Why it is called pig butchering
The term is a translation of the Chinese phrase sha zhu pan — 'pig butchering plate'. The metaphor is deliberate and cold: the victim is 'fattened' with attention, small profits and encouragement before the final loss. It describes a method, not a single scheme, and the same playbook is run by organised operations at industrial scale.
What separates it from ordinary investment fraud is duration and intimacy. Weeks or months pass before cryptocurrency is mentioned. That patience is what makes the eventual losses so large, and why victims frequently describe the relationship as the part that hurts most.
The stages of the long con
- First contact. A wrong-number text, a dating app match, a professional networking message or a friendly reply in a group chat. It rarely looks like an approach at all.
- Rapport. Daily conversation moves to WhatsApp, Telegram or Line. No money is discussed. Photographs, voice notes and video calls are used, and some operations now use synthetic media.
- Introduction. Investing is mentioned casually — a family contact with market access, an arbitrage desk, a mining or liquidity pool. The victim is invited to look, not to invest.
- Small win. A modest deposit is made and a withdrawal is permitted, quickly and in full. This single step converts scepticism into confidence more effectively than anything else in the sequence.
- Escalation. Larger deposits follow, often funded by savings, remortgaging or loans, with dashboard balances showing steady growth.
- The wall. Withdrawal is blocked. A tax charge, a compliance deposit, an anti-money-laundering bond or an account-upgrade fee must be paid first — and paying it produces another demand.
The platforms involved
The 'trading platform' is a website or app controlled entirely by the operator. The balance shown is a number in their database; it has no relationship to any market. Deposits leave for operator-controlled wallets within minutes of arriving.
- Cloned or invented exchange sites, often with a convincing app installed outside the official app stores via a configuration profile or direct download.
- Payment almost always in USDT, most often on Tron, because fees are negligible and transfers settle in seconds.
- Funds routed first through a personal wallet the victim controls, which is why victims frequently believe they sent money to their own account.
- Chat kept on encrypted messengers so the record can be deleted from the operator's side once the victim stops paying.
How the money moves afterwards
Pig butchering proceeds follow a recognisable pattern. Deposits are consolidated from many victims into a small number of collection addresses, then split across layers of intermediate wallets before reaching a service that can convert them to local currency.
- Rapid forwarding. Value leaves the deposit address within seconds or minutes, which indicates automated sweeping rather than a human counterparty.
- Consolidation. Several victims' deposits merge into one address — a strong clustering signal and often the point where the scale of an operation becomes visible.
- Peeling. Round-number amounts are split off repeatedly to complicate manual following, while the bulk of value stays on one dominant path.
- Cash-out. The trail usually terminates at a centralised exchange deposit address, an over-the-counter desk, a bridge to another network, or a dormant address.
Investigative steps in a pig butchering case
- Establish the starting point from your own records: withdrawal confirmations from the exchange or wallet you funded, with transaction hashes.
- Reconstruct the timeline, pairing each transfer with the message or dashboard instruction that prompted it. Fee demands after the withdrawal block matter as much as the original deposits.
- Follow the transfer graph hop by hop, recording amounts, timestamps and hashes so any third party can verify each step independently.
- Identify consolidation addresses and check whether they appear in other reported cases, which is what turns an individual loss into evidence of an operation.
- Classify each terminal branch — service deposit address, bridge, privacy protocol or dormant — and state the confidence for each link rather than implying certainty.
- Preserve the off-chain material: platform URLs, app download links, chat exports, profile photographs, and any documents or identification you submitted.
What tracing can and cannot establish
A trace can show where value went, how it was split, whether it merged with other victims' funds, and which service or mechanism it reached. That is what a bank fraud team, a solicitor or a reporting body can act on.
It cannot name the person behind an address from on-chain data alone, and it cannot reverse a confirmed transfer. Attribution requires off-chain information held by regulated services and released under legal process. Anyone promising an identity or a guaranteed return from a trace is describing something the technology does not permit.
If it is happening to you now
- Stop sending funds. A further payment never releases a blocked balance; it identifies you as someone who will pay again.
- Do not tell the other party you are investigating. It usually triggers immediate cash-out and deletion of the account.
- Export the chats and screenshot the dashboard, balances and withdrawal errors before access is removed.
- Report it. In England, Wales and Northern Ireland to Action Fraud; in Scotland to Police Scotland on 101. Tell your bank and the exchange you withdrew from, and keep every reference number.
- Revoke wallet approvals and move any remaining cryptocurrency to a newly created wallet if the platform ever had access to it.
Common questions
- What is a pig butchering scam?
- A long-running fraud in which a stranger builds a personal or professional relationship over weeks before introducing a fake cryptocurrency investment platform. Small withdrawals are allowed early to build trust, then larger deposits are encouraged and withdrawal is blocked behind fees.
- Why was I allowed to withdraw money at first?
- Permitting an early withdrawal is a deliberate part of the method. It costs the operator very little and it is the single most effective step in convincing a victim that the platform is real before larger sums are deposited.
- Can funds lost to a pig butchering scam be traced?
- The transfers themselves are permanently recorded and can be followed hop by hop to a terminal point such as an exchange deposit address, a bridge or a dormant wallet. Tracing establishes where value went; it does not reverse transfers or reveal who controls an address without off-chain information obtained through legal process.
- Should I pay the tax or release fee to get my balance out?
- No. The blocked balance is a database entry, not money held on your behalf. Each fee paid produces another demand, and further payments reduce what remains to be evidenced.
- Is it too late if the contact ended months ago?
- Often not. On-chain history is permanent, so the transfer trail remains available long afterwards, though funds are more likely to have been cashed out. Off-chain material degrades faster, so preserve whatever still exists.
Have a case you want reviewed?
We scope at intake and tell you honestly whether the on-chain data supports a traceable case.