Chinese National Extradited in $37M Crypto Scam

CyberScoop · High sophistication
Last updated October 26, 2026

U.S. authorities allege that Zheng Zhao and co-conspirators used relationship-building scams to persuade at least 174 Americans to invest in fake cryptocurrency platforms. The group contacted victims through social media, dating sites, calls, and text messages, then showed false investment growth while moving victims’ money through accounts they controlled.

Key findings

  • The alleged operation deceived at least 174 U.S. residents and stole nearly $37 million.
  • Scammers initiated contact through social media, phone calls, text messages, and online dating sites.
  • The attackers built trust and then promoted cryptocurrency investments through fake websites made to resemble legitimate trading platforms.
  • Victims were shown that their investments were increasing in value, while their funds had already been transferred through accounts controlled by the conspiracy.
  • The operation allegedly used scam centers in Cambodia and moved funds through U.S. accounts, Deltec Bank in the Bahamas, Tether, and a Cambodia-controlled digital wallet.

Who’s being targeted

  • Commonly targeted roles: All employees, Finance and payroll teams, Executive leaders, Employees who use social media, Employees who use online dating services.
  • Affected industries: Financial services, Cryptocurrency and digital-asset services, Banking, Consumer investing.
  • Attack channels: social media, website, online dating.
  • Impersonated: A trusted online acquaintance posing as a successful cryptocurrency investor, Romantic interest or dating-site acquaintance.

Awareness takeaways

  • Treat investment advice from unsolicited online contacts or new dating-site connections as a potential scam, especially when the person steers the conversation toward cryptocurrency.
  • Independently verify any investment platform before sending money; a professional-looking website can be fraudulent.
  • Do not rely on on-screen account gains as evidence that an investment is real or recoverable; verify whether withdrawals work through trusted, independent channels.
  • Report suspected investment fraud quickly to financial institutions and appropriate internal security or fraud-reporting contacts, since scam networks may move funds internationally soon after receipt.

Red flags to watch for

  • An unsolicited contact quickly shifts the conversation to investments.
  • The person builds a relationship before suggesting a financial opportunity.
  • The investment website resembles a legitimate trading platform but is not independently verified.
  • A new romantic connection introduces an investment opportunity.
  • The contact asks the target to use a specific investment site.
  • Displayed gains are not proof that funds can be withdrawn or that the platform is legitimate.
Try Mirage

Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.

Get a demo
Read the video transcript

A new dating match says, ‘I’m getting strong crypto returns.’ After weeks of chatting, they send you their trading site. You deposit money. The polished dashboard shows your balance climbing. Here’s the catch: those gains are just numbers on a fake site. In this alleged scam, victims’ money had already moved through controlled accounts and into Tether. A friendly contact and a rising chart prove nothing. Before sending money, independently verify the trading platform.

Similar attacks

Romance Scammers Pushed Fake NFT Investments

Romance Scammers Pushed Fake NFT Investments

U.S. prosecutors indicted six people over a Madagascar-based scam operation that allegedly stole more than $516,000 from U.S. victims. The group reportedly used dating sites, posed as attractive women, and persuaded victims to connect cryptocurrency wallets to fraudulent NFT websites, then…

October 27, 2026
Interpol Busts Romance, Crypto & Sextortion Rings

Interpol Busts Romance, Crypto & Sextortion Rings

Interpol said an eight-month operation across 22 countries led to 58 arrests tied to cyber-enabled financial fraud, including romance scams, cryptocurrency/investment scams, and business email compromise. Authorities described how scammers build trust with victims (including minors) on social and…

August 25, 2026
AI Bank Calls Enabled $425K NFC ATM Theft

AI Bank Calls Enabled $425K NFC ATM Theft

Dutch police arrested two suspects accused of using AI-generated bank fraud calls to steal more than €380,000 from 170 victims. The callers falsely warned of suspicious account activity, then posed as bank employees and persuaded victims to download an app and tap their debit card to their phone,…

October 26, 2026
Fraudulent Gov Email and Passkey Lures Hit Orgs

Fraudulent Gov Email and Passkey Lures Hit Orgs

The bulletin describes real-world social engineering where staff were tricked into disclosing sensitive data or access. In one case, Revolut employees responded to fraudulent information requests sent from a real government-domain email account, exposing extensive customer records. Separately,…

September 14, 2026
Fake IT Helpdesk Tricks Users Into Remote Access

Fake IT Helpdesk Tricks Users Into Remote Access

This bulletin describes multiple real-world social engineering campaigns where attackers impersonate IT support or use trusted-looking sharing and “Allow” prompts to gain access. Several campaigns abuse Microsoft Teams and document-sharing lures to trick employees into installing remote tools or…

September 3, 2026
INTERPOL Busts Scam Laundering Network: 58 Arrests

INTERPOL Busts Scam Laundering Network: 58 Arrests

INTERPOL’s Operation Jackal IV (Nov 2025–Jun 2026) targeted the money-laundering backbone behind global online scams, leading to 58 arrests and 263 suspects linked to West African organized crime groups. Cases included romance/investment scams targeting retirees, a fake-investment call center tied…

August 26, 2026