Who This Article Is For
Most security articles are written for the person at risk. This one is written primarily for someone else: the friend, partner, adult child or colleague who suspects something is wrong and doesn’t know what to do about it.
That’s deliberate, and it reflects how this fraud actually ends. Victims rarely self-identify while it’s happening — the entire operation is engineered to prevent exactly that. Intervention, when it comes, almost always comes from outside.
If you’re reading this because you suspect you’re being scammed: skip to “If You Are the One Being Scammed.” You’re not stupid and you’re not alone, and the sooner you stop, the more you keep.
The Scale
This is no longer a niche fraud. By total loss it is the largest category of financial crime the FBI tracks.
- Crypto investment fraud, including pig butchering, accounted for $5.8 billion across 41,557 complaints in 2024 — the top-loss crime category tracked by the FBI’s IC3 for the second consecutive year.
- The FBI’s 2025 annual report put total investment-related fraud at $8.65 billion, roughly double the prior year and almost triple the next-highest category.
- Chainalysis put on-chain crypto scam revenue at a minimum of $9.9 billion for 2024, with pig butchering accounting for around a third of scam inflows and growing roughly 40% year on year.
- Chainalysis’ 2026 report found the average scam payment to pig-butchering and related addresses rose from $782 in 2024 to $2,764 in 2025 — a 253% increase.
- A single laundering platform serving these operations, Huione Guarantee, processed more than $70 billion in cryptocurrency since 2021.
Two figures matter more than the totals.
Cyvers found that 75% of pig-butchering victims lost more than half their net worth. This is not a fraud people absorb. It takes houses, pensions and retirements.
Underreporting is estimated to exceed 85%. Shame, clinical depression, and fear of admitting the loss to family or advisers mean the real figure is several times what any dataset shows.
How It Actually Works
The name is a translation of the Chinese sha zhu pan — fattening the pig before slaughter. It originated in China around 2019 and industrialised from there.
The structure is consistent across operations because it’s run from scripts, in compounds, at scale.
Phase 1: Contact
A wrong-number text. A LinkedIn connection. A dating app match. A friendly reply in a hobby group. Nothing about money.
Targeting is not random. Analysis consistently finds victims are often highly educated, and are selected because they’ve recently gone through a divorce, bereavement, relocation or other personal difficulty — circumstances that create openness to new connection.
Victims aged 40 to 65 account for around 68% of total cumulative losses. This is not a scam that preys on the naive. It preys on the competent and lonely.
Phase 2: Relationship
Weeks or months. Daily messages. Shared routine. Photos, voice notes, sometimes video calls — increasingly with AI-generated or deepfaked faces. Genuine emotional investment on one side, a script on the other.
No money is mentioned. This phase exists specifically to build trust that will later override judgement, and the operation is patient because the expected value justifies it.
Phase 3: Introduction
Investment enters sideways, never as a pitch. A casual mention of a trading strategy. A screenshot of a return. A reluctance to share details — “I don’t want to be the person who pushes.” The victim frequently has to ask to be included.
That reluctance is the most effective part of the script. It converts the proposition from something being sold into something being granted.
Phase 4: The fake platform
The defining technical component is the counterfeit trading application.
It looks professional. It has charts, an order book, a portfolio view, a support chat. It is also entirely fictional — a web interface showing numbers the operator controls.
These apps are not found on the Apple App Store or Google Play. They’re installed through direct links, sideloaded, or accessed through a browser. That single fact is the clearest identifying marker of the entire fraud.
A small initial deposit shows immediate gains. A test withdrawal works — this is critical, because it manufactures proof the platform is real. Then the numbers climb.
Phase 5: Escalation
The displayed balance grows. The victim deposits more. Then more. Operations routinely induce victims into borrowing against mortgages and retirement assets to increase position size, because the displayed returns make it look rational.
Every number the victim sees is fabricated.
Phase 6: The close
Withdrawal is attempted and fails. A tax is owed first. A compliance fee. A minimum balance requirement. An anti-money-laundering deposit. Each payment is framed as the last obstacle.
Then contact ends. The platform goes offline. The person was never real.
Why Intelligent People Fall for This
Dismissing victims as gullible is both wrong and useless. The mechanisms are specific:
The relationship precedes the money. Judgement is not applied to a stranger’s investment pitch; it’s applied to a trusted person’s suggestion, months in.
The test withdrawal is designed to defeat scepticism. A victim who does the responsible thing — try a small amount, verify it works — receives confirmation the platform is legitimate. Due diligence is weaponised.
Sunk cost compounds. After a significant deposit, “this is a scam” means accepting an enormous loss. Continuing preserves hope. The fraud exploits the psychology of not wanting to be a victim, which keeps victims paying.
Isolation is engineered. Scripts include lines designed to discourage disclosure — this is private, people won’t understand, don’t tell your family about us. By the time it collapses, the victim often has nobody informed enough to intervene.
AI has removed the remaining tells. Deepfake video and voice cloning mean a video call no longer proves anything. Older advice about grammar and photo reverse-searching is substantially obsolete. Related: Deepfakes, Voice Clones and AI-Written Phishing: Why the Old Warning Signs Are Dead
The Signs
Behavioural:
- A significant new relationship with someone never met in person
- Protectiveness or secrecy about who they’re talking to
- A new, unexplained interest in crypto trading
- Reluctance to discuss specifics of the platform or the person
- Withdrawal from friends and existing social contact
- Financial changes: refinancing, loans, pension withdrawals, selling assets
- Talk of large unrealised gains with no corresponding change in lifestyle
- Defensiveness, disproportionate to the question, when asked about any of it
The single clearest technical marker:
The trading platform is not in the Apple App Store or Google Play. If someone is trading through a sideloaded app or a link they were sent, that is close to definitive. Legitimate regulated platforms are in official app stores.
Verifiable in minutes:
- Is the platform on the official ESMA CASP register, or a comparable national register? Related: How To Verify A Mica Licence
- Does the company exist in any corporate register?
- Does the platform’s domain predate the relationship by more than a few months?
- Does the “support” team exist outside the app?
How to Help Someone
This is the hardest part, and getting the approach wrong makes things worse. The operation has already prepared the victim for exactly your intervention.
Do not lead with “you’re being scammed.” It triggers defensiveness, confirms the scammer’s framing that outsiders won’t understand, and frequently causes the victim to conceal further. The relationship is real to them; attacking it attacks them.
Lead with the platform, not the person. “I’d like to understand how the platform works” is answerable. “This person doesn’t exist” is not.
Ask the withdrawal question. The most useful single intervention: can you withdraw the full balance, right now, to your own bank account? Not a test amount — all of it. The answer, or the excuse for why not, is usually the moment of recognition. It arrives from them rather than from you, which is the only way it lands.
Use verifiable facts, not accusations. Walk through the register check together. Look for the app in the official store. These are neutral, checkable actions rather than claims about their judgement.
Expect to be rejected the first time. Recognition often takes several attempts. Staying available matters more than winning the argument — the moment of collapse comes eventually, and you want to be someone they can tell.
If they are still depositing, prioritise stopping the outflow. Every further payment is unrecoverable. Stopping it matters more than being proven right.
Take the aftermath seriously. Victims experience intense financial distress and severe clinical depression, and underreporting is driven largely by shame. The loss is frequently more than half of everything they have. This needs support, not vindication, and in some cases professional mental health help.
If You Are the One Being Scammed
If reading this produced a sinking feeling: stop depositing. Right now, before anything else.
Do not pay the withdrawal fee. Not the tax, not the compliance charge, not the minimum balance. These exist only to extract more. There is no balance to release.
The money already sent is almost certainly gone. The money you haven’t sent yet is not. That is the only decision still available, and it’s a real one.
Preserve everything — screenshots, the platform URL, wallet addresses, the full message history, transaction records.
Report it. To your national police, your financial regulator, and the relevant national cybercrime unit. Reporting feels futile and sometimes isn’t: in April 2026 the FBI, working with authorities in Dubai, China and Thailand, dismantled at least nine overseas scam centres and arrested hundreds of suspects. The FBI’s Operation Level Up has notified roughly 9,000 victims and recovered around $562 million. Those outcomes were built from individual reports.
Tell one person. The isolation was engineered. Breaking it is the first step out, and the shame is a product of the scam rather than of anything you did.
Ignore everyone who contacts you about recovery. This is critical. The moment a loss becomes visible, recovery fraud targets the victim — a second extraction aimed at someone already demonstrated to be reachable. No legitimate investigator cold-contacts victims, and no legitimate process requires an upfront fee or your wallet access. Related: Your Crypto Was Just Stolen: What to Do in the First 24 Hours
Why Crypto
A reasonable question: romance fraud predates crypto by centuries. Why is this the vehicle?
Because crypto solves the scammer’s two hardest problems. Irreversibility — no chargeback, no fraud department, no clawback. And a plausible story for extraordinary returns — 300% in six months is absurd in equities and merely a good year in crypto, which makes a fabricated chart credible.
It is not a crypto-specific fraud. It is an old fraud that found an ideal settlement layer.
Worth naming honestly: crypto’s culture of spectacular-return stories supplies the cover. Every genuine post about life-changing gains makes the fabricated version more believable.
The Bottom Line
The largest loss category in crypto is not a technical attack. No hardware wallet prevents it, no approval audit catches it, no simulation flags it — because at no point is anything compromised. The victim sends the money voluntarily, to someone they trust, through an interface showing numbers that were never real.
Three things worth remembering:
- If a trading platform isn’t in the official app store, it isn’t a trading platform.
- “Can you withdraw everything right now?” is the question that ends it. Ask it of any platform, including your own.
- If someone you know is in this, lead with the platform rather than the person, expect to be rejected, and stay available.
And if you’ve lost money this way: the operation was industrial, scripted, funded, and run by people who do this full time against thousands of targets. Being caught by it says considerably less about you than it says about them.
About the Author
N. Singh is the Founder and Editor-in-Chief of TrueToCrypto.com, with over a decade in blockchain and fintech, focusing on cryptocurrency security and fraud analysis.
Transparency: N. Singh holds cryptocurrency and uses Ledger and Trezor hardware wallets. TrueToCrypto does not offer, endorse, or accept payment from any crypto recovery service, and no affiliate links appear in this article. This article is educational and is not financial, legal, or psychological advice.
If you or someone you know has been affected, report to your national police and financial regulator. If the emotional impact is severe, please speak to a doctor or a mental health professional — the financial loss and the psychological harm are both real, and the second one is treatable.
Contact: info@truetocrypto.com
Figures drawn from FBI IC3 annual reports, Chainalysis Crypto Crime Reports (2025 and 2026), Cyvers, and UNODC regional findings. Verified October 2026.
