Target Global Crime Syndicates; Charges Scammers Based in Africa and Tied to China," Oct. 27, 2026. https://www.justice.gov/usao-dc/pr/scam-center-strike-force-expands-reach-target-global-crime-syndicates-charges-scammers
2. Jonathan Greig, "US indicts Malaysian national after Madagascar scam operation uncovered," The Record, Oct. 27, 2026. https://therecord.media/malaysian-national-indicted-after-scam-centers-raid-madagascar
3. Affidavit in Support of Criminal Complaint and Arrest Warrant, United States v. Chui Kok Wa et al. (D.D.C., redacted), posted by the U.S. Attorney's Office for the District of Columbia. https://www.justice.gov/usao-dc/media/1468811/dl

---

Corrections and updates: If you are named in this article, or represent someone who is, and believe anything here is inaccurate or out of date (including a dismissal, acquittal, or change in case status), please contact us at editorandchief@scammers.com. We will review it and update the article promptly.