DefCrypt — Pig Butchering: A Long Con, Not a One-Off Scam

The name “pig butchering” comes from the Chinese term sha zhu pan, jargon used by operators: the victim is “fattened” with attention, romance, or friendship, shown fictitious profits, and only then “butchered” by taking their assets. FinCEN associates the scheme with fictitious identities, relationship scripts, and virtual-currency investments. The FBI describes both the relationship and the “investment” as fraudulent: the goal is a series of increasingly large deposits, not a single transfer.

What distinguishes it from a one-off scam is time and psychological leverage. Contact may begin with a “wrong number” text, a dating app, or social media; the conversation moves to a private messenger; and trust is built for weeks before crypto is mentioned. The FTC warns that when a new online acquaintance offers to “teach” you how to invest in cryptocurrency, it is an investment scam, not assistance.

Do not confuse pig butchering with theft from an already compromised wallet where you did not knowingly make the transfer; that scenario requires a different checklist. If the scheme has led to a fake “exchange” introduced through a chat, see the warning signs in crypto exchange scams. For the broader response after crypto fraud, see what to do after a crypto scam.

Based on FBI and FinCEN materials, a typical cycle looks like this:

1. Initial contact and “fattening”: frequent messages, empathy, isolation from family or friends, and refusal to join a normal video call.
2. The “investment lesson”: profit screenshots, an “exclusive pool,” and guaranteed returns.
3. The deposit: you buy crypto on a real exchange and send it to the “platform” address or the “mentor’s” wallet, placing the assets under the scammers’ control.
4. A fictitious increase in the displayed balance and, sometimes, a small withdrawal to build trust.
5. A large withdrawal is blocked pending a “tax,” “fee,” “insurance payment,” or “verification deposit.”
6. Pressure through urgency and shame, followed by disappearance once no more money can be extracted.

Early warning signs include contact that began by “accident”; a move to WhatsApp or Telegram; a request to hide the investment from family; promises of “risk-free” or guaranteed returns; and a platform you learned about only from this person. IC3 records billions of dollars in losses from crypto investment fraud. Through Operation Level Up, the FBI notified thousands of victims who were still planning to send more. Stopping at this stage is the critical gain.

1. Stop every transfer to the “mentor,” the platform, or any supposed withdrawal service, including the “final fee.”
2. End contact: do not argue in the chat or believe threats that you will “lose the profits already earned.”
3. Preserve messages, usernames, URLs, screenshots of the displayed balance and withdrawal error, dates, and amounts.
4. Record every outgoing TxID, network, and destination address in a block explorer.
5. Change passwords for your email and legitimate exchange accounts if you shared codes or signed in through links they sent; never enter your seed phrase.
6. Do not install an APK or “trading bot” from the chat, and do not connect your wallet to an unknown dApp.
7. Build a timeline: first message → deposits → demand for an additional payment.

At the same time, submit the TxID package for assessment. If the funds are still moving toward an exchange account, the window for requesting a freeze may be shorter than it appears. This is where blockchain analytics and, if the funds reach an exchange, work with the platform may help—but stopping further losses comes first. For the urgent response after pig butchering, see emergency response.

• Do not send a “tax,” “penalty,” or payment to a “recovery guarantor”; these are standard end stages of the scheme and often a second fraud.
• Do not provide your seed phrase, remote access, or 2FA codes “for an audit.”
• Do not open a second account using a “new support link” from the same platform.
• Do not believe threats involving shame or claims that you will “lose what you have already earned”; the displayed balance on a fake platform is not your money.

The FBI IC3 separately warns about fraudulent recovery services that demand up-front fees. Victims are often targeted again immediately after the original scheme.

Goal

Realistic action or outcome

Stop further losses

End contact and stop all additional payments

Preserve evidence

Messages, URLs, TxIDs, amounts, and dates

Trace funds to an exchange

Analyze the transaction chain; this is not always possible

Recover all funds

Not guaranteed; it depends on the route and the platforms involved

A legitimate assessment begins with evidence, not promises of a miracle. The outcome-based fee model is explained under success fee. Pressure to “pay today and withdraw tomorrow” almost always means the scheme is still trying to collect deposits.