Scam patterns

Pig butchering: the long investment scam explained

“Pig butchering” is the industry’s own name for it: fatten the pig before the slaughter. Weeks or months of real friendship or romance, then an investment that only exists on a website. It is not an improvised con by one person — it is run from organised centres with scripts, shifts and managers, and understanding how that machine works tells you both how to get out of it and what is still possible afterwards.

Updated 16 October 2026 · about 10 minutes to read

Where the name comes from

The term is a translation of a Chinese phrase used by the criminal groups themselves, shā zhū pán — the “pig-slaughtering plate”. The victim is the pig, the months of attention are the fattening, and the slaughter is the moment the deposits stop being returned. The name is ugly on purpose: inside the operation it is a business process, and the people running it talk about conversion rates, not about you.

What makes it different from ordinary fraud is the time invested before any money is mentioned. A classic scam wants your money in one conversation. This one is prepared to spend two months earning the right to ask.

Who is actually writing to you

Almost never the person in the photographs. International bodies including United Nations agencies and Interpol have documented large compounds in South-East Asia and elsewhere where this work is done at industrial scale — and where a significant share of the workers were themselves trafficked, recruited by fake job adverts, had their passports taken and are kept under quotas and punishment. Many of them are also victims.

Practically, this means three things for you:

• The script is not improvised. The warmth, the timing, the “accidental” mention of profit, the small successful withdrawal — all of it is written down, tested and reused.
• Several people play one character. The messages come in shifts, which is why tone and grammar shift slightly, and why they answer at unusual hours.
• Arguing with the person is pointless. They may personally be unable to stop, and your leverage is never with them — it is with the exchanges and the banks on the money path.

The four stages

• 1. Contact. A wrong number, a dating app, a comment under your post, a professional network, a message about a job. Thousands of approaches, and the script continues only with the people who answer.
• 2. Fattening. Weeks of ordinary life: photos, voice notes, the dog, the family, your plans. Money is not pushed — it leaks out as a detail of their successful life. The target is not greed, it is trust, and the most frequent victims are not naive people but busy, educated, lonely ones.
• 3. Feeding. A platform appears, almost always presented as something exclusive: an arbitrage bot, a liquidity-mining pool, a “company account” at a real exchange, sometimes a convincing clone of one. A small deposit grows. A small withdrawal succeeds. Then the amounts rise — bonuses, windows, tiers, a “manager” who joins the chat.
• 4. Slaughter. The withdrawal is blocked. A tax, a fee, an anti-money-laundering deposit, a “profit verification” payment. Each one paid produces the next. Pressure arrives: deadlines, a frozen balance, a suggestion to borrow, sometimes a fake official or a fake lawyer. Then silence — followed within weeks by the “recovery” offer, which is the same industry selling to the same list.

Where the money actually goes

Your deposit never entered a trading account. The typical path: you send USDT — most often on Tron or BNB Chain because fees are tiny — to an address the operation controls. Within hours it is split, hopped through a few intermediate addresses, and consolidated with money from other victims. Then it reaches a cash-out point: an account at a real exchange, an over-the-counter broker, a payment processor, or a chain of “mules”.

Two practical consequences:

• The cash-out point is the only place anything can be done. Addresses themselves cannot be frozen by anyone. Accounts at real platforms can be. That is why the first hours matter more than anything else you will do later, and why the whole purpose of tracing is to find a regulated company holding your money.
• USDT is sometimes freezable. Stablecoin issuers can block addresses, and they do when authorities require it. It is not a right you can exercise by asking politely — but it is a route that does not exist with a pure transfer in Bitcoin.

How to recognise it early

Four checks catch almost every case, and they cost nothing:

• Who started the conversation? If they wrote to you and the subject eventually became money, treat everything else as decoration.
• Does the platform exist outside their link? Search the name, look for coverage that is not on the site itself, check how old the domain is, see whether the app comes from a normal store listing with a long review history. Clones use a name one letter away from a famous exchange.
• Where does the deposit go? To a company account in its own legal name, or to a bare crypto address? Real venues cannot take client money to an anonymous address.
• Can you verify the balance independently? If the only evidence of your money is a number on their page, there is no money.

A fifth check for the romance version: ask for a live video call at a moment you choose, not a recorded one. Refusals, endless technical excuses or a twelve-second clip are the answer.

If you are inside it right now

This is the hardest part, because the attachment is real even when the person is not. In order:

• Do not send the next payment. Not a smaller one, not “just the tax”, not a loan. There is no amount that unlocks a balance that does not exist.
• Do not tell them what you now know. First export the entire chat history, save the profile, the username, the phone number, the platform URLs, your balance screens and every payment receipt.
• Write the money list. Each transaction hash, address, amount, asset, network, date and time with time zone — in a plain text file you can copy from.
• Tell one real person. Shame is what keeps people paying; a friend or relative who knows is the best protection against the next demand and against the recovery scam that follows.
• If you borrowed money, tell the lender or bank what happened — that conversation is far easier before the first missed payment than after.
• Then stop responding, block, and do not engage with any new account that contacts you about the case.

Afterwards: what is realistic

An honest summary, because the alternative is being sold hope by somebody:

• The sooner the better. In the first hours or days there is a real chance that the funds are still sitting at an identifiable cash-out point and that a compliance team or an authority can hold them. Our freeze request template and the 48-hour guide are built for that window.
• A police report is not a formality. Exchanges and banks need a case number and an official request to do more than note your complaint. See how to report crypto theft.
• Tracing is worth money only when it can lead somewhere. A report that ends at a regulated platform in a reachable jurisdiction is useful. A report that ends at an address nobody controls is a document, not a remedy — and an honest adviser will tell you which of the two you have before taking a fee.
• Nobody can guarantee a return. Not us, not a “recovery agency”, not anyone with an official-looking letterhead. If someone does guarantee it, that is the second scam: run the free seven-question check.
• Tax and reporting. In some countries a documented theft affects your tax position. It is worth asking an accountant locally once the report exists.

One more thing worth saying plainly: people who fall into this are not stupid. The operation spends weeks building the exact conditions in which a reasonable person makes a bad decision. What happened to you is a crime committed by an organisation, not a character flaw.