The United States Federal Bureau of Investigation (FBI) has uncovered a sophisticated cyber fraud scheme that targeted donors to the Trump-Vance 2025 Inaugural Committee, with a Nigerian national at the centre of the operation.
Ehiremen Aigbokhan, a Lagos-based internet fraudster, is accused of orchestrating a cryptocurrency scam that diverted more than ₦460 million meant for the high-profile swearing-in of U.S. President Donald Trump.
The FBI has filed a civil forfeiture complaint before a U.S. District Court, seeking to seize digital assets linked to the crime, while an arrest warrant has also been issued for Mr Aigbokhan. He is wanted for alleged wire fraud, money laundering, and a Business Email Compromise (BEC) scheme that exploited donors’ trust and digital vulnerabilities.
How the heist happened
According to court documents obtained by PM News, Mr Aigbokhan and his collaborators spoofed official email addresses of Trump’s inauguration team to trick unsuspecting contributors.
In one instance, a fake email address @t47lnaugural.com was used to impersonate the co-chair of the inaugural committee, Steve Witkoff. The real email ends with @t47inaugural.com — a detail only distinguishable by the replacement of an uppercase “I” with a lowercase “L”.
On December 26, 2024, the fraudulent email convinced a U.S. donor to transfer 250,300 USDT.ETH, a dollar-pegged cryptocurrency hosted on the Ethereum blockchain. At the time, this amount was valued at over ₦400 million using the prevailing black market rate.
The fraudsters quickly dispersed 215,000 USDT.ETH across multiple wallets in an attempt to obscure the funds.
However, the FBI detected the unusual flow of funds and, working in collaboration with crypto firm Tether, froze the implicated accounts on December 31, 2024, successfully stalling further movement of the stolen digital assets.
FBI links crime to Lagos
Digital forensic investigations led federal agents directly to Lagos, Nigeria, where Mr Aigbokhan operated.
IP logs, email metadata, and blockchain transaction history confirmed that login activities for the spoofed email addresses consistently originated from Lagos.
A major breakthrough in the case came when investigators traced one of the wallets receiving the stolen funds to a Binance.com account created by Aigbokhan in October 2024.
That account, according to the FBI, had no prior transaction history until it received a portion of the defrauded crypto, strongly indicating it was set up solely to launder the proceeds of the scam.
Over ₦60 million in crypto frozen
The U.S. Department of Justice has since seized 20,017 USDT.ETH from Mr Aigbokhan’s wallet and another 20,336 USDT.ETH from a second connected wallet, identified as 0xC7bdBA7ffB126F68E8454C.
Together, the frozen crypto assets amount to over ₦60 million at current market rates. The FBI is now pursuing a civil forfeiture order from a U.S. federal court to permanently seize the funds.
“This case highlights the evolving nature of global fraud and the necessity for cross-border cooperation to dismantle these schemes,” said Assistant U.S. Attorney Rick Blaylock Jr., who is prosecuting the case from the District of Columbia.
Extradition unclear as Aigbokhan remains at large
As of press time, Mr Aigbokhan remains at large, and U.S. officials have not confirmed whether Nigerian authorities have been officially contacted to initiate extradition proceedings.
The FBI stated that active steps are ongoing to locate and apprehend Mr Aigbokhan and any possible accomplices tied to the case.
The incident is being described as one of the most audacious international cyber scams linked to a U.S. presidential event in recent times.
Nigeria’s growing cybercrime spotlight
Meanwhile, the Trump inauguration scam joins a list of high-profile cross-border frauds involving Nigerian actors.
Global warning for digital donors
The breach has sparked fresh calls for stricter cybersecurity measures in political fundraising and digital transactions.
Donors and organizations are being advised to double-check recipient details, verify communication sources, and maintain tighter scrutiny around email correspondence and crypto addresses, especially ahead of sensitive events.
