U.S. prosecutors indicted six people over a Madagascar-based scam operation that allegedly stole more than $516,000 from U.S. victims. The group reportedly used dating sites, posed as attractive women, and persuaded victims to connect cryptocurrency wallets to fraudulent NFT websites, then pressured them to add more funds while the money was drained.
This case involved an alleged scam operation that used dating sites as the entry point for financial fraud. According to the indictment, scammers posed as attractive women to build rapport with victims over time. Once trust was established, victims were steered toward a supposed investment opportunity involving nonfungible tokens, or NFTs. The pitch required victims to connect a cryptocurrency wallet to a website presented as a legitimate NFT investment platform. From there, the group used scripted scenarios and pictures to maintain the illusion of legitimacy and encourage continued investment.
The scheme combined emotional manipulation with financial pressure. By first establishing a romantic connection through dating sites, the scammers lowered victims' skepticism before introducing a financial ask. The investment pitch relied on prepared scripts and curated images rather than verifiable information, making it difficult for victims to distinguish the scheme from a genuine opportunity. Once a wallet was connected, victims were repeatedly pushed to add more funds, a pressure tactic that kept money flowing even as losses mounted. More than $516,695 was reportedly drained from 74 cryptocurrency wallets belonging to victims across multiple U.S. states, reflecting the scale this approach can reach when sustained over time.
Individuals and organizations with employees who use dating apps or hold cryptocurrency should treat unsolicited investment advice from online contacts as a significant warning sign. Wallets should never be connected to a platform promoted by someone who cannot be independently verified, and any pressure to make repeated deposits should prompt a pause rather than action. Compelling stories and professional-looking materials are not proof of legitimacy; they can be part of a scripted scam. Encouraging employees and consumers to independently research investment platforms before committing funds, and to be wary of romantic contacts who pivot to financial requests, can reduce exposure to this type of scheme.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
The operation used dating sites as the initial contact channel, with scammers posing as attractive women to build trust before introducing an investment opportunity.
Victims were directed to fraudulent websites presented as legitimate NFT investment platforms and asked to connect their wallets to begin investing.
Scammers pressured victims to continue adding funds to their wallets even as money was being siphoned out, a tactic designed to maximize losses before the scheme was discovered.
Warning signs include a new online romantic contact promoting an investment, requests to link a cryptocurrency wallet to an unfamiliar site, and repeated pressure to deposit additional funds.
Your new dating-site match has an NFT tip? Pause. In this scam, contacts posing as attractive women used scripted stories and pictures, then said, ‘Connect your cryptocurrency wallet to our NFT investment website to begin investing.’ Here's the tell: the person you met for romance is selling an investment. Once wallets connected, victims were pushed to add funds while money drained. If a dating match sends an NFT site, don't connect your wallet.
U.S. authorities allege that Zheng Zhao and co-conspirators used relationship-building scams to persuade at least 174 Americans to invest in fake cryptocurrency platforms. The group contacted victims through social media, dating sites, calls, and text messages, then showed false investment growth…
FinCEN reports that overseas scam centers stole about $12.7B from U.S. victims since 2023, largely through “pig butchering” style cryptocurrency investment scams. Scammers build trust using fake personas (often romance or “financial adviser” roles), then pressure victims to buy crypto and send it…
OpenAI says it shut down a coordinated network of ChatGPT accounts linked to Cambodia that supported multiple real-world scams, including investment, romance, gambling, and law-enforcement impersonation. The group used AI to create fake personas, translate and generate persuasive messages on…
Attackers abused legitimate Staples and Dell order-notification systems to send convincing emails about expensive purchases the recipient never made. Instead of using a suspicious link, the messages inserted attacker-controlled “helpline” numbers into trusted transaction fields, aiming to move…
Microsoft says it uncovered and disrupted an underground marketplace (“YAM Store”) that sold phishing kits and access to cloud accounts, enabling massive global phishing and SMS scam campaigns. The operation allegedly supported over a billion scam messages since January 2026 and targeted 75,000+…
The Rust project warned of an active social engineering campaign targeting Rust team members and popular crate maintainers. Attackers pose as recruiters or contractors, lure developers into video calls, then trick them into installing software or running pasted code to steal credentials and publish…
