🐷 Pig Butchering Scams: How They Work and How to Trace One (2026)

At a glance: pig butchering in five facts

What does "pig butchering" mean?

"Pig butchering" is a translation of the Chinese term Sha Zhu Pan. It names a virtual-currency investment scam in which the scammer first wins the victim's confidence and then takes their money through a fake investment FinCEN Alert FIN-2023-Alert005 (8 Sep 2023). FinCEN explains the metaphor: scammers call victims "pigs", use "fictitious identities, the guise of potential relationships, and elaborate storylines" to "fatten up" the victim, and call the theft "butchering" or "slaughtering" FinCEN Alert FIN-2023-Alert005 (8 Sep 2023).

FinCEN notes that these scams "may also be referred to, or begin as, 'confidence scams' (or in certain cases 'romance scams')" FinCEN Alert FIN-2023-Alert005 (8 Sep 2023). The FBI's own name for the crime type is cryptocurrency investment fraud. It describes these as "sophisticated long-term scams using psychological manipulation, the appearance of legitimacy, and exploitation of cryptocurrencies" FBI IC3, 2025 Internet Crime Report (PDF).

A note on the name. In December 2024 INTERPOL urged an end to the term. It called it "widely used but stigmatizing", said it "dehumanizes and shames victims", and proposed "romance baiting" instead INTERPOL (17 Dec 2024). This guide uses "pig butchering" because that is what people search for and what the FinCEN alert is called. The shame belongs to the criminals, not the people they target.

How does a pig butchering scam work, from start to finish?

FinCEN's 2023 alert splits the scheme into four stages FinCEN Alert FIN-2023-Alert005 (8 Sep 2023). The FBI's 2025 report describes the same arc, with one more step at the end: victims are "also targeted in recovery scams" FBI IC3, 2025 Internet Crime Report (PDF).

1. Contact. A text, social-media message or dating match, often framed as a wrong number or an old friend.
2. Trust. Weeks of friendly or romantic chat. The profile shows wealth and a lifestyle worth wanting.
3. Pitch. An "insider" tip on crypto or gold, and a link to a trading website or app.
4. Fake profits. The dashboard shows big gains. A small withdrawal may go through to build confidence.
5. Squeeze. Bigger deposits, loans, a deadline. Then "taxes" or "fees" before any withdrawal. Then silence.
6. Second wave. A "lawyer", "recovery firm" or fake official offers to get the money back, for a fee.

1. Initial contact. The scammer reaches out "through text messages, direct messages on social media, or other communication tools and platforms, usually under the guise of accidentally reaching a wrong number or trying to re-establish a connection with an old friend". They may pose as an investor or money manager with a profile "which showcases wealth and an enviable lifestyle" FinCEN Alert FIN-2023-Alert005 (8 Sep 2023). The FBI adds advertisements and dating apps as entry points, followed by a quick move to a messaging app FBI IC3, 2025 Internet Crime Report (PDF).

2. The "investment" pitch. Once trust is built, the scammer introduces "a supposedly lucrative investment opportunity" on websites or apps "designed to appear legitimate, but which are fraudulent and ultimately controlled or manipulated by the scammer". They may ask for remote access to the victim's device, coach them through buying crypto on a real exchange, or push them to a crypto kiosk FinCEN Alert FIN-2023-Alert005 (8 Sep 2023). In 2025 the FBI also saw victims "introduced to investment groups" posing as industry insiders who give guidance on crypto or gold FBI IC3, 2025 Internet Crime Report (PDF).

3. The promise of greater returns. The platform shows "extraordinary returns on the investment that have been fabricated". A small withdrawal may be allowed "to further build the victim's confidence" FinCEN Alert FIN-2023-Alert005 (8 Sep 2023). The FBI says victims "are shown fake profits and offered loans to encourage larger investments" FBI IC3, 2025 Internet Crime Report (PDF). FinCEN reports that victims have cashed out tax-advantaged accounts and taken home equity lines of credit and second mortgages to invest more FinCEN Alert FIN-2023-Alert005 (8 Sep 2023).

4. The point of no return. When deposits slow, the scammer claims losses that need topping up. If the victim tries to withdraw, "the scammer may demand that the victim pay purported taxes or early withdrawal fees". When the victim can't or won't pay more, "the scammer will abruptly cease communication" FinCEN Alert FIN-2023-Alert005 (8 Sep 2023).

It is not only individuals who get caught. In August 2024 a former bank CEO in Elkhart, Kansas, was sentenced to 293 months in prison for embezzling $47.1 million of Heartland Tri-State Bank's money, sent in 11 wires to a crypto wallet between May and July 2023. The FBI described his get-rich-quick plan as "a pig butchering scheme". The bank failed US Attorney, District of Kansas (19 Aug 2024).

What are the red flags of a pig butchering scam?

No single sign proves a scam, but each stage has its own tells. The table maps the stages above to warning signs taken from FinCEN's red-flag indicators FinCEN Alert FIN-2023-Alert005 (8 Sep 2023), FBI warnings FBI PSA I-100322-PSA (3 Oct 2022) FBI IC3, 2025 Internet Crime Report (PDF) and FTC advice FTC: cryptocurrency and scams (checked 10 Oct 2026) FTC: romance scams (checked 10 Oct 2026).

Family members often notice the money signs first. FinCEN lists a customer who "appears distressed or rushed to access funds", sudden large transfers to crypto exchanges by someone with no crypto history, and buying crypto at a kiosk to deposit to an address a new contact supplied FinCEN Alert FIN-2023-Alert005 (8 Sep 2023).

How much money do people lose to pig butchering?

No official figure counts "pig butchering" by that name each year. The closest US measure is the FBI IC3 category cryptocurrency investment fraud. Figures below are complaints reported to IC3, not all losses.

Outside the US, UNODC reports that countries in East and Southeast Asia "combined have lost up to an estimated US $37 billion to cyber-enabled fraud" in 2023 UNODC, Inflection Point, technical policy brief (Apr 2025). It also cites an estimated $4.4 billion of US losses in 2023 attributed to pig butchering UNODC, Inflection Point, technical policy brief (Apr 2025).

Who is behind pig butchering? Scam compounds and forced labour

The person texting a victim is often a victim too. FinCEN says these scams "are largely perpetrated by criminal organizations based in Southeast Asia" and that "a significant number of scammers who contact victims are likely victims themselves of human and labor trafficking rings" FinCEN Alert FIN-2023-Alert005 (8 Sep 2023). The FBI's 2025 report says the same: organised crime groups based in Southeast Asia use "victims of human trafficking as forced labor to run the scam operations" FBI IC3, 2025 Internet Crime Report (PDF).

How people end up in the compounds. The FBI warned in May 2023 that recruiters post false job adverts on social media and job sites, then change the job location. On arrival, workers' passports are taken. They are "held against their will, intimidated, and forced to commit international cryptocurrency investment fraud schemes", given debts for travel and board, and sometimes "sold and transferred between compounds" FBI PSA I-052223-PSA (22 May 2023). The US Treasury describes the same pattern: fake tech or customer-service jobs, then confiscated passports, debt bondage, physical violence and threats of forced prostitution, with daily quotas to target Americans US Treasury press release (23 Jun 2026).

The scale. UNODC's April 2025 brief describes "hundreds of large-scale scam operations conservatively generating tens of billions of dollars in annual profits". These run on "multi-lingual workforces comprised of hundreds of thousands of trafficked victims and complicit individuals", and the groups are expanding into Africa, South Asia, the Middle East and Pacific islands UNODC, Inflection Point, technical policy brief (Apr 2025).

Sanctions and seizures. On 14 October 2025 the US Treasury designated the Cambodia-based Prince Group as a Transnational Criminal Organization, sanctioning 146 targets. Alongside it, FinCEN cut the Huione Group off from the US financial system. Treasury says Huione laundered at least $4 billion in illicit proceeds between August 2021 and January 2025 US Treasury press release (14 Oct 2025). The same day, the Justice Department unsealed an indictment of Prince Group chairman Chen Zhi and filed to forfeit about 127,271 bitcoin, worth roughly $15 billion. It called this the largest forfeiture action in its history. Prosecutors describe the compounds as "violent forced labor camps" US DOJ press release (14 Oct 2025). On 23 June 2026 Treasury sanctioned 35 more Prince Group-linked targets US Treasury press release (23 Jun 2026).

What is a crypto recovery scam, and why does it come next?

After the first loss, many victims are targeted again by people who offer to get the money back. The FTC says scammers buy lists of people who have already paid scammers. They then pose as a government agency, consumer group or law firm and ask for a "retainer fee", "processing fee" or "tax" FTC: refund and recovery scams (checked 10 Oct 2026). The FBI warned in June 2024 about fictitious law firms contacting crypto scam victims. Some claimed to have information from the FBI or other agencies, and victims reported losing more than $9.9 million to these follow-on schemes between February 2023 and February 2024 FBI PSA I-062424-PSA (24 Jun 2024).

Its August 2025 warning lists the signs FBI PSA I-081325-PSA (13 Aug 2025):

• They know the exact amounts and dates of your past transfers, and say you are on a government list of scam victims.
• They claim official partnership with a government or regulator, or cite one that doesn't exist (the FBI's example is an "International Financial Trading Commission").
• They want payment in crypto or gift cards, or ask you to open an account at a foreign bank whose website is fake.
• They add you to group chats where "bankers" or "attorneys" demand fees to verify your identity.
• They won't show a licence or join a video call.

The rules are simple. "The US Government does not request payment for law enforcement services provided", and "there are no law firms which are officially authorized partners of US Government agencies" FBI PSA I-081325-PSA (13 Aug 2025). "Law enforcement does not charge victims a fee for investigating crimes" FBI PSA I-062424-PSA (24 Jun 2024). The IC3 "will never directly contact you for information or money" and "does not work with any non-law enforcement entity" to recover funds IC3 home page (checked 10 Oct 2026). The FTC's advice: "Never pay upfront for a refund or help with a refund" FTC: refund and recovery scams (checked 10 Oct 2026).

That rules out any service that charges an upfront fee and promises to "hack back" or "trace and recover" your crypto. A legitimate lawyer you choose yourself is a different thing from someone who contacts you first. Check the person and firm independently before you share anything.

What evidence should a victim save?

Save evidence before you block anyone or delete anything. Scammers often delete chats and take sites offline. IC3 asks for how the contact began, the person's identifiers, and full transaction details: "date, payment type, amount, account numbers (including cryptocurrency wallets)", the receiving institution, and receiving cryptocurrency addresses FBI PSA I-100322-PSA (3 Oct 2022). The FBI also advises keeping records of all interactions FBI PSA I-081325-PSA (13 Aug 2025).

• Chats: export full conversations (WhatsApp, Telegram and most apps have an export option), plus screenshots that show the sender's handle, number and timestamps.
• Identity used: profile photos, names, usernames, phone numbers and email addresses. Save the photos as files for reverse image search.
• The platform: the exact web address (domain) of the trading site or app, screenshots of your "balance" and of any fee or tax demand, and where the app was downloaded from.
• Money out: bank and card statements, wire receipts, crypto kiosk receipts, and exchange withdrawal records.
• Crypto: every wallet address you sent to, every transaction hash (the long ID of each transfer), the coin and network (for example USDT on Tron), the amount and the date and time.
• Recovery contacts: anyone who later offered to recover funds. Keep their messages too. They belong in the same report.

Keep originals in one folder and a written timeline with dates. The evidence logger can hash files and keep a timestamped case log in your browser, which helps if you later hand the material to police or a journalist.

How can you check whether a trading platform is fake?

FinCEN's technical red flags are a checklist for the fake site: poor spelling, generic or fake-looking testimonials, amateur design, a domain that imitates a real business, a recently registered web address, no physical address, chat or email as the only contact, and an app from a third-party website instead of a well-known store FinCEN Alert FIN-2023-Alert005 (8 Sep 2023). The FBI also warns of domain names that copy real exchanges, so watch for misspellings FBI PSA I-100322-PSA (3 Oct 2022).

In practice:

1. Run the domain through the website legit checker for registration age, hosting and lookalike signals.
2. Check the domain's registration history with WHOIS history. A trading "company" whose site is weeks old is a strong warning sign.
3. Search the exact domain and app name together with "scam". Other victims often post the same platform.
4. Note that a real exchange can be part of the scam too. FinCEN describes scammers coaching victims to buy crypto on legitimate services and then send it to the fake platform FinCEN Alert FIN-2023-Alert005 (8 Sep 2023). The exchange you used is a reporting channel (see below), not proof that the platform was real.

Domains matter to investigators. In a case FinCEN summarises, a court authorised the seizure of seven spoofed domains used against five US victims who lost over $10 million FinCEN Alert FIN-2023-Alert005 (8 Sep 2023).

Can you trace pig butchering crypto on the blockchain?

Partly. Public blockchains let anyone follow money from address to address. They do not show who owns an address. Here is what a victim or reporter can and cannot do.

USDT on Tron. Many victims are told to buy the stablecoin Tether (USDT) and send it on the Tron network (TRC20). Tether's own page lists Tron among the networks it issues USDT on Tether, issuer page: supported protocols (checked 10 Oct 2026). UNODC reported in January 2024 that "USDT on the TRON blockchain has become a preferred choice for regional cyberfraud operations and money launderers alike due to its stability and the ease, anonymity, and low fees of its transactions" UNODC, Casinos, Money Laundering, Underground Banking and TOC in East and Southeast Asia (Jan 2024). FinCEN also lists converting large amounts of ether to TRX and moving it quickly off an exchange as a red flag FinCEN Alert FIN-2023-Alert005 (8 Sep 2023).

What law enforcement can do with tracing. In June 2025 the Justice Department filed to forfeit more than $225.3 million in crypto. It traced the funds using "blockchain analysis and other investigative techniques" through a laundering network of hundreds of thousands of transactions, linked them to more than 400 suspected victims, and thanked Tether for its "proactive assistance" US DOJ press release (18 Jun 2025). That is the realistic path to recovery: your report, with addresses and hashes, joined to a law enforcement case. It does not come from a paid "tracer" who contacts you first.

Act fast on bank transfers. If you sent a bank wire to buy crypto or to a "holding company", call your bank immediately and ask for a recall. Then file at IC3 with full transaction details. The IC3 Recovery Asset Team works with banks to freeze funds and reported $679,013,183 frozen in 2025 FBI IC3, 2025 Internet Crime Report (PDF). That process runs through banks, so it doesn't apply to crypto that has already left your wallet.

How do you check who you are really talking to?

Scammers use stolen or AI-generated photos, throwaway numbers and fake profiles. The FTC's first tip for spotting a romance scammer is to "do a reverse image search of the person's profile picture". If the photo turns up under another name, that's a warning sign FTC: romance scams (checked 10 Oct 2026). The FBI says investment scammers "often use AI to enhance their conversations with potential victims", and investment clubs use AI-generated videos and voices of celebrities and trusted figures FBI IC3, 2025 Internet Crime Report (PDF).

• Reverse image search: run the profile photo through several engines at once. Stolen photos often belong to a real person with a different name.
• Face finder: compare a set of photos the scammer sent against each other, in your browser, to see whether they show the same person.
• Reverse phone lookup: check the number the first text came from.
• Email lookup: check any email address used by the person or the "platform".

A match proves the profile is fake. No match proves nothing. Never confront the scammer with what you find. Put it in your report.

Where do you report a pig butchering scam?

Report even if the amount is small or you're unsure it counts. The IC3 asks people to "file a report even if you are unsure of whether your complaint qualifies" IC3 home page (checked 10 Oct 2026). All entries below were checked on official pages on 10 October 2026.

If an official contacts you about your case, check them by calling the agency's local office on a number you look up yourself FBI PSA I-081325-PSA (13 Aug 2025) FTC: refund and recovery scams (checked 10 Oct 2026).

How do you support someone who lost money to pig butchering?

These scams are run by organised groups with scripts and trained staff, and they cause "financial and emotional harm" FinCEN Alert FIN-2023-Alert005 (8 Sep 2023). The FBI calls them "devastating" because they leave victims with "significant financial loss and emotional distress" FBI IC3, 2025 Internet Crime Report (PDF). Many victims don't realise it's a scam until someone tells them. When the FBI's Operation Level Up contacted 3,780 crypto investment fraud victims in 2025, 78% were unaware they were being scammed FBI IC3, 2025 Internet Crime Report (PDF). INTERPOL warns that shame stops victims "coming forward to seek help" INTERPOL (17 Dec 2024).

Related OSINT Tools & Guides

Crypto Wallet Lookup Website Legit Checker Reverse Image Search Face Finder Reverse Phone Lookup Email Lookup WHOIS History Evidence Logger