DOJ Filing Shows MoonPay Executives Sent $250,000 to Nigerian Scammer

A recent Department of Justice (DOJ) filing seeking to recover fraudulently obtained cryptocurrency has shed light on a sophisticated scam that may involve high-profile victims from the crypto industry.

According to a report by NOTUS, the filing suggests that the CEO and CFO of MoonPay, a prominent crypto payment firm, were targeted in a scheme that led to the loss of $250,300 in USDT. The DOJ is now moving to seize approximately $40,350 in frozen USDT as part of its efforts to address the fraud. The case highlights the persistent risks of deception in the crypto space, even for seasoned industry leaders.

The filing details how two individuals, identified only as “Ivan” and “Mouna,” sent $250,300 in USDT to a scammer posing as Steve Witkoff, co-chair of President Trump’s inaugural committee. NOTUS connected these pseudonyms to MoonPay’s CEO, Ivan Soto-Wright, and CFO, Mouna Ammari Siala, based on their names and a wallet linked to the transaction. Blockchain records from Etherscan further tie the wallet to MoonPay, strengthening the case that the executives were the victims. A separate 2023 lawsuit also alleged that Soto-Wright used the same wallet to fund a personal account, adding another layer of intrigue to the incident.

Details of the Scam and Investigation

Unlike complex onchain exploits often seen in crypto fraud, this scam relied on a straightforward yet effective tactic. The scammer used an email address, steve_witkoff@t47lnaugural.com, with a lowercase “L” in place of a capital “I” to mimic a legitimate address. This subtle trick, common in phishing schemes, exploits the visual similarity between the two letters in many fonts. A second email, financersvp@t47lnaugural.com, employed a similar tactic to deceive the victims. The DOJ filing notes that IP geolocation data traced these emails to Nigeria, not the United States, pointing to an international operation.

Binance records revealed that the wallet receiving the funds was registered to Ehiremen Aigbokhan, an individual based in Lagos, Nigeria. The DOJ alleges that Aigbokhan received an international transfer of funds as a result of this fraudulent activity. Tether, the issuer of USDT, has frozen approximately $40,350 of the stolen funds, which the DOJ now seeks to recover. This seizure underscores the growing cooperation between crypto firms and law enforcement to combat fraud, though recovering the full amount remains uncertain.

The scam’s simplicity is a stark reminder of the vulnerabilities in digital communications, even for those well-versed in crypto. MoonPay, a platform known for facilitating crypto transactions, has not publicly commented on the incident, leaving questions about how its executives were targeted. The use of a fake email mimicking a high-profile figure like Witkoff suggests the scammer carefully crafted their approach to exploit trust. This case adds to the growing list of frauds leveraging impersonation tactics in the crypto ecosystem.

The DOJ’s filing marks a significant step in addressing crypto-related fraud, but it also raises concerns about privacy and security for industry leaders. By inadvertently revealing the victims’ identities, the filing has sparked discussions about the balance between transparency in legal proceedings and protecting individuals’ privacy. For MoonPay, the incident could prompt a review of internal security protocols to prevent similar attacks in the future. As the crypto industry matures, such cases highlight the need for robust safeguards against both sophisticated and simplistic scams.