A rising balance can be fake: U.S. crypto-fraud case describes the trap
Source report: 2026-10-23 · Editorial analysis published: 2026-10-24
An October 23 Justice Department announcement reports Zheng Zhao’s extradition and court appearance. Prosecutors describe fake trading sites and 174 identified U.S. victims; the allegations remain unproven.
A new court appearance, an old-looking promise
The U.S. Justice Department said on October 23 that Zheng Zhao, 44, had appeared in federal court in California after extradition from the Netherlands. Prosecutors allege that he participated in an international cryptocurrency-investment scheme operated from scam centres in Cambodia. The announcement says investigators identified 174 U.S. victims. These are allegations; a criminal complaint is not a guilty verdict.
The mechanism described is familiar to anyone who has seen an unusually convincing investment dashboard. Prosecutors say people were contacted through unsolicited messages, calls, social media and dating services. Trust came first. A supposed investment opportunity, supported by a website resembling a genuine crypto-trading platform, came afterward.
Extradition means a person is transferred between countries to face proceedings. It does not settle the truth of the charges. The October 23 event is the reported court appearance after that transfer; the release should not be read as saying every alleged transaction happened that day or that a trial has already established responsibility.
A number on a website is not your money
According to the announcement, victims were told their investments were growing even though the money had been stolen. A rising balance can therefore be part of the sales pitch rather than evidence of a successful trade. A website can display a number without holding the assets it claims the number represents.
The practical distinction matters for people receiving mining rewards too. A pool's reported balance, a payment it has sent and coins visible at your receiving address describe different stages. None of those should be confused with a stranger's investment page promising to multiply the proceeds. This case concerns alleged investment fraud; the release does not identify a mining pool or cloud-mining product as the scheme.
A useful check separates what a service says from an independently visible transfer. Even an authentic payment history cannot certify the honesty of a different investment service using a similar name. The decision to transfer mining proceeds remains a separate decision about the recipient; it is not an automatic continuation of the work your device performed.
What the money trail establishes—and what it does not
The Justice Department says more than $36.9 million in victim funds moved from U.S. accounts controlled by alleged co-conspirators to one bank account in the Bahamas. It alleges the funds were converted to Tether, or USDT, and sent to a digital-asset wallet controlled in Cambodia before further transfers to scam-centre leaders.
USDT is a token designed to track the U.S. dollar, commonly called a stablecoin. A dollar-linked price does not verify the identity or honesty of the person receiving it. The reported $36.9 million describes a specified flow of victim funds; it should not be presented as a recovered amount, a payout to victims or a court-proven total loss.
Following a public blockchain transfer and identifying the human controlling an address are different tasks. A visible transaction can help describe where tokens moved without proving every claim made in a chat. The allegations about accounts and organizers come from the investigators’ case; this article has not independently identified the wallet owners or recovered the funds.
A useful pause before the next transfer
For a miner considering what to do with payouts, the simplest lesson is to check the destination independently. Reach an established service through its known address, rather than a link supplied by a new online acquaintance. A polished logo, personal attention and a large displayed profit do not establish who controls the account or whether a withdrawal will happen.
If a suspected fraud has already occurred, keep the messages, website addresses, transfer records and transaction identifiers. A transaction identifier helps trace a blockchain payment; it is not a recovery key or a guarantee that money can be returned. The announcement directs digital-asset investment-fraud victims to IC 3.gov. It does not promise an automatic refund or require sending another payment to unlock one.
Keep recovery records separate from wallet secrets. A website address or transaction identifier documents what happened; a private key or recovery phrase can authorize spending. A person asking for those secrets is asking for a different level of access. Evidence preservation does not mean uploading the means to control your wallet to a supposed helper.
Read the victim count within its scope
The 174 figure is the number of U.S. victims the government says it identified. It is not a count of every person affected worldwide, every account on a platform or people who have already received compensation. Those would require separate evidence.
For a reader, the useful connection to mining is protection of the proceeds, not an allegation that mining itself caused this case. A miner can perform real work and receive real coins, then still lose them to a separate fake investment offer. Keep that later decision visible instead of letting a genuine mining payment lend credibility to an unrelated promise.
Source: U.S. Department of Justice ↗
Mining calculator ↗
