Investigating Crypto Romance Scams (Pig Butchering)
Analyzing the pig butchering pattern, typical fund flows, and how to build evidence for law enforcement.
Crypto romance scams, widely known as "Pig Butchering" (Sha Zhu Pan), have exploded into a multi-billion dollar global criminal enterprise. Unlike quick phishing hits, these are long-con psychological operations.
Investigators dealing with pig butchering face unique challenges: highly traumatized victims, drawn-out timelines, and complex, industrialized laundering networks based primarily in Southeast Asia.
The Pig Butchering Methodology
The scam typically begins with a "wrong number" text or a match on a dating app. The scammer (often a human trafficking victim themselves) builds a relationship over weeks or months before introducing the concept of cryptocurrency investing.
- •The victim is directed to buy legitimate crypto (usually USDT) on a real exchange like Coinbase.
- •They are instructed to transfer the funds to a fake, custom-built trading platform controlled by the syndicate.
- •The platform shows fake profits to encourage larger deposits (fattening the pig).
- •When the victim tries to withdraw, they are hit with fake "tax" or "verification" fees (the butchering).
Typical Fund Flows
Once the victim deposits USDT into the fake platform, the funds are immediately swept into the syndicate's laundering network. The typical pattern involves:
1. Consolidation: Sweeping funds from victim-specific deposit addresses into a central hot wallet.
2. Layering: Moving funds rapidly across the TRON or Ethereum networks, often using decentralized bridges or cross-chain swaps.
3. Off-Ramping: Depositing the funds into heavily nested OTC (Over-The-Counter) broker accounts on major Asian exchanges.
Building the Evidence File
Because pig butchering involves dozens of transactions over months, chaotic evidence presentation is the quickest way to get a case ignored by law enforcement.
Investigators must meticulously document the complete flow. This includes the URLs of the fake trading platforms (crucial for domain seizure), the victim's original exchange withdrawal receipts, and a clean trace to the final OTC deposit addresses.
The Urgency of Action
Victims often wait weeks to report the crime, paralyzed by shame or continuing to pay fake taxes. Investigators must act aggressively to trace the final hops and issue freeze requests to destination exchanges before the OTC brokers fully liquidate the USDT to fiat.
Untangle Syndicate Networks
Aletheia features specialized heuristics for identifying pig butchering consolidation wallets and OTC off-ramps, dramatically speeding up the tracing process for high-volume scams.