Trust first, fake investment later: one victim allegedly lost $16 million

US prosecutors have described an investment-fraud case in which one person allegedly transferred approximately $16 million in cryptocurrency to a fake platform. The allegations concern a confidence scheme commonly called “pig butchering”: a criminal first develops a relationship and trust, then introduces an apparently exceptional investment.

The amount attracts attention, but the repeatable process is more important. The scam need not begin with an aggressive advert. It may start on a dating profile, with an apparently accidental text, through social media or as a friendly reply in a messaging app. Money may not enter the conversation for a long time.

What prosecutors allege

The US Department of Justice announced charges against 37-year-old Trung Nguyen Van on 25 September. The two-count money-laundering complaint was unsealed after his initial federal court appearance. Charges are accusations, not proof of guilt; responsibility must be determined in court.

According to the documents described by prosecutors, one victim transferred approximately $16 million in cryptocurrency between June and August 2024, believing they were investing through a platform called “Triangle.” One transfer of more than $569,000 was traced to the defendant’s wallet. The funds were then allegedly moved rapidly to a private wallet outside a centralised exchange.

Prosecutors further allege that wallets connected with the defendant received about $53.28 million in crypto assets from fraud schemes targeting US residents between February 2018 and 17 December 2024, and transferred about $53.19 million onwards. Other victims reported a similar sequence: online contact, a promise of high returns, transfers to a designated website and the eventual inability to withdraw their money.

Why a rising balance on a screen proves nothing

A fake platform can display any result because the figures need not represent genuine assets. Even a small initial withdrawal does not establish legitimacy. It may simply be the cost of building confidence before a much larger transfer.

When the victim tries to withdraw everything, another obstacle appears: a tax, verification fee, security deposit, account-tier requirement or penalty for a supposed mistake. A legitimate institution does not require more cryptocurrency to be sent to a private address to “unlock” the customer’s own funds.

The relationship, rather than the website, is often the strongest element. A fraudster may discuss family, work and plans every day, respond to emotions and even discourage a rushed investment. When money finally enters the conversation, the proposal comes from someone perceived as close or knowledgeable, not an anonymous advertisement.

Warning signs that should stop a transfer

Pause if a person known only online:

• moves the conversation to a private messenger and gradually isolates you from other opinions;
• claims access to a secret method, mentor or exceptional trades;
• directs you to a particular website or an app outside the official store;
• teaches you how to buy cryptocurrency and bypass warnings from a bank or exchange;
• shows personal results but avoids independent verification of the business;
• pushes for larger deposits after apparent gains;
• demands another payment before allowing a withdrawal;
• says not to discuss the opportunity with family, a bank or an adviser.

One sign does not always prove fraud. The combination of an online-only relationship, a controlled platform, guaranteed returns and an extra withdrawal fee is enough reason not to send more money.

What to do after money has already been sent

Stop further transfers. Do not pay a “tax,” “insurance charge” or “AML fee,” even if the screen shows a large balance. Avoid telling the scammer everything you plan to do because accounts, conversations and sites may be removed.

Preserve evidence: the full chat history, profile and site addresses, wallet addresses, transaction identifiers, purchase confirmations, phone numbers, email addresses and payment instructions. A conversation export is better than a few selected screenshots, but do not install a tool recommended by the contact to create one.

Contact the bank, exchange or payment provider used to send the funds as quickly as possible. A blockchain transaction usually cannot be reversed like a bank transfer, but rapid reporting may help flag an address, freeze funds that reach a custodial platform and preserve records for law enforcement.

Report the case to police or the appropriate cybercrime authority. Do not delete accounts or conversations before preserving evidence. Use the official reporting service for the relevant country rather than a contact supplied by someone offering recovery.

A second scam often follows the first

Information about someone who has already paid is valuable to other criminals. They may pose as a law firm, investigator, “blockchain expert,” government agency or exchange employee and offer to recover the funds for an upfront fee. Access to details from the original case makes them sound credible.

No unsolicited helper should receive remote access to a device, a private key, seed phrase or sign-in code. A promise of guaranteed crypto recovery is a warning sign. Assistance should be verified independently, starting with the bank, exchange and law-enforcement agency.

Family and colleagues should respond without ridicule. Shame encourages victims to hide additional payments and delay seeking help. Calm questions about platform verification, an independent withdrawal and the origin of the relationship are more effective than an immediate accusation.

Why companies should teach this even when personal money is involved

The scheme may enter through an employee’s personal phone, but the consequences do not always remain private. A person under pressure might use corporate email, share a work screen, install software, borrow money or use business information to verify an identity. A criminal who has built trust may also change the objective and request a work document or access.

A security programme should explain long-term relationship building, not just suspicious links. Employees need a confidential route to ask for help assessing a site or conversation without fear of ridicule. A company should not investigate private life, but it can help separate corporate devices, accounts and data from an ongoing scam.

Source facts and Breachroad’s conclusions

The US Department of Justice describes the charges, confidence-building pattern, approximately $16 million transferred by one victim, flows through specified wallets and similar accounts from other victims. The DOJ explicitly states that the charges are accusations and not evidence of guilt.

The warning-sign checklist, evidence-preservation plan, recovery-scam warning and guidance for organisations are Breachroad’s conclusions. Our related guides explain romance and investment scam warning signs and recovery scams after losing money. Organisations can discuss such scenarios without blaming victims through cybersecurity awareness training.