Pig Butchering Crypto Scams: How They Work and What to Do

A pig butchering scam is a fake relationship that turns into a fake investment. The scammer builds trust over weeks, steers you to a trading site they control, shows invented profits, and then blocks withdrawals until you stop paying. An AML check can flag the receiving address, but it cannot reverse the payment, so the real defence is to spot the pattern before you send anything.

Where the name comes from

FinCEN, the US Treasury's financial intelligence unit, explained the term in a September 2023 alert. Scammers call victims "pigs" and talk about "fattening" them with trust before the "butchering", when the money is taken.^[1] The FBI describes the same scheme as cryptocurrency investment fraud: a confidence scam where the victim is coached to invest more into a platform that looks very profitable, then cannot withdraw.^[2]

FinCEN says these scams are largely run by criminal organizations based in Southeast Asia. Many of the people sending the messages are themselves victims of labor trafficking.^[1]

How the scam works

FinCEN describes four stages.^[1]

1. First contact. A text, social media message or dating-site match, often framed as a wrong number or an old friend. The profile often shows wealth and an easy lifestyle.
2. The pitch. After trust is built, the contact mentions a crypto opportunity and sends you to a website or app that looks real but is controlled by the scammer. They may ask for remote access to your device or walk you through buying crypto step by step.
3. Fake returns. The site shows large gains. You may be allowed to withdraw a small amount, which makes the next deposit feel safe.
4. The end. When you try to take money out, you are told to pay "taxes" or "early withdrawal fees". Once you stop paying, the contact disappears.

The FTC puts it simply: never mix online dating and investment advice. If someone you met online asks you to send crypto or offers investment tips, it is a scam.^[3]

How big the problem is

In 2024, the FBI's Internet Crime Complaint Center (IC3) received 41,557 complaints about cryptocurrency investment fraud, with $5.8 billion in reported losses. Losses were 47% higher than in 2023. People over 60 reported the largest share, about $1.6 billion.^[2]

The US government has started to target the networks behind the scams:

• Funnull Technology. In May 2025 OFAC sanctioned this Philippines-based company. Treasury says it provided infrastructure for hundreds of thousands of pig butchering websites. US victims of those sites reported over $200 million in losses.^[4]
• Prince Group. In October 2025 OFAC designated 146 targets in this Cambodia-based network. Treasury says it ran at least ten scam compounds where workers were held against their will.^[5] The Justice Department indicted its chairman, Chen Zhi, and filed to forfeit about 127,271 bitcoin, which it called the largest forfeiture action in its history.^[6]

How stolen USDT moves

FinCEN lists bitcoin, ether, USDT and TRX among the assets used in these scams.^[1] Your deposit does not go into an "investment account". It goes to addresses controlled by the scammers and their co-conspirators.

From there the funds are spread out quickly. In one case FinCEN cites, deposits went straight through numerous private wallets and swapping services to hide their source.^[1] FinCEN also flags a pattern where a large amount of ether is swapped on an exchange into a coin with lower fees, such as TRX, and sent out at once.^[1]

At scale this becomes a laundering industry. In June 2025 the Justice Department filed to forfeit more than $225.3 million in crypto from a network that ran hundreds of thousands of transactions to hide scam proceeds. It thanked Tether for its help.^[7] Treasury says Huione Group, which FinCEN cut off from the US financial system, laundered at least $4 billion in illicit proceeds.^[5]

What an AML check can and cannot show

An AML checker reads the history of an address. It can help in two ways:

• Before you pay. If the deposit address you were given is already linked to reported scams, a check may show a scam risk category. A clean result does not mean the address is safe. New scam addresses are created all the time.
• After you pay. A check can show where funds went next, which can support a report to the police or the exchange.

What it cannot do is freeze or return funds. Only an issuer, an exchange or law enforcement can freeze assets. See how Tether freezes work and what a risk score means.

Beware of recovery offers

Victims are often targeted a second time. The FBI warns that companies claiming they can recover lost crypto often take an upfront fee and disappear. Private recovery firms cannot issue seizure orders.^[8] In 2025 the FBI added that fake law firms now contact victims, claim government ties and demand payment. US agencies do not charge for law enforcement work.^[9]

What to do

1. Stop sending money. No tax or fee will unlock funds on a fake platform.
2. Save everything. Keep chat logs, usernames, phone numbers, website addresses, wallet addresses and transaction hashes. FinCEN asks banks to report exactly these details.^[1]
3. Report it. File at ic3.gov in the US, and tell the exchange you used to buy the crypto. The FTC also lists ReportFraud.ftc.gov.^[3]
4. Check before you send. Run any address a new contact gives you through an AML checker first. Treat a clean result as "no known record", not as proof.
5. Ignore recovery offers that come to you unasked or ask for payment upfront.

This article is general information, not legal advice.