Skip to content

Pig butchering

Long-trust fraud engineered for crypto off-ramps

Pig butchering merges relationship grooming with fake investment apps—often over weeks—before victims drain savings through guided transfers.

Assess Your Case

What pig butchering is

The term describes scams where operators cultivate personal trust—often via messaging apps—before introducing a proprietary trading or mining platform.

Victims believe they are building wealth together; balances on the app are fictional while real crypto moves to operator wallets.

Cases frequently cross borders, with chat personas, customer support, and app backends operated as an integrated campaign.

Stages operators use

  1. 01

    Contact & rapport

    Unexpected friendly messages that shift from small talk to daily intimacy and mirrored life stories.

  2. 02

    Credibility gifts

    Small successful withdrawals from the fake platform to prove the relationship is financially safe.

  3. 03

    Platform introduction

    A branded app or web portal with live chat support and VIP account managers.

  4. 04

    Escalating deposits

    Guided transfers from bank, exchange, or wallet with remote coaching on bypassing warnings.

  5. 05

    Extraction

    Tax, AML, or union-fee narratives block exits until victims stop paying; operators vanish or ghost.

  6. 06

    Re-targeting

    Secondary recovery scams targeting the same victims under new brands.

Indicators specific to pig butchering

  • Met on WhatsApp, Telegram, or dating apps but never verified video calls matching profile photos
  • Introduced to a crypto platform not listed on major app stores without independent audit
  • Coach insists on transferring in stages to avoid bank or exchange alerts
  • Dashboard profits rise but withdrawals always require another fee
  • Support chat and romantic contact share similar scripting or timezone inconsistencies
  • Urged to borrow funds or liquidate retirement after emotional crises manufactured in chat

How victim funds move

Transfers are coached in real time; operators optimize for speed to their treasury before victims consult third parties.

  • — Victims send from licensed exchanges to fresh addresses supplied in chat
  • — Mule wallets peel funds through swaps within minutes
  • — Stablecoins route to exchange deposits in Asia-facing or offshore clusters
  • — Some campaigns reuse the same deposit address across multiple victims in a cohort
  • — App displayed balances never exist on-chain—they are database entries only

Critical evidence

  • Complete chat exports with metadata
  • App APK/IPA files and install sources
  • Every TXID victims sent under operator instruction
  • Support ticket transcripts and fee payment receipts
  • Bank wire SWIFT references if fiat was used

Our investigative angles

01

App & domain infrastructure

Map backend hosts, TLS certificates, and support portals tied to the fake platform.

02

Wallet cohort analysis

Cluster victim outflows to shared operator wallets and downstream exchanges.

03

Persona OSINT

Compare photos, handles, and phone numbers across victim statements for reuse.

04

Coaching timeline

Align chat pressure events with on-chain spikes to demonstrate orchestration.

If you are in an active pig butchering situation

  • 01Stop sending money—even if promised release after one last fee
  • 02Do not install remote access tools at the request of chat contacts
  • 03Export chats and transaction records before accounts are deleted
  • 04Warn friends if recruiters asked you to bring others into the platform
  • 05Speak with licensed professionals before paying any recovery advance fee

Never provide a seed phrase, private key, or authentication code to anyone claiming they can recover funds—including parties who contact you unsolicited. Legitimate investigators do not need wallet secrets to begin a case review.

Services commonly engaged

Frequently asked questions

Is the trading app ever real?

Displayed trades are simulated; only your deposits are real on-chain.

Why did early withdrawals work?

Small payouts are a trust-building tactic before larger extractions.

Can tracing still help after months?

Visibility depends on chain paths and exchange cooperation—not time alone.

Should I confront the persona?

Confrontation can trigger account locks; preserve evidence first.

Investigate a pig butchering loss

Document chats and TXIDs for assessment—we never ask for seed phrases.

Assess Your Case