A crypto trader completed 8 smooth deals, then fell into a trap on the 9th because of a trick few people would expect — never create a crypto wallet in front of strangers. The case of a student allegedly losing VND 1.5 billion is a major warning:
Transaction method: Buying and selling cryptocurrency (USDT) through OTC transactions — direct trades conducted outside an exchange.
How the alleged scam and asset theft unfolded:
Meeting at a seemingly “safe” location: The group arranged to meet the victim, referred to as A, right outside a bank in Tan My Ward, District 7 — a busy place with security guards and many people around, making the victim less suspicious.
Secretly recording the wallet creation process: Inside the group’s car, they asked A to create a completely new crypto wallet on the spot.
A hidden camera had allegedly already been installed on the car ceiling to record the victim’s phone screen, including the 12-word wallet recovery phrase (seed phrase).Building trust over time: Over roughly a month and a half, the two sides met 8 times and completed 7 successful transactions, with amounts gradually increasing from VND 30 million to VND 500 million.
Each time, the USDT was transferred in full to the victim’s wallet, which led A to trust the group completely and continue using the same wallet address.
The VND 1.5 billion transaction:
During the VND 1.5 billion deal, 60,000 USDT was still transferred into A’s wallet, but the group deliberately did not send the network-fee token (TRX), saying A should pay the fee personally.
Meanwhile, they repeatedly asked to borrow the victim’s phone, allegedly to distract him.
As soon as the victim handed over the final portion of the cash, within just a few minutes, the entire balance in the wallet was withdrawn from another device using the 12-word seed phrase that had allegedly been secretly recorded earlier.
The person sitting in front of the victim was only handling the face-to-face transaction, while another individual allegedly withdrew the funds remotely.
Emergency details and the complaint submitted to the authorities:
Complaint process: On September 7 and September 11, 2026, the victim submitted complaints to the Inspectorate of the Ministry of Public Security, the Criminal Police Department under the Ministry of Public Security, and Ho Chi Minh City Police.
An updated complaint dated September 29, 2026 reportedly runs 95 pages, seeking an investigation into what the victim describes as an organized, professional and transnational criminal network.Serious nature and foreign involvement: The case allegedly involves several foreign nationals, including H, a Chinese citizen, as well as individuals identified as A, B, C, H and interpreter G, operating in Ho Chi Minh City, Khanh Hoa and Hanoi.
Risk of escape and destruction of evidence:
Some individuals allegedly showed signs of dispersing assets and deleting Telegram chat data. For example, D reportedly deleted data just 15 minutes after Lu Phu Linh was detained on July 22, 2026.
The group is allegedly still conducting transactions in Kim Lien Ward, Hanoi.
Some individuals may be at high risk of leaving Vietnam, and the victim has requested consideration of a temporary exit ban under Point a, Clause 1, Article 124 of the Criminal Procedure Code.
Threats against witnesses/victims:
Lu Phu Linh — the only individual reportedly handed over to investigators so far — and other members of the group allegedly know the victim’s identity and appearance.
On July 23, 2026, the alleged ringleader D reportedly sent a threatening Telegram message to Witness No. 3, including the message:
“Someone in your family has d**d.”
The victim has urgently requested protective measures under Chapter XXXIV of the Criminal Procedure Code.
#ScamAlert #FraudWarning #Investor #Crypto #OTC