FBI Reveals Identity of Kenyan Man in Online Romance and Cryptocurrency Scam Targeting 800 Americans
The United States Federal Bureau of Investigation (FBI) has identified a Kenyan national among six suspects charged over an alleged international online romance and cryptocurrency investment scam that reportedly targeted approximately 800 Americans.
The Kenyan, identified as Nicodemus Hingima Monyancha, is accused of participating in a sophisticated fraud operation that allegedly used fake romantic relationships to convince unsuspecting victims to invest in fraudulent cryptocurrency platforms.
According to investigators, the criminal network operated from scam compounds in Madagascar, where individuals allegedly posed as attractive women on dating websites and social media platforms to establish relationships with American victims.
After gaining the victims’ trust, the suspects allegedly introduced cryptocurrency investments, directing them to websites designed to resemble legitimate digital asset trading platforms. Once victims connected their cryptocurrency wallets, the fraudsters allegedly gained access to their funds and transferred the money without their knowledge.
The case has attracted international attention because of the number of victims involved, the alleged use of romantic relationships to facilitate financial fraud and the participation of individuals from several countries.
Monyancha is among six defendants charged in the United States over the alleged scheme. The other suspects are Malaysian national Chui Kok Wa, identified by investigators as the alleged leader, Cameroonian national Gislen Neukeu, Ugandan national Shamusa Ninsiima and Rwandan nationals Clement Mugiraneza and Merveille Macacumura.
The charges form part of an expanding American crackdown on international cryptocurrency fraud networks that use online relationships, digital investment platforms and cross-border financial transactions to steal money.
How the alleged romance scam worked
Investigators say the operation relied on a carefully organised approach that exploited the emotional vulnerability and trust of people searching for romantic relationships online.
The suspects allegedly created attractive female profiles on dating websites and other online platforms to attract potential victims, particularly American men.
After initiating conversations, the individuals behind the profiles reportedly worked to establish personal connections with their targets. Some conversations were allegedly moved from dating websites to WhatsApp and other messaging platforms, where the suspects could communicate more frequently and build stronger relationships.
Rather than immediately asking for money, the alleged scammers gradually developed romantic connections with their targets. They reportedly exchanged photographs, discussed personal experiences and created convincing stories about their lives.
Once a victim became emotionally invested, the supposed romantic partner would introduce cryptocurrency and digital investment opportunities.
The victims were allegedly encouraged to invest in non-fungible tokens, commonly known as NFTs, through platforms presented as legitimate investment marketplaces.
NFTs are digital assets whose ownership is recorded on a blockchain. Although they can have legitimate uses, investigators say the suspects exploited public interest in digital assets to make their fraudulent investment platforms appear credible.
Victims were reportedly directed to websites where they could connect their cryptocurrency wallets and begin depositing digital assets.
In some cases, the platforms allegedly displayed what appeared to be investment profits, encouraging victims to believe their money was growing.
However, investigators say the displayed investment activity was part of the deception. Once victims connected their wallets and granted the requested permissions, the suspects allegedly obtained the ability to transfer cryptocurrency out of the accounts.
The victims would then discover that their funds had disappeared, sometimes without receiving any warning or explanation.
Approximately 800 Americans linked to the suspected operation
The FBI reportedly identified approximately 74 cryptocurrency wallets associated with the alleged scheme and linked them to around 800 victims across the United States.
Investigators estimated that the operation caused losses of at least $516,695.46 in cryptocurrency, according to the FBI affidavit cited in reports about the case.
The figure highlights the financial consequences of online investment scams that exploit personal relationships and the growing popularity of cryptocurrency.
The actual impact of the operation may extend beyond the money directly identified in the investigated wallets, although authorities have not established a larger confirmed loss figure for this particular case.
One example cited in the investigation involved a victim from Maryland who allegedly lost nearly $12,000 after connecting a cryptocurrency wallet to a purported NFT investment platform.
The victim reportedly deposited cryptocurrency after being persuaded that the platform offered an investment opportunity. Although the website initially appeared to show a small profit, attempts to withdraw the funds were unsuccessful.
Investigators also described another victim in Oregon who reported losing cryptocurrency after connecting a wallet to a similar platform.
These cases illustrate how fraudulent investment websites can create the appearance of legitimate financial services while secretly facilitating unauthorised transactions.
The FBI also reportedly tested one of the suspicious platforms using a newly created cryptocurrency wallet. Investigators found that the website requested permission to spend USDT tokens, potentially allowing an external party to transfer funds from the connected wallet.
The findings helped investigators understand how the alleged fraudsters obtained access to victims’ digital assets.
Evidence points to an organised operation in Madagascar
One of the most striking aspects of the investigation is the level of organisation investigators say existed within the suspected criminal network.
The operation allegedly functioned through scam compounds in Madagascar, where workers were assigned specific responsibilities and schedules.
Investigators believe the network was established in Madagascar in early 2025 after criminal operations were relocated from Cambodia following law enforcement action in Southeast Asia.
Evidence recovered from electronic devices reportedly included employment contracts, staff rosters, work schedules and detailed instructions on how workers should communicate with potential victims.
The documents allegedly showed that workers were expected to follow specific procedures when approaching people online, developing romantic relationships and introducing cryptocurrency investments.
Some employees were reportedly assigned overnight shifts corresponding to daytime and evening hours in the United States.
This arrangement allegedly allowed workers in Madagascar to communicate with American victims during periods when they were most likely to be active online.
The recovered documents also reportedly included salary arrangements, commissions and performance targets linked to the amount of money workers persuaded victims to invest.
Some employment records allegedly provided for penalties when workers failed to meet their targets.
Investigators further recovered instructions explaining how workers should build emotional connections with victims before introducing investment opportunities.
One document reportedly described the approach as an emotional scam, using a person’s feelings to persuade them to invest.
Other instructions allegedly encouraged workers to exchange photographs, arrange video calls and develop convincing personal histories.
A separate document reportedly contained a story about a husband suffering from leukaemia, which could be used to create sympathy and strengthen emotional connections with potential victims.
The evidence suggests that investigators are examining a coordinated operation rather than isolated individuals independently attempting to defraud people online.
Kenyan national charged alongside five other suspects
Monyancha’s identification has brought attention to Kenya’s alleged connection to the international fraud network.
The Kenyan is charged alongside five other foreign nationals, with prosecutors alleging that the group participated in a conspiracy involving online romance fraud and cryptocurrency investment platforms.
The alleged leader, Chui Kok Wa, is a Malaysian national whom investigators believe coordinated important aspects of the operation.
The other defendants include Gislen Neukeu from Cameroon, Shamusa Ninsiima from Uganda, and Clement Mugiraneza and Merveille Macacumura from Rwanda.
The charges followed an investigation that examined electronic devices, cryptocurrency transactions and information recovered from suspected scam compounds.
The US authorities are seeking to bring the accused individuals before American courts to answer the allegations.
The case also demonstrates how criminal networks can recruit people from different countries and organise operations across international borders.
For Kenya, the involvement of a Kenyan citizen in the case adds to growing concerns about the participation of East African nationals in cross-border financial and cybercrime investigations.
However, the allegations against Monyancha must be distinguished from a criminal conviction. He and the other defendants remain entitled to due process and are presumed innocent unless proven guilty.
FBI-backed operation dismantles 13 suspected scam compounds
The charges emerged following an investigation that involved cooperation between American investigators and authorities in Madagascar.
In August 2026, an FBI team travelled to Madagascar after receiving an invitation from the country’s Ministry of Justice and National Police.
The operation focused on suspected scam compounds believed to be involved in online financial fraud.
Authorities reportedly examined 13 suspected compounds and seized more than 3,200 electronic devices during the operation.
The devices were expected to provide investigators with valuable information about the alleged network, including communications between suspects, cryptocurrency transactions, victim contacts and the organisation of the compounds.
Local authorities reportedly detained approximately 400 individuals during the wider operation.
The FBI subsequently used information recovered from electronic devices to investigate the alleged romance and cryptocurrency fraud network.
However, the investigation encountered challenges after Madagascar repatriated several suspects to China before American investigators could complete their interviews.
US prosecutors have since called for greater cooperation from Madagascar, including assistance in bringing the six charged defendants to face proceedings in the United States.
The Justice Department has also obtained a material-witness warrant to interview 15 individuals believed to have information about the alleged operations.
Questions emerge over possible human trafficking and worker exploitation
While the investigation focuses on the alleged cryptocurrency fraud, it has also raised questions about the conditions under which some individuals worked inside the suspected scam compounds.
Lawyers representing a group of African nationals detained in Madagascar reportedly alleged that some individuals had been recruited through online employment advertisements before being subjected to intimidation, abuse and restrictions on their freedom.
The allegations suggest that some people working within international scam operations may themselves have been recruited under misleading circumstances.
Some workers reportedly claimed they were trafficked and mistreated by individuals associated with the operation.
The FBI said it had not been able to independently substantiate some of these allegations because investigators had not interviewed the individuals concerned.
The issue adds another dimension to the investigation, which is examining not only the people allegedly responsible for financial fraud but also the circumstances surrounding the recruitment and treatment of workers.
Authorities will need to establish whether individuals participated willingly, were coerced or were themselves victims of criminal exploitation.
This distinction is important because international scam compounds have increasingly raised concerns about human trafficking, forced labour and the recruitment of vulnerable people through fraudulent employment opportunities.
US intensifies crackdown on international cryptocurrency fraud
The case comes amid a wider American campaign targeting international criminal networks accused of using digital assets to defraud citizens.
The US Department of Justice has increasingly focused on scam centres that operate through online dating platforms, social media, messaging applications and fraudulent investment websites.
These operations often rely on cryptocurrency because digital assets can be transferred across borders quickly and through multiple wallets.
The use of cryptocurrency does not automatically make a transaction anonymous or impossible to trace. Investigators can examine blockchain records, identify suspicious wallet addresses and work with financial service providers to follow the movement of stolen funds.
In this case, investigators reportedly traced 74 cryptocurrency wallets connected to the alleged operation.
The investigation also demonstrates the importance of international cooperation in addressing crimes that do not respect national borders.
A victim may be living in the United States, the person communicating with them may be operating from Madagascar, and the cryptocurrency proceeds may be transferred through wallets connected to individuals in other countries.
This creates challenges for law enforcement agencies that must coordinate investigations, gather evidence and pursue suspects across different legal jurisdictions.
The US Scam Center Strike Force has been working to disrupt such operations by targeting the individuals, websites, financial infrastructure and digital assets allegedly used to facilitate fraud.
The authorities have also urged technology companies and international partners to strengthen cooperation in identifying suspicious platforms and preventing further victimisation.
What the case means for Kenyans using dating and investment platforms
The allegations offer an important warning to Kenyans and other internet users about the risks associated with online relationships that quickly turn into investment opportunities.
Romance scams often begin with ordinary conversations. A person may receive a message from someone who appears attractive, friendly and genuinely interested in developing a relationship.
The communication may continue for weeks or months before the other person introduces an opportunity to make money through cryptocurrency, foreign exchange trading or another online investment platform.
The supposed romantic partner may claim to have extensive investment experience and offer to help the victim earn profits.
In some cases, victims are directed to websites that display impressive balances and apparent returns, creating the impression that their investments are successful.
However, the displayed figures may be fabricated, and the website may be designed specifically to steal deposits or obtain access to cryptocurrency wallets.
Internet users should therefore be cautious when someone they have only met online begins encouraging them to invest money.
They should independently verify investment platforms, avoid sharing wallet recovery phrases and passwords, and never grant unfamiliar websites unnecessary permission to spend their digital assets.
A romantic relationship should never be treated as proof that an investment opportunity is legitimate.
Anyone who suspects they have been targeted should preserve messages, transaction records, wallet addresses and website details for reporting to the relevant law enforcement authorities.
A growing challenge for international law enforcement
The case involving Monyancha and the five other defendants demonstrates the changing nature of financial crime in the digital era.
Traditional fraud schemes often depended on direct contact between criminals and their victims. However, online platforms now allow criminal networks to approach thousands of people across different countries without meeting them physically.
By combining fake identities, emotional manipulation and cryptocurrency transactions, the alleged network was able to target people looking for relationships and turn their trust into an opportunity for financial exploitation.
The involvement of multiple nationalities also highlights the need for stronger cooperation between governments and law enforcement agencies.
As investigators continue examining the evidence, attention will remain on the six defendants, the alleged leadership structure and the financial transactions connected to the suspected operation.
For the hundreds of Americans reportedly affected, the priority will be accountability and efforts to recover their lost funds.
For Kenya, the case is another reminder that cybercrime can have international consequences and that individuals accused of participating in overseas criminal operations may face prosecution beyond the country’s borders.
Ultimately, the investigation sends a warning to people who use online relationships to promote fraudulent investment schemes: digital platforms may make it easier to reach victims, but they can also leave evidence that investigators can follow across borders.
