Pig butchering scam

Table of contents

What is a pig butchering scam?

Pig butchering — also known as romance baiting, financial grooming, or a confidence scheme — is a type of social engineering scam in which fraudsters establish fake relationships — often romantic or investment-based — to manipulate victims into transferring large sums of cryptocurrency or fiat over time. The term originates from Southeast Asia — where criminal networks operate intricate scam centers — from the term “Shā Zhū Pán.” The scam’s nickname refers to the idea of “fattening the pig before slaughter,” where the victim is “fattened” with trust and attention before the scammer disappears with their funds.

Pig butchering is one of the most financially damaging forms of fraud, and has become a top enforcement priority for global regulators and law enforcement agencies.

Key takeaways:

Pig butchering is a type of trust-based scam that targets individuals, often via messaging apps or dating sites
Pig butchering fraudsters pose as love interests, mentors, or investors to gain control over victim funds
Pig butchering scams often involve fake investment platforms or “too-good-to-be-true” returns
Pig butchering scams often result in high financial losses, and the element of emotional manipulation can make these cases complex to investigate
Pig butchering scams are frequently linked to transnational criminal networks organizations and human trafficking operations

‍

How does pig butchering work?

Pig butchering scams unfold gradually, often over weeks or months. They typically follow the same, clear pattern:

Initial contact: Scammers reach out to victims through social platforms, SMS, or messaging apps (e.g. WhatsApp, Telegram, Tinder) — often using stolen photos; fake identities; or, increasingly, AI-generated images and deepfakes.
Relationship building: The scammer builds rapport with the victim, appearing trustworthy and emotionally invested in them.
Introduction of opportunity: Eventually, the fraudster pitches a lucrative crypto investment opportunity — often linked to a fake platform they control or are involved with.
Coaching and manipulation: The fraudster coaches the victim through the process of sending funds, demonstrating fabricated returns or balances to encourage even more investment from the victim.
“Slaughter”: When the victim tries to withdraw funds or stops sending more money, the scammer vanishes — along with the victim’s funds — or the platform becomes inaccessible.

‍

Why should law enforcement, crypto-native businesses, compliance professionals, regulators, and policymakers care about pig butchering?

Pig butchering hurts people and weakens trust in digital assets. It also stretches across borders, platforms, and payment rails — making disruption a shared priority for law enforcement, crypto businesses, financial institutions, and regulators.

Key considerations and challenges for law enforcement agencies

Considerations

High financial losses: Victims can lose their life savings — devastating to anyone, but particularly difficult for elderly populations, who are often targeted by scammers.
Cross-border complexity: Pig butchering scams are typically run by transnational criminal groups operating from regions with limited enforcement cooperation — and often with ties to cybercrime, fraud, and labor exploitation.
Crypto tracing hurdles: Stolen funds often move through multiple wallets, obfuscation services like mixers, or are converted into stablecoins.
Public trust: Visible wins against these scams build confidence in reporting and in digital finance more broadly.

Challenges

Delayed reporting, scarce evidence: Grooming and shame leads to victims delaying reporting (or often, never reporting) these scams. Plus, scammers often use ephemeral apps and fake platforms that disappear.
Attribution at scale: Funds move across wallets, chains, and obfuscation services, then commingle with other flows, making them challenging to isolate and trace.
Cross-border hurdles: Infrastructure and cash-out points sit offshore, requiring investigative speed and parallel actions from cooperating agencies.
Victim-centric complexity: Many victims, many transactions, and evolving attribution make restitution and case linkage challenging — though victim reporting sites like Chainabuse can help law enforcement identify victims of the same scam.

Law enforcement agencies across the US, Asia, and Europe have launched specialized task forces to respond to pig butchering scams, including Operation Shamrock, the FBI’s Operation Level Up, and Europol’s European Financial and Economic Crime Centre (EFECC).

Key considerations and challenges for crypto businesses (e.g. VASPs, exchanges and DeFi platforms) and financial institutions

Considerations

Customer protection and brand risk: Victim losses and blocked withdrawals drive complaints, reputational damage, and churn.
Regulatory expectations: Examiners look for effective monitoring, reporting, and cooperation with investigations.
Operational cost: Freezes, escalations, and outreach increase workload without strong triage and automation.

Challenges

Behavioral detection: Pig butchering patterns can resemble legitimate trading or “investment coaching.”
Mule and nested activity: Fraud proceeds flow through new accounts, P2P marketplaces, and third-party processors.
Multi-asset laundering: Criminals use a combination of asset classes to both steal and launder funds including cash, wire transfers, and digital assets.
Rapid chain-hopping: Once funds are on-chain, criminals move value quickly across assets and networks to beat case initiation and freezes.
Evidence handling: Preserving artifacts and producing high-quality suspicious activity report (SAR) narratives under tight timelines.

Key considerations and challenges for regulators and policymakers

Considerations

Consumer harm at scale: Losses, under-reporting, and cross-border victimization require a coordinated response.
Financial integrity: Pig butchering scams often fuel broader illicit activities, undermining market confidence and rule of law in developing jurisdictions.
Clarity and consistency: Clear expectations for Virtual Asset Service Providers (VASPs), reporting, and information sharing improve outcomes.

Challenges

Evolving tactics: Scam playbooks and infrastructure adapt faster than guidance cycles.
Jurisdictional gaps: Varying regulations, thresholds, and legal authorities complicate asset freezes and restitution.
Data fragmentation: Limited cross-agency and cross-border data sharing slows timely disruption.
Balancing innovation and protection: Regulators must juggle enabling healthy crypto markets while minimizing harm.

‍

What are some real-world cases where TRM Labs was used by law enforcement to disrupt pig butchering scams?

REACT Task Force

The REACT Task Force, in collaboration with TRM Labs, has taken a proactive multi-jurisdictional approach to combat pig butchering. In 2023, they co-created the Crypto Coalition — a group of over 1,400 law enforcement professionals — and launched the Tracer Fellowship, a 12‑month program granting fellows full access to TRM’s blockchain intelligence tools, training, and certifications. They also spearheaded Operation Shamrock, an awareness campaign educating investigators and the public about pig butchering tactics. Chainabuse is the official reporting partner for Operation Shamrock.

US Secret Service (San Francisco Field Office)

In a high-profile pig butchering case in August 2022, the US Secret Service traced roughly USD 5.5 million sent by seven victims to a fake crypto trading platform. Leveraging TRM Forensics, investigators followed the complex movement of funds — from USDC into DAI, then to USDT, and through multiple wallets — ultimately identifying an unhosted wallet where funds were parked.

Royal Thai Police – Cyber Crime Investigation Bureau (CCIB)

In Thailand, the Royal Thai Police’s CCIB traced a cross-border scam network affecting victims in Thailand, the US, and the UK. Starting with one victim's wallet, investigators used TRM Forensics to dismantle a larger pig butchering operation and launched Operation Trust No One. With TRM’s VASP analytics and visual timelines, they identified operational hubs across Southeast Asia, froze illicit funds, and arrested a suspect who was later sentenced to 28 years in prison.

Department of Justice (DOJ) + FBI Phoenix

Using TRM’s analysis, the US DOJ and FBI Phoenix executed a seizure of approximately USD 112 million tied to pig butchering and other crypto investment scams. By unraveling the commingled network of fraudulent transactions, investigators traced proceeds to exchange cash-out points — aided by TRM’s blockchain intelligence.

Department of Justice (DOJ) + FBI Cleveland Field Office

In Ohio, TRM Labs supported tracing over USD 8.2 million in USDT linked to pig butchering. Investigators used TRM’s Graph Visualizer to link victim-specific fraud proceeds with funds from other likely-unidentified victims. The dual-use legal approach — wire fraud and money laundering statutes — supported a full forfeiture, enabling restitution to both known and potential future victims.

‍

How do blockchain analytics tools like TRM help in the fight against pig butchering?

TRM Labs empowers law enforcement with tools and support tailored to the unique demands of pig butchering investigations:

Advanced blockchain intelligence

Tools like TRM Forensics let investigators trace victim funds across chains and through intermediary wallets, revealing complex laundering paths and linking disparate cases.

Scam attribution

TRM’s platform helps teams quickly map fund flows, recognize repeat scam patterns, and present clear, court-ready visual evidence.

VASP intelligence and exchange outreach

TRM maintains a deep database of Virtual Asset Service Providers (VASPs). Investigators can rapidly identify involved exchanges and facilitate seizure or freeze actions — even across borders.

Training and capacity building

‍TRM Academy is TRM's training arm — delivering best-in-class live and on-demand courses and certifications that enables law enforcement personnel to gain hands-on experience with modern blockchain investigations, reducing onboarding time and strengthening crypto crime preparedness.

Scam victim report and education

Chainabuse, operated by TRM Labs, is a public platform where anyone can report crypto fraud or suspicious wallet activity. It has grown into a vital resource for uncovering scams early and advancing crypto crime investigations. By serving as a centralized, structured database of scam reports, Chainabuse empowers the public to report scams and suspicious wallet addresses, providing investigators with actionable intelligence to combat illicit activity.

Public–private collaboration

TRM facilitates communication and data sharing across agencies — from local task forces like REACT to federal investigations and international enforcement partners — helping coordinate cross-border operations.

In 2025, TRM Labs launched the Beacon Network — the first real-time crypto crime response system developed in partnership with leading exchanges, stablecoin issuers, and law enforcement agencies worldwide. Beacon enables verified investigators to instantly flag wallet addresses linked to financial crime, propagates risk signals across related wallets, and triggers immediate alerts as illicit funds move toward participating platforms.
In 2024, TRON, Tether, and TRM Labs launched T3, an initiative aimed at facilitating public-private collaboration to combat illicit activity associated with the use of USDT on the TRON blockchain. Within weeks of launch, T3 facilitated multiple active law enforcement investigations, showcasing the power of public-private collaboration to deny criminals access to the digital financial system. To date, hundreds of millions of dollars of illicit crypto have been frozen.
In late 2024, TRM-operated Chainabuse was named the official reporting partner for Operation Shamrock, establishing its role as a public-private platform that enables law enforcement and investigators to rapidly triage crypto fraud cases, link related incidents, and identify emerging scam trends through its centralized repository of verified reports.

Strategic investigative planning

TRM empowers agencies to shift from reactive tracing to proactive disruption — anticipating scammer behavior, flagging emerging typologies, and interdicting funds before losses escalate.

‍

Frequently asked questions (FAQs)

Is pig butchering illegal?

Yes. Pig butchering is a form of fraud that involves deception, theft, and often money laundering. In many jurisdictions, these scams are also tied to cybercrime and human trafficking.

What makes pig butchering different from phishing?

Phishing is typically a one-time scam aimed at stealing credentials or small amounts of money. Pig butchering is a long-term con: fraudsters build trust over weeks or months before persuading victims to transfer large sums of crypto or fiat.

Can victims get their crypto back after pig butchering scams?

In some cases, yes. If reported quickly, law enforcement can use blockchain intelligence tools like TRM Forensics to trace stolen funds and help freeze them at exchanges. However, recovery depends on how fast the scam is detected and whether assets have already been laundered and cashed out.

How do pig butchering scams start?

Scammers often initiate contact on dating apps, social media, or messaging platforms like WhatsApp, Telegram, or WeChat. They usually pose as friendly strangers, professional investors, or potential romantic partners.

Which cryptocurrencies are most often used in pig butchering scams?

Stablecoins are commonly used because they allow scammers to quickly move and convert funds across multiple blockchains while avoiding price volatility. Bitcoin and Ethereum are also frequently seen in investigations.

Why are pig butchering scams hard to stop?

These schemes are run by organized criminal networks that often operate across borders. Scammers may use multiple wallets, mixers, and exchanges to launder funds, making it difficult for investigators to trace and seize assets without advanced blockchain analytics.

What should I do if I suspect a pig butchering scam?

Stop sending funds immediately, collect all communications, submit a report via Chainabuse, and report the case to your local law enforcement agency or cybercrime task force. If cryptocurrency is involved, provide wallet addresses and transaction IDs to help investigators trace the funds.

How can compliance teams detect pig butchering activity?

Financial institutions and VASPs can look for red flags such as repeated deposits to wallets linked to romance scams, sudden large transfers to new accounts, or customer claims of “investment coaching.” Screening wallets with TRM can surface known scam-linked addresses.