What happened
The Department of Justice disclosed that Malaysian national Chui Kok Wa and five co‑conspirators orchestrated a cryptocurrency scam that promised returns on fictitious NFT investments. Victims in multiple U.S. states transferred a total of $516,695 to wallets controlled by the group. FBI agents, working with Madagascar police, seized more than 3,000 devices from 13 scam compounds in Antananarivo, documenting the workflow and linking the operation to Chinese collaborators. Law‑enforcement officials reported difficulty interviewing suspects and separating alleged human‑trafficking victims from paid participants.
Why it matters for trust and compliance
- The incident demonstrates why organizations must enforce a control objective around third‑party and supply‑chain risk management, ensuring continuous oversight of external actors that could be co‑opted for fraud.
- Map onboarding and monitoring of crypto‑related third parties to the VCF supply‑chain risk control.
- Collect and retain device‑access logs and contractual evidence to support audit readiness.
Who is affected
FIN_SERV
Recommended actions
- Review and strengthen third‑party due‑diligence questionnaires for crypto service providers.
- Implement continuous monitoring of external actors and retain forensic logs as evidence of oversight.