Case Study: Investigating a Pig Butchering Syndicate
An anonymized walkthrough of a complex cryptocurrency investigation tracking funds from a pig butchering scam to an offshore exchange.
Pig butchering (Sha Zhu Pan) scams have become a multi-billion dollar industry, characterized by sophisticated social engineering and complex money laundering networks. This anonymized case study illustrates the typical investigative lifecycle.
Phase 1: The Initial Report and Triage
The victim reported losing $150,000 in USDT over a three-month period. They had been contacted via a wrong-number text, built a rapport with the scammer, and were eventually convinced to invest on a fraudulent trading platform.
The initial artifacts were the victim's transaction hashes and the URL of the fake trading site.
Phase 2: Infrastructure OSINT
Analysis of the fraudulent domain revealed it was registered recently and hosted behind Cloudflare. By examining historical DNS records and SSL certificates, we identified a cluster of similar domains utilizing the same frontend templates.
- •We mapped the syndicate's infrastructure footprint.
- •Identified overlapping IP spaces suggesting a coordinated operation.
- •Archived the fraudulent site content for evidence.
Phase 3: Fund Tracing
The victim's USDT (on the Tron network) was traced from their initial deposit address. The funds did not remain there long; they were swept into a larger consolidation wallet controlled by the scammers.
From the consolidation wallet, the funds were dispersed through several intermediary addresses in an attempt to obfuscate the trail—a process known as layering.
Identifying the Cash-Out Point
Despite the layering, blockchain heuristics allowed us to follow the primary volume of funds. Eventually, the USDT was deposited into a known hot wallet belonging to a high-volume, offshore cryptocurrency exchange.
Phase 4: Action and Outcome
With the exchange deposit identified, a formal report was generated detailing the flow of funds and the specific deposit memo/address used. This was provided to law enforcement.
Law enforcement submitted a preservation request to the exchange, followed by a subpoena. While the exchange complied and froze the associated account, significant funds had already been converted to fiat.
Trace Complex Fraud Rings
Aletheia's automated tracing algorithms can quickly unravel the complex layering techniques used by pig butchering syndicates, identifying cash-out points faster.