What is pig butchering?

Pig butchering is a sophisticated, long-run fraud that typically begins with a chance contact — a message on WhatsApp, a match on a dating app, or a connection request on LinkedIn. The fraudster (or, increasingly, a fraud syndicate operating scripts across hundreds of victims simultaneously) invests weeks or months building a genuine-feeling relationship with the victim.

The name comes from the Chinese metaphor of fattening a pig before slaughter. The victim is the pig. The fraudsters invest time and emotional effort to build trust — the fattening — before extracting the maximum possible amount of money.

At some point in the relationship, the subject of cryptocurrency investment is raised, often casually. The fraudster mentions that they have made significant returns through a particular platform or trading method, and offers to help the victim do the same.

The mechanics of the fraud

Phase 1 — Contact and grooming (weeks to months): Regular contact is established. Conversations are warm, personal, and designed to create genuine emotional connection. This phase can involve daily messaging, voice calls, and in some cases video calls using deepfake technology.

Phase 2 — Introduction to the platform: The fraudster introduces a cryptocurrency trading platform — typically a fake platform designed to look convincing. The victim is shown how to deposit funds and shown (fake) profits accumulating.

Phase 3 — Small wins: The victim deposits a modest amount and is allowed to withdraw a small profit. This builds confidence. The platform's fake dashboard shows growing returns.

Phase 4 — Escalation: The fraudster encourages increasingly large deposits, often with time-limited "opportunities". The victim's dashboard shows substantial gains.

Phase 5 — The slaughter: When the victim attempts to withdraw significant funds, they are told a tax payment, verification fee, or other charge is required. This fee is also stolen. Once the fraudster believes they have extracted the maximum, they disappear.

Red flags to recognise pig butchering: Unsolicited contact from an attractive stranger; early introduction of cryptocurrency investment; a platform that cannot be found through independent research; inability to withdraw funds without paying fees; pressure to invest larger amounts quickly; unusually perfect returns on a trading dashboard.

Why victims are not to blame

Pig butchering operations are run by professional fraud syndicates, many based in South East Asia (notably Myanmar, Cambodia, and Thailand), employing hundreds of operators following detailed scripts. They invest significant resources in the emotional manipulation of victims and in building technically convincing fake platforms.

Victims include educated professionals, experienced investors, and people who are not naive about scams. The fraud specifically targets emotional vulnerability and trust, not technical ignorance. The shame victims feel is a deliberate part of the fraud's design — it reduces the likelihood of reporting.

How the money moves on the blockchain

Pig butchering operations typically move victim funds through a predictable pattern:

  • Collection wallets — the address the victim sends to, which aggregates funds from multiple victims
  • Consolidation — funds from multiple collection wallets are consolidated, often in large batches
  • Layering — funds are moved through multiple hops, sometimes through mixing services, to obscure the trail
  • Exchange deposits — ultimately funds are deposited at an exchange to convert to fiat currency, often in jurisdictions with limited regulatory oversight

This pattern is highly distinctive and well-understood by blockchain investigators. Professional traces of pig butchering proceeds frequently identify the consolidation wallets and exchange deposit addresses used by the syndicate.

What a blockchain trace can reveal

A professional investigation of pig butchering proceeds can typically identify:

  • The collection wallet that received the victim's funds
  • Other victim funds consolidated into the same wallet (demonstrating the organised nature of the operation)
  • The layering pattern used to move funds
  • Any exchange deposits — which can be the subject of production orders
  • OFAC sanctions matches — many pig butchering operations have connections to sanctioned entities or individuals
  • The total volume of funds processed through the same operation

Legal options for victims

Where an exchange deposit address is identified, a solicitor can seek a production order compelling the exchange to disclose the KYC details of the account holder. This can reveal the identities of money mules used by the syndicate to cash out victim funds.

Civil asset recovery proceedings are possible in some cases. Some UK solicitors specialising in crypto fraud have achieved successful freezing orders against exchange accounts identified through blockchain traces.

Reporting to Action Fraud remains important even where individual police investigation seems unlikely — the intelligence contributes to operations targeting the syndicates themselves, several of which have resulted in significant law enforcement action in partnership with Interpol and South East Asian authorities.

If you are a victim: The most important immediate step is to obtain a blockchain trace and professional investigation report. This documents exactly where your funds went, identifies any exchange contacts for legal action, and provides the evidential foundation for any subsequent proceedings.