What are pig-butchering crypto scams, and how to combat them?

In recent years, a new type of scam has been targeting cryptocurrency users called the “pig-butchering scam.” Has anyone been really interested in getting to know you via dating apps or any of your social media handles? That’s often how these scams start.

Scammers make you feel special while building a fake relationship to gain your trust over time. But here’s the twist: they are neither in love nor is their friendship trustworthy. All they want is to convince you to invest in what seems like an amazing opportunity.

Do you think it can’t happen to you? In 2021, scammers used fake profiles on dating apps like Tinder and Bumble to build trust and trick people into investing in fake cryptocurrency platforms. They made it seem like the victims were earning money, but the funds were gone when they tried to withdraw. This scam resulted in millions of dollars in losses, with victims unable to recover their investments. 

With so many cyber threats surrounding you, staying cautious is more important than ever, especially with online investments and cryptocurrency. So, let’s dive into pig-butchering scams and explore how they work, the common red flags to be aware of, and how to protect yourself.

Pig-butchering scams explained

A pig-butchering scam, also known as “Sha Zhu Pan” in Chinese, is a sneaky and long-term type of investment fraud that often starts on social media or dating apps with a romantic angle. In October 2023, 12% of United States-based users of dating apps had been scammed this way, up from 5% in 2018.

According to the US Federal Bureau of Investigation (FBI), these scams first emerged in China in 2019. Since then, Southeast Asia has become a significant hub, with organized groups in countries like Laos, Cambodia and Myanmar running these schemes like businesses. Shockingly, they often use victims of human trafficking to carry out the scams.

But why is it called a pig-butchering scam? Is it related to an old Wall Street saying, “Bulls make money, bears make money, pigs get slaughtered?”

Well, not exactly. 

The name comes from how scammers see their victims, usually as “pigs” who they convince to invest small amounts at first, and once pigs believe in the earning potential, they’re encouraged to invest more and more — just like “fattening” up a pig for slaughter. Then, these pigs are butchered when the scammer thinks they’ve gotten all they can from them, meaning they’ve likely stolen the victim’s funds and disappeared. 

Social media platforms used to trick victims are called “pig pens,” and the lies scammers tell to keep the money flowing are called “pig feed.” And by now, you probably know who the butcher is in this scenario. That’s right — it’s the scammer.

Did you know? In April 2023, the US Department of Justice seized approximately $112 million in cryptocurrency connected to pig-butchering scams without revealing the identities of the suspects involved. 

How pig-butchering scams work in crypto

Now you know what a pig-butchering scam is and its origins, so let’s walk you through an example to understand how it works. Read on to raise your crypto scam awareness and learn how to protect yourself against crypto fraud.

Suppose there are two people: Bob and Alice. 

Bob is a scammer, and Alice is his target. Here’s how a pig-butchering crypto scam might play out between them:

Step 1: Initial contact

It all starts when Bob sends Alice a message on a dating app. His profile picture looks friendly and genuine, but it’s actually stolen from someone else or is artificial intelligence-generated.  

He sends a casual message like, “Hi, meeting you at the Web3 symposium in Frankfurt was great! We should catch up again soon over a cup of coffee.” Alice, who can’t recall who Bob is, responds carefully: “I think you might have the wrong person. I wasn’t at a Web3 symposium.” 

However, Bob, who is “hunting a pig,” responds: “Oh, my bad! But, hey, it seems we have common interests; why not get to know each other?” This is how many pig-butchering scams begin — through social engineering tactics like random messages that catch people off guard. 

Did you know? Romance baiting first appeared in Australia in a media release from Scamwatch in February 2021. It was part of a romance fraud awareness campaign leading up to Valentine’s Day, aimed at educating people about scammers who use romantic relationships to exploit victims financially. 

Step 2: Building trust

Over the next few weeks, Bob and Alice chat about their interests, hobbies and career goals. Alice becomes interested in Bob’s life, especially his success in cryptocurrency investing and how his uncle helped him make a fortune off cryptocurrencies. 

Alice, new to crypto, finds herself intrigued, starts to trust Bob, and requests him to guide her in successfully investing in crypto. This stage, known as “pig raising,” is all about building trust and creating a sense of security where scammers prepare to trick their victims into investing.

Step 3: The investment proposal

One day, Bob tells Alice about a fantastic investment opportunity in crypto and promises to guide her in making money. Alice, excited about the crypto world, agrees with Bob’s proposal. Then, Bob sends her a link to an investment platform that appears to be legitimate but is, in reality, fake, entirely controlled by Bob and his scam team — a classic tactic in pig-butchering crypto scams.

The image above shows how a pig-butchering scam team is organized. The front team is the “face” of the scam and includes people who pretend to be friendly online and others who chat with victims. The back team moves stolen money, manages crypto wallets and runs the tech side.

Step 4: High returns and the hook

Alice decides to invest money, starting small. The platform shows her that her investment is growing quickly, making her feel excited. She is even able to withdraw money without any issues. This convinces Alice that the platform is legitimate, and she feels safe investing more money. 

Feeling reassured and keen to make larger returns, Alice puts in even more money, thinking she’s on her way to financial success.

Step 5: The disappearance

Eventually, Alice invested a significant amount of money. But one day, when she tries to make another withdrawal, she is unable to do so.  

Suddenly, Bob also stops responding to her messages. This is when she realizes she can’t access her funds — she’s been scammed, and Bob has vanished without a trace. 

This final stage is what scammers refer to as “pig killing”— when they disappear with all the money they’ve tricked their victims into investing. This is similar to a rug pull, where the scammer disappears once they have enough of the victim’s investment.

Real-world examples of crypto pig-butchering scams

The cryptocurrency world is full of scams, which happen for several reasons. First, the complex nature of cryptocurrencies can make them an attractive target to trick victims. Second, the lack of regulation allows scammers to operate without getting caught.

Let’s dive into the various real-world examples of pig-butchering scams:

• San Francisco Bay area investor: A Bay Area man, CY (pseudonym), lost $1.2 million in a cryptocurrency pig-butchering scam. It began on WhatsApp, where a scammer pretended to be an old colleague, built trust and convinced him to invest in a fake crypto platform. Despite initially being cautious, CY lost his savings and took out loans, believing he could recover the money. In the end, the scammer disappeared, leaving CY devastated.
• Former Heartland Tri-State Bank CEO: Shan Hanes, the former CEO of Heartland Tri-State Bank, was accused of stealing $47.1 million from the bank to invest in cryptocurrency. He reportedly made unauthorized wire transfers to crypto wallets, using money from a local church and investment club. His risky crypto deals caused the bank to collapse in 2023. Some believe Hanes may have been scammed via pig-butchering methods in fraudulent crypto schemes.
• Liquidity mining scam: In late 2023, Sophos X-Ops uncovered a massive liquidity mining scam involving three Chinese crime rings, targeting nearly 100 victims. One victim tricked through the MeetMe app lost $22,000 (excluding the processing fees for wire transfers to exchanges and token purchases). Scammers harassed him, demanding more deposits and even using AI-generated messages to reestablish contact.

These are just three examples of hundreds or even thousands of similar cases that show how widespread pig-butchering scams have become. Despite being cautioned multiple times, many individuals fall prey to these scams, losing significant amounts of money and facing devastating financial consequences.  

Did you know? In 2023, Sophos X-Ops, the cybersecurity division of Sophos, uncovered two large pig-butchering scams: one in Hong Kong and another in Cambodia. These scams used real crypto trading apps and fake identities to steal millions. Investigators also found that scammers were using AI to enhance their tactics.

The impact of pig-butchering scams

Imagine being proud of yourself for making a smart investment, only to discover you’ve lost everything. For some, this may mean losing retirement funds, life savings, or even money that is kept aside for emergencies. 

Those who might have taken loans to invest in fraudulent schemes may end up in severe financial trouble because they won’t be able to repay the loans. These scams make everyone more suspicious of legitimate investments, hurting trust in the cryptocurrency market and beyond. It’s a harsh reminder of why being careful and staying informed is important.

10 warning signs of pig-butchering scams

A few red flags to watch out for pig-butchering scams include:

1. If someone expresses strong feelings for you too quickly online, especially without meeting in person, it might be a scam.
2. Be careful if someone you don’t know asks you for money, even if they say it’s for an emergency.
3. You are being promised risk-free investments and easy money, often showing fake screenshots of massive profits to dupe you in.
4. If they don’t want to share personal information or professional credentials, it’s suspicious.
5. They pressure you to keep investing more money as soon as you start, frequently claiming that this is a once-in-a-lifetime chance or that you must invest more to make bigger earnings.
6. They often flaunt a luxurious lifestyle, showing off expensive cars, trips or wealth to make their story seem legitimate.
7. The investment platform they recommend is usually not a well-known exchange and may lack basic security measures or verification processes.
8. When you try to withdraw your money, you may encounter delays, fees or excuses for being unable to access your funds.
9. When you become suspicious or hesitant, the scammer might use guilt, threats or emotional appeals to keep you invested.
10. If you encounter issues, the platform’s support channels might be fake or unhelpful, further complicating your situation.

What to do If you suspect you’re a victim

If you’re worried that you are butchered, say, in a fraudulent “mining pool” app linked to your wallet, don’t panic — just take these steps right away, as noted by Sean Gallagher, principal threat researcher, Sophos X-Ops: 

• Revoke permissions: Use Revoke via your wallet app or browser to remove any permissions linked to your wallet. You’ll need Ethereum for “gas” fees.
• Move funds: Transfer all your crypto to a new wallet immediately, especially if you can’t revoke the permissions.
• Contact Support: Contact the exchange and wallet provider directly. Avoid in-app support chats, as scammers may control them.
• Avoid recovery services: If you’ve lost funds, avoid “crypto recovery” services found on social media — they’re often scams, too.
• Document transactions: Use a blockchain explorer like Etherscan to track transactions and share details with security teams or law enforcement.
• Seek support: Others might have fallen victim to such scams. For help, reach out to the Cybercrime Support Network.
• Report the fraud: Notify local authorities. In the US, contact the Secret Service, Federal Bureau of Investigation or Federal Trade Commission. In the United Kingdom, contact Action Fraud.

Did you know? Tether worked with the US Department of Justice and crypto exchange OKX to trace and freeze the illicit funds worth $225 million in USDT as part of the DOJ’s investigation into a Southeast Asian human trafficking syndicate. 

Groups involved in pig-butchering scams

Sophos has reported on various groups involved in pig-butchering scams, including the domains used, contract wallets, hosting providers, registrars and the total volume of cryptocurrency transacted:

Allnodes

• Domains: Operates under domains like allnodes.vip and allnodes.xyx.
• Contract wallets: Uses Ethereum contract wallets with addresses such as “0x6B79f38233726282c7F88FE670F871eAbd0c746c” and “0xd2b14d2fff430a720cf44bbd064f548a585e73de” to manage and transfer funds.
• Hosting and registrar: Hosted by Alibaba Cloud and registered under Alibaba Cloud.
• Total volume: Has handled significant sums, with transaction volumes of $177,596 and $174,934, respectively, for each domain.

Trust Group

• Domains: Includes multiple domains like trust-oke[.}com, trust-usdt[.]com, and several others.
• Contract wallets: Primarily uses the wallet “0xcf6b558c218a9148cd77c04be4e3d1c1fc9d61a2” for transactions.
• Hosting and registrar: Utilizes Amazon AWS for hosting and is registered with Amazon.
• Total volume: The group has moved a substantial $676,869 through its operations.

Ada Group

• Domains: Manages several domains like ada-defi[.]pics, ada-defi[.]beauty and others, which are possibly used to target different audience segments.
• Contract wallets: The Ethereum contract wallet “0xeb7b75dd5b4b6ef7bbc6ec079cd329a782fc1efe” is used to gather and redirect funds.
• Hosting and registrar: Hosted by Cloudflare and registered with Dynadot.
• Total volume: Processed funds worth $62,660.

Unknown Group

• Domains: Operates domains like trust-eth[.]com and eth-mining[.]xyz.
• Hosting and registrar: Switches between Google and Cloudflare for hosting. Domains are registered with Gname.com and Dynadot.
• Total volume: Not specified.

By now, you might be aware that cybercriminals involved in pig-butchering scams are pretty advanced in their methods. They have established several contract wallets to control the flow of cryptocurrencies, which facilitate the distribution and money laundering of funds through various routes. The total volume of reported operations shows how extensive these are and how much they impact their victims. It’s quite an elaborate setup they’ve got going. 

How to avoid being butchered?

To avoid falling victim to pig-butchering scams, follow the below key tips:

• Verify identities: Check who you’re talking to online, especially on dating apps or social media. Scammers often use stolen photos or fake profiles to build trust. If someone you barely know starts talking about investments, it’s best to back off.
• Question high returns: If an investment seems too good to be true, it probably is. Watch out for offers that promise huge returns with little or no risk, especially if they pressure you to take action quickly.
• Research platforms: Do your homework before investing in any platform or app. Check if it’s regulated, read reviews and verify its legitimacy. Scammers often create convincing fake websites or apps.
• Protect your personal info: Keep your personal and financial details to yourself. Only share such information with people you know and trust. Scammers can use your data to manipulate or steal from you.
• Trust your gut: If something doesn’t feel right, don’t hesitate to say no or take some time to think it through. For instance, if someone claims to be a German national but messages you in Chinese, it might be worth double-checking. 

By educating yourself on the tactics used by scammers and emerging scams in the crypto world, you can protect yourself or avoid being butchered. When interacting with strangers online, if you feel something is wrong, don’t hesitate to trust your instincts and get advice from trusted friends or financial experts. Remember, it’s always better to be safe than sorry.