Kenyan Among Six Charged in US Over Fake Online Love and Crypto Scam Targeting 800 Americans
A Kenyan national is among six suspects charged by the United States over an alleged international cryptocurrency fraud scheme that reportedly targeted approximately 800 Americans through fake online romantic relationships and fraudulent investment platforms.
The charges, announced by the US Department of Justice on Tuesday, October 27, 2026, have exposed the alleged tactics used by an organised network accused of exploiting people’s search for love to steal their money. Investigators say the suspects operated from Madagascar and had alleged connections to criminal networks linked to Southeast Asia and China.
According to American authorities, the group allegedly created fake online identities, posed as women on dating websites and built relationships with unsuspecting victims. After gaining their trust, the scammers allegedly persuaded them to connect their cryptocurrency wallets to fraudulent websites offering investments in non-fungible tokens, commonly known as NFTs.
Once victims connected their wallets and added more funds, the suspects allegedly accessed and removed cryptocurrency without their knowledge.
The Federal Bureau of Investigation (FBI) identified approximately 74 cryptocurrency wallets associated with about 800 victims across the United States who reported financial losses after interacting with the fraudulent investment platforms. Investigators further alleged that the stolen funds were transferred to cryptocurrency accounts associated with actors based in China.
The case has drawn attention to the growing threat posed by online romance scams combined with cryptocurrency investment fraud. It also highlights the challenges facing international law enforcement agencies as criminal networks operate across several countries, use digital platforms to target victims and move funds through cryptocurrency systems.
The six suspects include nationals from Kenya, Uganda, Cameroon and Rwanda. US prosecutors say the alleged operation was connected to a wider criminal network with links to Malaysia and China. However, the charges remain allegations, and the accused are presumed innocent unless proven guilty in court. <Cite refs={[“turn470739view0″,”turn470739view1”]}/>
How the alleged romance and cryptocurrency scam worked
According to the US Department of Justice, the operation relied on a calculated process of building emotional connections with victims before introducing them to fraudulent investment opportunities.
The suspects allegedly used images of attractive women and fake online identities to approach potential victims through dating websites. These interactions were designed to make the targets believe they were communicating with genuine people interested in developing romantic relationships.
Rather than immediately asking for money, the scammers allegedly spent time building trust. This approach can make romance-based investment fraud particularly dangerous because victims may believe they are dealing with someone who genuinely cares about them.
Once a relationship had developed, the alleged scammers introduced cryptocurrency investments, including opportunities connected to non-fungible tokens. They reportedly directed victims to websites that appeared to offer legitimate investment services.
The victims were then encouraged to connect their cryptocurrency wallets to the platforms and continue funding their accounts.
However, investigators allege that the websites were fraudulent and that connecting the wallets enabled the scammers to steal cryptocurrency without the victims’ knowledge.
The scheme illustrates how online fraudsters can combine emotional manipulation with technology to make financial crimes appear convincing. Victims may believe they are following investment advice from a trusted romantic partner rather than interacting with people operating a coordinated fraud operation.
The US authorities said the alleged scheme was sophisticated enough to involve detailed instructions on how workers should communicate with victims and encourage them to invest.
Information recovered from the phones of Chui Kok Wa, who was charged with conspiracy to commit wire fraud and described by prosecutors as the alleged leader of the NFT scheme, reportedly included employment contracts, work schedules, payment arrangements and scripts for conversations with victims.
The scripts allegedly instructed workers to use victims’ feelings to persuade them to invest. The phones also reportedly contained employee information and cryptocurrency wallet addresses.
These details have become central to the case because they may help investigators establish how the operation was organised, how its workers were managed and how money was allegedly stolen.
The existence of scripts and employment records, as described by prosecutors, suggests that investigators believe the operation was more organised than isolated individuals independently approaching strangers online. The full extent of each suspect’s role, however, must be established through the legal process. <Cite refs={[“turn470739view0″,”turn213851search1”]}/>
FBI links the scheme to approximately 800 victims
One of the most striking details in the case is the number of people allegedly affected by the fraudulent investment platforms.
The FBI identified approximately 74 cryptocurrency wallets associated with around 800 Americans who reported financial losses after interacting with the websites.
The number of wallets and victims does not necessarily mean that every victim lost the same amount of money. Nor does it establish the total amount stolen through this particular operation. The available announcement did not provide a final overall loss figure for the alleged scheme.
Nevertheless, the reported number of victims illustrates how online fraud can reach people in different locations without requiring criminals to meet them physically.
A scammer operating from another country can communicate with a target through a dating application, messaging service or social media account. The victim may have little information about the person behind the profile, the company promoting the investment or the people controlling the website.
This distance can make it difficult for victims to identify warning signs before money disappears.
Cryptocurrency adds another layer of complexity. Digital assets can be transferred between wallets and moved across different platforms, potentially making it difficult to establish who controls the funds and where they ultimately end up.
Although blockchain transactions can leave a digital record, investigators may need specialist tools, financial records and international cooperation to link wallet addresses to individuals and trace the movement of assets.
In this case, US authorities said the funds stolen from victims were moved to cryptocurrency accounts associated with Chinese-based actors.
The government also announced that it had seized websites associated with the alleged scheme. Shutting down the platforms could prevent further victims from accessing them, although recovering money already stolen is a separate challenge.
For victims, the financial impact may extend beyond the immediate loss of savings. Some may have borrowed money, used retirement funds or made repeated deposits because they believed the investment was genuine.
Others may struggle to report what happened because they feel embarrassed about trusting someone they met online.
The case therefore raises important questions about consumer protection, digital security and the need to make reporting online fraud easier for victims. <Cite refs={[“turn470739view0″,”turn213851search3”]}/>
Alleged scam compounds in Madagascar
Investigators believe the alleged operation was run from scam compounds established in Madagascar in early 2025.
According to the US Department of Justice, a criminal group with connections to Malaysia and China allegedly established the compounds after moving operations from Cambodia, possibly following law enforcement action there.
The development reflects the increasingly international nature of organised online fraud. Authorities say criminal networks can move their operations between countries when investigations, arrests or other enforcement measures threaten their activities.
Operating from a different country can complicate investigations because evidence, suspects, victims and financial transactions may fall under different legal systems.
The FBI travelled to Madagascar in August 2026 to assist local authorities in efforts to dismantle 13 alleged scam compounds. During the operation, more than 3,200 electronic devices were seized, according to the US government.
The devices reportedly formed part of a wider investigation into the activities of suspected scam centres.
Computers, mobile phones, servers and other digital equipment can contain valuable evidence, including communications with victims, scripts, transaction records, account credentials and information about the people operating the networks.
However, obtaining such evidence is only one part of the process. Investigators must analyse the material, identify suspects, establish individual roles and present evidence that can support criminal proceedings.
The US government said its efforts to interview individuals connected to the operations were hindered after Madagascar repatriated several suspects to China before the investigation was complete.
Following the latest charges, US Attorney Jeanine Ferris Pirro called on Madagascar to cooperate with American authorities and extradite the six accused individuals.
The request could become an important part of the next stage of the case. Any extradition process would depend on the applicable legal procedures and decisions by the relevant authorities.
The investigation demonstrates why cooperation between countries is increasingly important in combating cybercrime. A criminal network may recruit workers in one country, operate websites from another, target victims thousands of kilometres away and move stolen money through accounts in yet another jurisdiction.
No single country can easily investigate every part of such a network without assistance from international partners. <Cite refs={[“turn470739view0″,”turn213851search4”]}/>
Chui Kok Wa accused of leading the NFT scheme
Among the six people charged, the US Department of Justice specifically identified Chui Kok Wa as the alleged leader of the NFT investment scheme.
Wa was charged with conspiracy to commit wire fraud. Prosecutors say information recovered from his phones included employment contracts, work schedules and payment arrangements tied to money stolen from victims.
The records reportedly showed that workers in Madagascar operated overnight shifts corresponding with daytime and evening hours in the United States. Such schedules would have allowed them to maintain contact with targets during the hours when those victims were most likely to be available online.
The phones also allegedly contained scripts that instructed workers on how to manipulate victims’ emotions to encourage investments.
Investigators further reported finding a roster containing employee names, passport details, salaries, working hours, disciplinary information and cryptocurrency wallet addresses.
These materials could be significant in helping prosecutors establish the organisation’s structure and the relationships between people allegedly involved.
They may also help investigators determine whether the operation used a coordinated system for approaching victims, maintaining conversations and transferring stolen funds.
However, evidence described in a criminal complaint or affidavit represents the government’s allegations at this stage. Its significance must be assessed through the judicial process, and the charges against each defendant must be considered individually.
The available Justice Department announcement specifically identified Wa’s charge but did not set out every charge against every suspect in the public summary. It is therefore important not to assume that all six defendants face identical allegations.
The case will depend on evidence establishing what each person allegedly did, whether the conduct violated applicable US law and whether prosecutors can prove the charges in court. <Cite refs={[“turn470739view0″,”turn213851search5”]}/>
Authorities raise concerns over possible trafficking and abuse
The investigation has also revealed a potentially troubling dimension involving people who may have worked inside the alleged scam compounds.
The US Department of Justice said 15 employees connected to the operation claimed they had been trafficked and abused by Wa. American authorities said they had obtained a material witness warrant to interview the employees, who were believed to be held in jail in Madagascar.
These claims introduce an important distinction in understanding scam-centre operations. People found working in such facilities may have different roles and circumstances, and some may themselves be victims of coercion or trafficking.
Authorities must therefore distinguish between people who allegedly organised or knowingly participated in fraud and those who may have been forced, deceived or exploited into working at the compounds.
The allegations made by the 15 employees require investigation and should not be treated as established findings without further evidence.
Their accounts could nevertheless help investigators understand how the alleged operation recruited workers, controlled their activities and managed communications with victims.
If individuals were trafficked or abused, their treatment would raise separate concerns requiring appropriate protection and legal attention.
The case illustrates the complex environment in which some international scam operations reportedly function. Investigations may need to address financial fraud, cybercrime, money laundering and potential human trafficking at the same time.
It also reinforces the importance of identifying the people who control such operations rather than focusing exclusively on individuals who may have been working under coercive conditions.
For authorities seeking to dismantle these networks, understanding recruitment methods and the roles of people inside the compounds may be essential to establishing responsibility and preventing similar operations from emerging elsewhere. <Cite refs={[“turn470739view0″,”turn213851search4”]}/>
US expands its crackdown on cryptocurrency fraud
The charges form part of a broader American campaign against online investment fraud and organised scam centres.
The US Department of Justice said its Scam Center Strike Force had restrained more than $1 billion in cryptocurrency linked to fraud and scams by October 27, 2026.
The task force also reported seizing 700 fraudulent cryptocurrency investment websites and working with international partners to seize and review tens of thousands of electronic devices.
These figures relate to the task force’s broader enforcement activities and should not be confused with the amount allegedly stolen in the Madagascar case.
The wider effort includes cooperation among the Department of Justice, FBI, US Secret Service and other agencies, as well as assistance from private-sector companies.
The objective is to identify scam networks, disrupt their digital infrastructure, trace stolen funds and hold people responsible for the alleged crimes accountable.
The government has also worked with technology companies to identify and remove fraudulent accounts and platforms. The Justice Department said Meta reported removing 17.3 million scam accounts during the previous year.
These measures demonstrate the scale of the challenge posed by online fraud. Criminals can use social media, dating websites, messaging applications and investment platforms to approach potential victims, making it necessary for law enforcement agencies and technology companies to coordinate their efforts.
However, seizing cryptocurrency does not automatically mean that victims will immediately receive their money back.
Authorities must establish the legal ownership of seized assets, complete the necessary court proceedings and determine how any funds can lawfully be returned to eligible victims.
The Justice Department acknowledged that the wider process of recovering and returning restrained cryptocurrency involves litigation and further legal steps.
For people who have lost money, the recovery process can therefore take time, and there is no guarantee that every victim will recover the full amount lost.
The broader crackdown nevertheless shows how financial investigations and digital evidence can be used to disrupt fraudulent operations that cross international borders. <Cite refs={[“turn470739view0″,”turn213851search3”]}/>
How people can protect themselves from romance and crypto scams
The case is a reminder that online relationships can be exploited to gain access to personal information and money. People using dating applications and social media should remain cautious when a new acquaintance begins recommending investments or asking for access to financial accounts.
One major warning sign is a person who quickly turns a romantic conversation into an investment pitch. Even if the relationship appears genuine, financial decisions should be made independently and based on verifiable information.
People should be particularly careful when someone directs them to an unfamiliar cryptocurrency website, asks them to connect a digital wallet or insists that they deposit additional money to unlock supposed profits.
A website displaying impressive returns does not prove that an investment is legitimate. Fraudulent platforms can imitate genuine services, show fabricated account balances and use convincing customer support messages to maintain a victim’s confidence.
Investors should verify platforms independently, research the people and companies involved, and avoid relying solely on recommendations from online acquaintances.
They should also never share wallet recovery phrases, private keys, passwords or one-time security codes. These details can give another person control over digital assets or financial accounts.
People who suspect they have been targeted should stop sending money, preserve relevant messages and transaction records, and report the matter to the appropriate authorities or financial platform. They should be wary of anyone who promises to recover stolen cryptocurrency in exchange for an upfront fee, as recovery scams often target people who have already suffered losses.
Most importantly, victims should not be ashamed to report fraud. The responsibility for deception lies with the people who carry it out, and timely reporting can help investigators identify patterns and prevent further losses.
Conclusion
The charging of a Kenyan national alongside five other suspects in the United States has brought renewed attention to the dangers of online romance scams linked to cryptocurrency investments.
US authorities allege that the network used fake female identities to build relationships with victims before directing them to fraudulent NFT investment websites. Investigators linked approximately 74 cryptocurrency wallets to around 800 Americans who reported financial losses.
The alleged operation was reportedly run from scam compounds in Madagascar and had connections to criminal networks linked to Southeast Asia and China. The US government has seized websites associated with the scheme and is seeking cooperation from Madagascar as the case progresses.
The investigation also highlights the complexity of international cybercrime, where emotional manipulation, digital technology and cross-border financial transactions can be combined to defraud victims.
As the legal process continues, the allegations against the six suspects must be tested in court. Authorities will also need to establish the role of each individual, trace the movement of funds and determine whether money can be recovered for affected victims.
For the public, the case serves as a warning to exercise caution when online relationships become tied to investment offers. Trust should never replace independent verification, particularly when cryptocurrency wallets and personal savings are involved.
