Skip to content

Crypto Investment ('Pig Butchering') Scams and Fake Recovery Agent Fraud

Xexlẽme kpatawo toa vovo le dukɔ ɖesiaɖe me. Axa sia zã 911, si nye xexlẽdzesi na United States kple Canada. Dukɔ bubu geɖewo zãa 112, 999, alo xexlẽdzesi bubu. Di xexlẽdzesi si le miaƒe dukɔa me.

Realizing that an online cryptocurrency, gold futures, foreign exchange (Forex), or decentralized finance (DeFi) liquidity-mining platform where you invested your savings is actually a Sha Zhu Pan ("Pig Butchering") scam is one of the most devastating financial and emotional crises a person can experience. Operated by transnational organized crime syndicates across Southeast Asia and globally, these scams spend weeks or months building a trusted romantic, friendship, or mentorship bond via WhatsApp, Telegram, LinkedIn, Instagram, Dating Apps, or an "accidental wrong-number text" before guiding you onto a counterfeit trading app or malicious Web3 smart contract.

The defining moment of a Pig Butchering scam happens when you try to withdraw your displayed account balance, often showing hundreds of thousands of dollars in fabricated profits, and the platform freezes your withdrawal, demanding that you first wire 15 to 30 percent in external "personal income taxes," "AML verification deposits," "blockchain gas clearance fees," or "credit score upgrades" to release your money. This guide gives you immediate, crystal-clear triage instructions to stop the financial bleeding, revoke live smart-contract drain permissions on your self-custody wallet, file actionable blockchain freeze requests with law enforcement and stablecoin issuers (Tether and Circle), and protect yourself from the Fake Crypto Recovery Agent ("Second Scam") vultures who target victims days later.

--- .

Wɔ esia fifia

  1. STOP sending any more money, never pay a "tax," "withdrawal fee," "AML security deposit," "gas fee," or "account unfreeze fee" to unlock a frozen balance. In 100 percent of legitimate regulated brokerages and cryptocurrency exchanges (such as Coinbase, Kraken, Gemini, Fidelity, or Interactive Brokers), any applicable transaction fees or tax withholdings are deducted directly from the balance inside your account. Any platform demanding that you send new out-of-pocket funds from your bank or external wallet to "unlock" an existing balance is a 100 percent fraudulent simulation. The millions of dollars displayed on your screen are fake HTML numbers controlled by the scammer's backend database; paying the "20 percent tax" will simply result in a new excuse ("cross-border audit fee") until you have zero dollars left.
  2. If you connected a self-custody wallet (Coinbase Wallet, MetaMask, Trust Wallet, Phantom, Rabby, or Ledger) to a "Liquidity Mining / AI Yield Node" DApp, immediately revoke all Unlimited Token Approvals (Approve / Permit2) OR move remaining funds in your wallet to a brand-new seed phrase. Many Pig Butchering scams tell you that your funds are "safe because they never leave your own Coinbase Wallet or Trust Wallet." In reality, clicking "Join Mining Pool" or "Receive Voucher" made you sign a malicious ERC-20 / TRC-20 increaseAllowance alo Approve(Unlimited) smart contract permission that lets the scammer's contract sweep 100 percent of the USDT/USDC sitting inside your wallet whenever they choose. Visit revoke.cash immediately or follow our cryptocurrency wallet drain and seed phrase compromise fia afɔɖoƒe.
  3. Preserve every single blockchain Transaction Hash (TxID), Deposit Wallet Address, URL, and WhatsApp/Telegram chat log BEFORE you confront or block the scammer. The moment you accuse the scammer of fraud, they will click "Delete Chat for Both Sides" on Telegram or WhatsApp and shut down the fake trading website, erasing the evidence you need for law enforcement and tax casualty loss deductions. Use a second phone or computer to photograph and export the entire chat history, screenshot your deposit history showing the exact 42-character (0x...), 34-character (T...), or bc1... destination wallet addresses, and copy every 64-character Transaction Hash (TxID) from your real exchange (Coinbase, Kraken, Binance, Crypto.com).
  4. If you sent a bank wire transfer, ACH transfer, or credit/debit card payment within the last 24 to 72 hours, call your bank's Wire Fraud Department immediately to request an emergency SWIFT Recall / FinCEN Rapid Response freeze. While irreversible blockchain transactions cannot be undone by your bank, bank-to-bank wire transfers to shell company accounts (often disguised as "import/export," "jewelry," or "consulting" LLCs in Hong Kong, New York, London, or Singapore) can sometimes be intercepted in correspondent banking queues if recalled within 24 to 48 hours. See our bank account breach and wire recall guide.
  5. NEVER hire any "Crypto Recovery Agency," "Blockchain Ethical Hacker," or "Cyber Refund Law Firm" that advertises on Google, YouTube comments, Reddit, Telegram, or Instagram. Every single private company or individual claiming they can "hack the scammer's wallet" or "recover your stolen USDT for an upfront fee or retainer" is running a Recovery Room Scam (often operated by the exact same syndicate that stole your money in the first place). Only sworn government law enforcement agencies with judicial seizure warrants can instruct Tether (USDT), Circle (USDC), or centralized exchanges to freeze and burn/reissue stolen funds.
  6. Prioritize your mental health and personal safety right now. Transnational scam syndicates employ teams of psychological manipulators trained to induce shame, isolation, and acute financial despair. Remember that doctors, software engineers, attorneys, bank CEOs, and retirees fall victim to this industrial-scale crime every single day. If you or a loved one are experiencing overwhelming despair or thoughts of self-harm, reach out to a trusted family member immediately and call your local crisis line (in the United States and Canada, call or text 988 for the Suicide & Crisis Lifeline; in the United Kingdom, call 111 or Samaritans at 116 123; or call your local emergency number at 911, 112, or 999, see all xexlẽdzesi siwo wozãna kpata).

Why the 'Small Test Withdrawal' worked at the beginning of the scam

Almost every victim of a Pig Butchering scam asks: "How could the platform be fake when it let me withdraw 500 dollars or 2,000 dollars right back to my real bank account during the first week?" That early withdrawal is the deliberate "baiting" phase of the scam script. When you first test the platform with 1,000 dollars, the scammers manually send you 1,200 dollars of real USDT out of their operational petty-cash wallet to convince you that the withdrawal button works and to disarm your skepticism. Once that 200-dollar payout convinces you to liquidate your 401(k), home equity line of credit, or life savings and deposit 50,000 or 250,000 dollars, the trap snaps shut and no further withdrawals are ever permitted.

--- .

Crypto investment scam & DeFi drain emergency triage decision tree

flowchart TD
    Root["Suspected Crypto Investment Scam ('Pig Butchering') or Frozen Withdrawal"] --> StopPay["RULE 1: Stop All Transfers Immediately, Never Pay 'Taxes', 'Gas', or 'AML Verification Fees'"]

    StopPay --> ModeCheck{"How Were Your Funds Transferred or Connected?"}

    ModeCheck -->|"Option A: Connected Self-Custody Wallet (Coinbase Wallet, Trust Wallet, MetaMask) to a 'Mining / Yield' DApp"| WalletRescue["1. Open revoke.cash immediately & revoke all Unlimited USDT/USDC Token Approvals<br/>2. If USDT is still showing in your own wallet address, immediately transfer it to a brand-new hardware/software wallet before the scammer sweeps it"]

    ModeCheck -->|"Option B: Sent Crypto (BTC, ETH, USDT, USDC) to a Deposit Address on a Fake Exchange App/Website"| TraceFreeze["1. Export all TxID hashes & Scammer Deposit Addresses BEFORE blocking scammer<br/>2. Trace hops on Etherscan / Tronscan / Breadcrumbs to find the Exchange Deposit Consolidation Address<br/>3. File FBI IC3 (US) / Action Fraud (UK) report + notify Tether/Circle & Destination Exchange Compliance"]

    ModeCheck -->|"Option C: Sent Bank Wire (SWIFT / Fedwire / SEPA / Faster Payments) within Last 72 Hours"| BankRecall["Call Bank Wire Fraud Dept Immediately: Request Emergency SWIFT gpi Stop-and-Recall & FinCEN Rapid Response Referral"]

    WalletRescue --> DeviceCheck["Audit Computer & Phone: Uninstall AnyDesk/TeamViewer, Delete Rogue iOS TestFlight / Enterprise Profiles, Rotate Exchange Passwords"]
    TraceFreeze --> DeviceCheck
    BankRecall --> DeviceCheck

--- .

Anatomy of the 3 technical variants of "Pig Butchering" platforms

Understanding which technical mechanism the syndicate used against you determines whether any funds are still sitting inside your own wallet waiting to be rescued right now:

Scam Architecture Variant How the Victim Experiences It What Actually Happens on the Blockchain Ðe Àte Ŋu Aɖe Ga Si Susɔ Fifiaa?
1. Aʋatso Centralized Exchange / Trading App (Wotsɔe de axadzi to Apple TestFlight, iOS Enterprise Profile, alakpa WebClip, alo domenyiŋusẽfianu si wowɔ alakpatɔe abe coin-pro-vip[.]com) . Èwɔa akɔnta le nyatakakadzraɖoƒe alo asitelefon dzi dɔwɔnu si le blɔ dzi, èwɔa gadzraɖoƒe ƒe adrɛs ƒe kɔpi (0x... alo T...), eye nàɖo crypto tso wò Coinbase/Kraken akɔnta ŋutɔŋutɔ me. Le screen dzi la, èkpɔa bosomikaɖi ƒe nɔnɔmetata siwo le agbe eye nèwɔa sɛkɛnd 60 ƒe "nodes / binary options / gold futures" asitsatsa siwo ɖua dzi 20% ɣesiaɣi. Asitsatsa ƒe nɔnɔmetatawo kple wò $300,000 ƒe ga si susɔ ɖe akɔnta me nye alakpa nyatakakadzraɖoƒe ƒe nyawo 100%. Le miniti 3 me tso esime wò ga ŋutɔŋutɔ va ɖo ametafakala la ƒe gakotoku ƒe adrɛs gbɔ la, ŋɔŋlɔdzesi aɖe si wowɔ le wo ɖokui si tsɔ wò USDT/BTC ŋutɔŋutɔ kplɔ yi gakotoku si me wodzraa nu ɖo le titina. Kpekpeɖeŋunana ɖokuiwò ƒe gaɖeɖe aɖeke mate ŋu adzɔ tso aʋatso dɔwɔnua me o. Ele be nàdi blockchain hops (TxID) tso wò gadeƒe ƒe adrɛs gbãtɔ dzi yi off-ramp exchange eye nàtsɔ sedzikpɔlawo ƒe freeze biabia aɖo ɖa.
2. Malicious Web3 DeFi "Liquidity Mining / Smart Pool" Drainer (Wokpɔe le Coinbase Gakotoku, Kakaɖedzi Gakotoku, MetaMask, alo SafePal ƒe nyatakakadzraɖoƒe si wotu ɖe eme la me) Ameflula la gblɔ na wò be: "Mehiã be nàɖo ga ɖe ame aɖeke gbeɖe o. Ðeko nàna wò USDT nanɔ wò ŋutɔ wò Coinbase Wallet si dziɖuɖua da asi ɖo la me, ʋu DApp ƒe web-browser, yi tomenukuƒe ƒe kadodo sia, eye nàzi 'Receive Voucher / Join Node' dzi be nàkpɔ 1.5% gbesiagbe." Ne èzi "Xɔ Voucher" alo "Confirm" dzi la, àdo smart-contract ƒe asitsatsa si nye ** ŋutɔŋutɔ.Approve(Spender: ScammerContract, Amount: Unlimited USDT). Gbã la, ameflula la gblẽa wò USDT ɖe wò gakotoku me eye wòɖoa gbesiagbe fetu suesuesuewo ɖe wò ale be nàtsɔ ga geɖe akpe ɖe eŋu; ne wò gakotoku me ga si susɔ ko la, woƒe nubabla yɔa ** .transferFrom() eye wòɖea wò USDT ƒe 100% le sɛkɛnd 1 me. Ẽ, NE womehe ʋuƒoa haɖe o: Ne wò USDT ŋutɔŋutɔ ganɔ anyi ɖe wò ŋutɔ wò Coinbase Wallet / Trust Wallet adrɛs me fifia la, yi ** enumakerevoke.cash** be nàte fli ɖe dzesi ƒe mɔɖeɖea me, ALOO nàɖo wò USDT tso gakotoku ma me ɖe wò Coinbase Exchange akɔnta ŋutɔŋutɔ me enumake hafi ametafatafakala la nade dzesii.
3. Adzɔge-Adzɔge Kpekpeɖeŋunana Gadzraɖoƒe/Xɔɖɔli Tsidzɔƒe (Ametafatafala fiaa mɔ wò to screen-share alo AnyDesk / TeamViewer / Zoom) "Mɔfiala" alo "VIP akɔntadzikpɔla" kpena ɖe ŋuwò nèɖoa wò Kraken, Coinbase, alo gadzraɖoƒe ka to screen share dzi, alo dea adzɔge kpekpeɖeŋudɔwɔnu ɖe ​​wò kɔmpiuta/telefon dzi. Ameflula la léa wò session cookies, API keys, alo 2FA codes, alo léa ŋku ɖe wò screen ŋu esime wòle woƒe gaɖeɖe ƒe adrɛs ŋlɔm ɖe wò exchange account si le se nu dzi. Enumake ɖe kɔmpiutaa ɖa le Wi-Fi ŋu, ɖe dɔwɔnu siwo le didiƒe ɖa (kpɔ míaƒe... tech support scam kple AnyDesk ɖeɖeɖa ƒe mɔfiame), eye nàtu wò gaɖɔliɖoɖo ŋutɔŋutɔ.

--- .

Afɔɖeɖe 1: Ʋɔnudrɔ̃ƒe ƒe kpeɖodziwo takpɔkpɔ (Wɔ esia HAFI nàdze ŋgɔ ametafatafakala) .

Vodada gãtɔ ɖeka si amesiwo ŋu wowɔ nuvevii wɔnae nye be woaɖo nyatakakawo ɖe ameflula la to asitelefon dzi "Menya be ametafakalae nènye, trɔ nye ga nam alo mele ka yɔm na FBI." Zi alesi nèɖo gbedasi ma ɖa teti ko la, habɔbɔa dzikpɔla zia abɔta ɖeka si tutu Telegram/WhatsApp ka si le telefon eveawo dzi eye wònaa wò gege ɖe aʋatso asitsatsa ƒe nyatakakadzraɖoƒea megawɔa dɔ o.

Hafi nàgblɔ nya aɖe na ametafakala la, wɔ abe ɖe nèle "dɔ wɔm kple wò gadzraɖoƒe be yeaƒo adzɔxexe/kakaɖedzigawo nu ƒu" hena miniti 30 esime nèle kpeɖodzigbalẽ sia tututu ɖem:

  1. Dɔ Blockchain ƒe Asitsatsa Hash ɖesiaɖe (TxID) kple Gakotoku ƒe Adrɛs tso wò REAL exchange:
  2. Ge ɖe cryptocurrency exchange alo gakotoku si le se nu si nèzã tsɔ ƒle crypto la eye nèɖoe ɖa (abe Coinbase, Kraken, Robinhood, Crypto.com, Gemini, Binance, Cash App, alo PayPal ene).
  3. Ʋu wò Asitsatsa / Gaɖeɖe Ŋuti Ŋutinya na asitɔtrɔ ɖesiaɖe si nèɖo ɖe ametafatafa ƒe mɔ̃a dzi.
  4. Kɔpi eye nàdzrae ɖo abe nuŋɔŋlɔ dzro ene (menye screenshots ɖeɖeko o, elabena numekulawo hiã ŋɔŋlɔdzesiwo ƒe ka siwo woate ŋu awɔ kɔpi-kpe ɖe wo ŋu):
    • UTC Ɣletiŋkeke, Ɣeyiɣi, kple Dollar/Crypto Ga home si sɔ pɛpɛpɛ le gaɖeɖe ɖesiaɖe me.
    • Nunɔamesi & Blockchain Network (e.g., . USDT on Tron TRC-20, . USDC on Ethereum ERC-20, alo Bitcoin BTC).
    • Wò Gakotoku ƒe Adrɛs si nèɖo ɖa.
    • Ametafatafawɔla ƒe Gaxɔgbalẽvi Xɔxɔ / Ga Dede Gakotoku ƒe Adrɛs (e.g., 0x71C... alo TX9k...).
    • Ŋɔŋlɔdzesi 64 ƒe hexadecimal Transaction Hash (TxID / . TxHash) na asitɔtrɔ ɖekaɖeka ɖesiaɖe.
  5. Screenshot eye screen-record Fake Trading App / Nyatakakadzraɖoƒea esime nègate ŋu ge ɖe eme kokoko:
  6. Lé video aɖe si me woɖea asi le le asitelefon dzi ɖaa si me:
    • URL / domenyiŋkɔ tututu si le alakpa mɔ̃a ŋu le browser ƒe adrɛs ƒe akpaa dzi.
    • Wò aʋatso Account Dashboard / UID xexlẽdzesi, aʋatso asitsatsa ŋutinya, kple "Deposit" screen si fia gakotoku ƒe adrɛs si nye platform si wode asi na wò.
    • "Asitsalawo ƒe Dɔwɔƒe / VIP Kpekpeɖeŋu" dzeɖoɖo fesre si le mɔ̃a me afisi wobiaa adzɔ 15 va ɖo 30% alo AML fetu (vevietɔ gakotoku ƒe adrɛs ɖesiaɖe si wona hena "adzɔa" xexe, elabena gakotoku ma dzie habɔbɔa léa ŋku ɖo vevie egbea).
  7. Tsɔ WhatsApp, Telegram, alo Signal chat archive bliboa yi duta:
  8. Le WhatsApp: Ʋu dzeɖoɖoa kple ameflula la -> zi woƒe profile ŋkɔ le etame -> ʋu yi ete eye nàzi Export Chat -> Include Media -> save the .zip nudzraɖoƒe ɖe wò kɔmpiuta alo Google Drive/iCloud dzi. Azɔ hã, screenshot woƒe telefon xexlẽdzesi, profile fotowo, kple gbeɖiɖi nuŋlɔɖi ɖesiaɖe alo video kaƒoƒo si wolé ɖe mɔ̃ dzi.
  9. Le Telegram dzi: Ʋu Telegram Desktop le kɔmpiuta dzi -> ʋu dzeɖoɖoa -> zi teƒe etɔ̃ (⋮) le etame-ɖusime -> Export chat history -> de dzesi aɖakaawo katã (Fotowo, Gbe gbedasiwo, Video gbedasiwo) eye nàɖoe ɖa abe HTML/JSON ene. Zi woƒe profile hã dzi be nàkpɔe ɖa be woƒe xexlẽdzesi Telegram User ID le dzedzem hã (to vovo na... @usernames si ameflulawo trɔna gbesiagbe, xexlẽdzesi Telegram Zãla ID la nɔa anyi ɖaa).

--- .

Afɔɖeɖe 2: Alesi nàwɔ akpɔ wò ga siwo nèfi la le blockchain la dzi eye nàbia Tether kpata (USDT) / Asitɔtrɔ ƒe tsikpe

To vovo na ga ŋutɔŋutɔ si wotsɔ de mɔzɔkplo me la, Bitcoin ɖesiaɖe (BTC), Ethereum (ETH / . ERC-20), kple Tron (TRX / . TRC-20) woŋlɔa asitsatsa ɖe xexeame katã ƒe agbalẽ gã si womate ŋu atrɔ o dzi tegbee. Ele be ga si wofi ƒe habɔbɔ deŋgɔwo gɔ̃ hã natsɔ ga siwo wofi la ayi teƒe eve siwo sedzikpɔlawo ate ŋu atɔ te nunɔamesiwo le la dometɔ ɖeka mlɔeba:

Chokepoint 1: Centralized Stablecoin Smart Nubablawo (Tether USDT kple Circle USDC) .

Haƒoƒo ƒe ametafatafa siwo wu 80 le alafa me bia be woaxe fe le USDT (Tether) me le Tron (TRC-20) alo Ethereum ( .ERC-20) blockchain, alo USDC (Kɔkɔe). - Nusi amesiwo ŋu wowɔ nuvevii ƒe akpa gãtɔ menya o enye be Tether (USDT) kple Kɔkɔe (USDC) smart contracts me dɔdzikpɔdɔ si wotu ɖe wo me si woyɔna be ** .addBlackList(address) / . freeze(address)**. - Ne Tether Limited alo Circle xɔ sedzikpɔlawo ƒe freeze biabia kpata si ɖee fia be wofie USDT alo USDC le anyinɔƒe le habɔbɔ ƒe gakotoku ƒe adrɛs si womexɔ o me (0x... alo T...), Tether ate ŋu atsɔ nya ɣaɣlawo atɔ te gakotoku ƒe adrɛs ma ɖe blockchain la dzi ale be ametafatafakala la mate ŋu aʋuʋu USDT la alo azãe gbeɖe o, eye ne ʋɔnudrɔ̃ƒea de se be woaxɔe le ame si la, Tether ate ŋu tɔ dzo (destroyBlackFunds) dzesi siwo wofa tsikpe me le ametafatafakala la ƒe gakotoku kple gakotoku si wotsɔ ɖɔa li gakotoku me USDT tẽe trɔ yi amesi ŋu wowɔ nuvevii gbɔ.

Chokepoint 2: Centralized Exchange (CEX) ƒe Gadzraɖoƒe ƒe Gakotokuwo

Be woatrɔ ame si wofi BTC, . ETH, alo USDT ɖe fiat ga me (China Yuan, United States Dollars, Thai Baht, alo UAE Dirhams), ametafatafalawo tsɔa ga toa domedome "hop" gakotoku 2 va ɖo 6 dzi hafi tsɔa wo dea Deposit Address le Centralized Exchange gã aɖe me (abe Binance, OKX, HTX/Huobi, Bybit, Gate.io, KuCoin, alo Kraken ene).

Ale si nàwɔ akpɔ wò TxID le miniti 5 me zã dutoƒo block explorers femaxee

  1. Kpe wò Asitsatsa Hash (TxID) yi ɖe block explorer si dziɖuɖua da asi ɖo me na network ma:
  2. Ethereum (ETH, . USDT-ERC20, . USDC): Sasrã etherscan.io ** .
  3. Tron (TRX, . USDT-TRC20): Sasrã tronscan.org ** .
  4. Bitcoin (BTC): Sasrã mempool.space alo blockchair.com ** .
  5. Nukpɔkpɔ Multi-Hop Graph Tracer (Free tier): Tsa le breadcrumbs.app alo metasleuth.io eye nàde wò scammer deposit address be nàwɔ automatic visual flow diagram si aɖe hop ɖesiaɖe afia.
  6. Dze hops yi ŋgɔ tso wò Deposit Address dzi:
  7. Zi Ametafatafawɔla ƒe Gadzraɖoƒe ƒe Adrɛs (To: field) le wò asitsatsa gbãtɔ me, emegbe nàzi ** .Token Transfers (ERC-20 / TRC-20)** tab be nàkpɔ afisi ametafatafakala la tsɔ wò dzesiwo yi kplɔe ɖo.
  8. Dze ɖoɖo gã siwo wotsɔ yia gota la yome hops 1 va ɖo 4 yi ŋgɔ vaseɖe esime nàkpɔ wo dometɔ ɖesiaɖe:
    • "Holding / Piggybank" Gakotoku si da sɔ ŋutɔ: Gakotoku si womeŋlɔ ŋkɔ na o si me $50,000 va ɖo $10,000,000+ le fifia le static me USDT alo USDC (taɖodzinu vevitɔ na Tether / Circle Smart-Contract Freeze enumake).
    • A Labeled Exchange Deposit Address: Le Etherscan alo Tronscan dzi la, adrɛs mamlɛtɔ si dzi woɖoe ɖo la aɖe dutoƒo ŋkɔdzesi abe ** ene afia zi ɖeka.Binance 14, ** .OKX 7, ** .HTX 2, alo ** .Bybit. Gakotokua afɔɖeɖe ɖeka enumake do ŋgɔ na (From:) si woŋlɔ ɖe edzi be exchange hot wallet nye ameflula la ŋutɔ ƒe Asitsalawo ƒe Deposit Address le exchange ma (si sɔ kple ememe akɔnta si me KYC nuŋlɔɖiwo, IP logs, kple ga siwo woate ŋu axe mɔ na le).

--- .

Afɔɖeɖe 3: Sedziwɔwɔ & asitɔtrɔ ƒe nyatakakawo ɖɔliɖɔli ƒe ɖaseɖigbalẽ si dziɖuɖua ɖo (Le ɖoɖo si tututu woatsɔ aɖo nɔƒe gbãtɔ nu)

Sedzikpɔlawo xɔa nyatoƒoetoto akpe geɖe siwo me mekɔ o gbesiagbe; nyatoƒoetoto siwo gblɔna ko be "Mebu $80,000 na nyɔnuvi aɖe si ŋkɔe nye Sophia le WhatsApp" la nɔa fli me ɣleti geɖe. To vovo na ema la, nyatakaka si woɖo ɖe ɖoɖo nu si ƒe tanyae nye "URGENT LIVE CRYPTO FREEZE REQUEST: $80,000 USDT-TRC20 Fifia Sitting in Unhosted Wallet [Address] / Deposited to Binance via TxID [Hash]" na nane Internet dzi nuvlowɔwɔ dɔwɔlawo si woate ŋu atɔ ɖe tsikpe me le ŋdɔ ma ke me.

1. United States ƒe Ame Siwo Ŋu Wowɔ Nuvevi Le

  • FBI ƒe Internet dzi Nuvlowɔwɔ Ŋuti Nyatoƒoetoto Dɔwɔƒe (ic3.gov): Ðo nyatakaka enumake ɖe ** .https://www.ic3.gov**. De Adzɔnu Hashes (TxIDs), Scammer Wallet Addresses, kple Identified Destination Exchange (e.g., Binance/OKX/Tether) ɖesiaɖe le ganyawo ƒe asitsatsa ƒe akpa tɔxɛwo me ale be FBI ƒe Recovery Asset Team (RAT) kple Virtual Asset Unit (VAU) automated parsers ŋlɔa gakotokua ƒe adrɛswo enumake.
  • United States Adzamekpovitɔwo ƒe Dɔwɔƒe (USSS) ƒe Gbeadzi Dɔwɔƒe & Nutoa Me Kpovitɔwo ƒe Nyatakaka: Ƒo ka na wò nutome U.S. Adzamekpovitɔwo ƒe Internet dzi Ametafatafa Dɔwɔha ƒe gbeadzidɔwɔƒe tẽ to telefon dzi (woŋlɔe ɖe... secretservice.gov/contact/field-offices) EYE nàzɔ ayi wò nutoa me dudzikpɔƒe ƒe kpovitɔwo ƒe dɔwɔƒe be nàxɔ Kpovitɔwo ƒe Nudzɔdzɔ Ŋuti Nyatakaka Xexlẽdzesi si le se nu (àhiã kpovitɔwo ƒe nya ƒe xexlẽdzesi sia be wòahe tsikpe kpata aɖe vɛ le Binance, OKX, alo Tether).
  • Adzɔnuwo ƒe Etsɔme Asitsatsa Dɔwɔha (CFTC) & SEC: Tsɔ nyatakaka si nye whistleblower/ametafatafa ƒe nyatakaka yi cftc.gov/complaint kple sec.gov/tcr.

2. United Kingdom, Canada, Europa Dukɔwo ƒe Ðekawɔha, kple Australia Ame Siwo Ŋu Wowɔ Nuvevi Le

  • United Kingdom: Tsɔ nyatakaka enumake yi Action Fraud (actionfraud.police.uk alo nàƒo ka 0300 123 2040) eye nàbia NFRC (Dukɔa ƒe Ametafatafa Ŋuti Nyatakaka Dɔwɔƒe) ƒe Nuvlowɔwɔ Ŋuti Nyatakaka Xexlẽdzesi. Ne gadzraɖoƒe ƒe gaɖoɖo ɖe amewo ŋu le UK me la, yɔ Authorized Push Payment (APP) Fraud Reimbursement / Contingent Reimbursement Model ƒe sewo kple wò gadzraɖoƒe enumake.
  • Canada: Tsɔ kpovitɔwo ƒe nyatakaka yi kpovitɔwo ƒe dɔwɔƒe si le mia gbɔ ƒe Ganyawo Ŋuti Nuvlowɔwɔ Dɔwɔƒe EYE nàtsɔ gakotoku ƒe adrɛswo katã aɖo ɖe Canada Anti-Fraud Center (antifraudcentre-centreantifraude.ca).
  • Australia: Nyatakaka enumake to ReportCyber (cyber.gov.au) kple Dukɔa ƒe Ameflunyawo Gbɔkpɔƒe (scamwatch.gov.au), eye nàƒo ka na wò gadzraɖoƒe ƒe ametafatafa ƒe dzidziɖedzi ƒe ƒuƒoƒoa.
  • Europa Dukɔwo ƒe Ðekawɔha: Tsɔ nya ɖe ame ŋu le nuvlowɔwɔ ta (Anzeige / . Plainte) le miaƒe nutoa me dukɔa ƒe kpovitɔwo ƒe dɔwɔƒe be nàxɔ nya ƒe xexlẽdzesi na Europol / dukɔa ƒe Internet dzi dɔwɔƒewo.

3. Nyatakaka Tsã na Destination Exchanges & Stablecoin Issuers (Kple Wò Kpovitɔwo ƒe Nya Xexlẽdzesi)

Ne ènya xɔ wò Kpovitɔwo ƒe Nyatakaka Xexlẽdzesi kple IC3 ƒe Kpeɖodzi Xexlẽdzesi ko la, tsɔ Victim Freeze Support Ticket tẽ ɖo ɖe exchange si me wò ga siwo nèdi la ƒe sedziwɔwɔ ƒe dɔwɔƒe (alo na Chainalysis / TRM Labs dutoƒo victim portals): - Binance Sedziwɔwɔ / Victim Freeze Request: Ʋu kpekpeɖeŋunaɖoɖo le binance.com -> Ka nya ta tso Ga siwo wofi ŋu -> na Deposit la tututu TxID, Binance Deposit Address, kple wò Kpovitɔwo ƒe Nyatakaka + Kpovitɔ ƒe Kadodo ƒe Email ale be Binance tsɔa ŋkeke 7 ƒe ameŋububu ƒe sedziwɔwɔ ƒe ɣeyiɣi kpui aɖe ƒe mɔxenu ɖoa anyi esime wòle kpovitɔa ƒe biabia le se nu lalam. - OKX / HTX / Bybit / Kraken / Coinbase: Email alo ɖo tikiti to woƒe dziɖuɖu Sedziwɔwɔ / Ametafatafa Nyatakaka ʋɔtru kple wò traced TxID kɔsɔkɔsɔ kple numekuku kpovitɔ ƒe email.

--- .

Afɔɖeɖe 4: Wò mɔ̃wo, akɔntabubu ŋutɔŋutɔwo, kple amenyenye ƒe dedienɔnɔ le ametafatafaa megbe

Le Haƒoƒo ƒe ametafatafa aɖe me la, zi geɖe la, amesiwo ŋu wowɔ nuvevii la naa nu geɖe wu cryptocurrency dzro aɖe ko na ameflula la:

  • Ðe nèda wò Mɔzɔgbalẽ, Ʋukugbalẽvi, alo Hadomegbenɔnɔ ƒe Dedienɔnɔ Xexlẽdzesi ƒe foto ɖe "KYC Verification" wɔɣi le aʋatso asitsatsa ƒe nyatakakadzraɖoƒea? Ne ègblɔ be ẽ la, fifia habɔbɔa lé wò dziɖuɖu ƒe ID ƒe nɔnɔmetata si ƒe lolome deŋgɔ eye woadzrae alo azãe hena amenyenye ƒe ametafatafa. Enumake tsi wò gaxɔgbalẽviwo nu ƒu kple Equifax, Experian, kple TransUnion to míaƒe... identity fififi ƒe ŋuɖoɖo ƒe mɔfiame.
  • Ðe nèzã "Enterprise Developer Profile," "WebClip," alo Apple TestFlight tsɔ da dɔwɔnu aɖe ɖe wò iPhone dzia? Yi Settings > General > VPN & Device Management le wò iPhone dzi fifia, zi Enterprise App / Configuration Profile ɖesiaɖe si woŋlɔ ɖi dzi, eye nàzi Delete Profile / Delete App dzi.
  • Ðe nèwɔ eƒe kɔpi aɖe .apk file onto your Android phone outside the Google Play Store? Ðe dɔwɔnua ɖa enumake, ʋu Google Play Protect, eye ne èna mɔɖeɖe app la Accessibility la, wɔ wò fotowo ƒe kɔpi eye nàgbugbɔ aɖo telefon la le dɔwɔƒe (kpɔ míaƒe... stalkerware, spyware, kple keylogger detection le telefonwo dzi fia afɔɖoƒe).
  • Ðe ameflula la bia tso asiwò kpɔ be nàde AnyDesk, TeamViewer, RustDesk, alo screen-share wò kɔmpiutaa? Dze míaƒe... tech support pop-up scam kple adzɔge kplɔ̃ dzi ɖeɖeɖa mɔfiame be nàkɔ adzɔgedzikpɔmɔ̃ siwo dzi womekpɔna o ŋu, eye nàtrɔ nyagbewo kple 2FA le wò gadzraɖoƒe kple e-mail akɔnta ŋutɔŋutɔwo dzi.
  • Kpɔ Dukɔa ƒe Akɔntanyala (CPA) alo adzɔxexe ŋuti senyala si si mɔɖegbalẽ le ku ɖe Adzɔxexe / Fififi ƒe Bubu ƒe Sewo ŋu: Le ʋɔnudrɔ̃ƒe aɖewo (abe le IRS Internal Revenue Code Section 165©(2) te le United States le asitsatsa siwo wowɔ hena viɖekpɔkpɔ ta, kpɔ IRS Chief Counsel Memorandum 202511015), documented victims of investment/Pig Butchering fraud afisi viɖe ƒe susu nɔ adzɔxela la si ate ŋu adze abia Fififi ƒe Nubuname ƒe Ðeɖe le woƒe adzɔxegbalẽvi dzi ne wodzra woƒe kpovitɔwo ƒe nyatakaka, IC3 ƒe agbalẽŋɔŋlɔ, kple asitsatsa ŋuti nuŋlɔɖiwo ɖo.

--- .

Alesi woade dzesi "Aʋatso Crypto Recovery Agent" (Ametafatafa Evelia) eye woaxe mɔ ɖe enu

Le ŋkeke alo kwasiɖa aɖewo me tso esime nèbu ga le Haƒoƒo ƒe ametafatafa aɖe ta la, Recovery Room Scam la aɖo taɖodzinu na wò:

  1. Alesi wokpɔa wòe:
  2. Direct Re-Targeting by the Original Syndicate: Kwasiɖa etɔ̃ le wò ga fifi megbe la, ametafatafa ƒe kaƒoƒe ma ke ɖoa gbedasiwo ɖe wò le WhatsApp alo email dzi wòwɔna abe ɖe yenye "Interpol Cyber Division," "The Global Blockchain Asset Recovery Commission," "Tether Refund Bureau," alo "Law Firm / Cyber Forensics Company." Wonya dɔlar agbɔsɔsɔme si tututu nèbu kple tɔwò xoxo gakotoku ƒe adrɛs (elabena woawoe fie), si na woɖina abe akunyawɔwɔ ƒe kakaɖedzi ene.
  3. Social Media Bot Swarms: Ne ègblɔ nya le YouTube, Reddit, X (Twitter), alo Facebook dzi tso ametafatafa ŋu la, automated bots ɖoa eŋu enumake be: "Mebu $90k hã, gake akpe na Mawu." @Cyber_Trace_Recovery_Official le Telegram/Instagram dzi la xɔ nye ga ƒe 100% le gaƒoƒo 48 me."
  4. Alesi Recovery Scam wɔa dɔe:
  5. "Gbugbɔgaxɔ ŋuti nunyala" la ɖea aʋatso screenshot aɖe fiana wò si gblɔ be "woke ɖe wò ga si wofi ŋu eye woda wo ɖe tsikpe me le smart contract / darknet escrow wallet me," eye wòbia tso asiwò be nàxe $1,500 va ɖo $5,000 do ŋgɔ ɖe "smart-contract activation software," "bridging liquidity," alo "legal bond insurance" ta, alo bia tso asiwò be nàtsɔ "recovery wallet" si ŋu woda asi ɖo la tso duta vɛ nyagbɔgblɔ eye nàtsɔ ETH dɔlar 2,000 ade eme ɖe gasfewo ta (si automated sweeper bot fi le sɛkɛnd 0.5 me).
  6. Se si dzi womate ŋu agbã o:
  7. Mɔ̃ɖaŋununya ƒe ŋutete mele ame ŋutɔ ƒe hacker, recovery company, alo forensic dɔwɔƒe aɖeke si le Anyigba dzi be wòatrɔ blockchain ƒe asitsatsa alo adze ameflula ƒe safui si nye ame ŋutɔ tɔ me o.
  8. Sedzikpɔlawo (FBI, Secret Service, Action Fraud, Europol) kple Tether/Circle MEXƆA fe, adzɔ, alo cryptocurrency gas dede ga si woda ɖe gaxɔ me la tso amesiwo ŋu wowɔ nuvevii si be woatsɔ atrɔ ga si woxɔ la GBEÐE o.

--- .

Nya siwo wobiaa amewo enuenu

My scammer says that if I don't pay the 20% withdrawal tax within 48 hours, the platform will freeze my account permanently, charge me a 5% daily late fee, and report me to the IRS / credit bureaus for tax evasion or money laundering. Can they ruin my credit or have me arrested?

No, every word of that threat is a complete fabrication designed to induce panic so you wire them one last payment before you think clearly. The fake trading website has zero connection to the IRS, HMRC, FinCEN, or any credit bureau (Equifax, Experian, TransUnion). You do not owe taxes on fabricated profits that never existed on a fake website, and a criminal syndicate operating out of an illegal compound cannot file a credit report or lawsuit against you. Block them after exporting your chat logs and do not send a single cent more.

The person who introduced me to the platform video-called me on FaceTime/WhatsApp every day for two months, she was a real person I saw on camera, so how could she be a scammer?

Modern Pig Butchering compounds do not rely only on stolen static photos. Syndicates employ human models ("camera hosts") kept specifically in staged luxury apartment sets to conduct live 5-minute video calls and send personalized daily cooking or gym videos to hundreds of victims simultaneously while a team of keyboard operators handles the text chats, or they use real-time GPU **Deepfake Face-Swap and Voice-Cloning software** over OBS Virtual Camera. Even if you saw a real face on a live video call, the investment platform they directed you to is 100 percent controlled by the syndicate. See our [deepfake voice clone and AI impersonation scams](../digital-and-tech/deepfake-voice-clone-and-ai-impersonation-scams.md) guide.

The scammer offered to pay "half" of my $30,000 tax/unfreeze fee out of their own pocket if I come up with the other $15,000. Doesn't that prove they are really trying to help me?

No, this is known in fraud investigations as the **"Co-Payment / Half-Share Trap"** and is Stage 4 of every standard Pig Butchering manual. Because the scammer's coworkers run the fake trading website, typing "+$15,000" into your on-screen tax balance costs the scammer **zero real dollars**, they simply edit a number in their database (or send USDT from one of their own wallets back to another one of their own wallets) to make you think they generously chipped in $15,000 for you, guilting you into wiring your last real $15,000.

I bought the cryptocurrency on Coinbase/Kraken and sent it to the scammer myself, will Coinbase or my bank reimburse me like a stolen credit card?

When you personally log into your bank or cryptocurrency exchange, pass 2FA, and authorize an outbound wire or crypto withdrawal (even under the psychological manipulation of a scammer), banks classify the transaction as an **"Authorized Push Payment (APP)"** rather than an unauthorized account hack. In the United States, Regulation E and the Electronic Fund Transfer Act generally cover *unauthorized* transfers (where a hacker broke into your account), not authorized scam transfers, though you should still file a formal bank fraud report and law enforcement asset-freeze request immediately. In the United Kingdom, however, mandatory **Payment Systems Regulator (PSR) APP Fraud Reimbursement rules** require UK banks to reimburse victims of Faster Payments / CHAPS authorized push payment scams up to statutory limits unless the customer acted with gross negligence.

--- .

Mɔfiame siwo do ƒome kplii

--- .

Wolé ŋku ɖe dzɔtsoƒewo ŋu

  • Dukɔa ƒe Numekuku Dɔwɔƒe (FBI) Internet dzi Nuvlowɔwɔ Ŋuti Nyatoƒoetoto Dɔwɔƒe (IC3) (United States): Cryptocurrency Investment Fraud ("Pig Butchering") Dudɔnunɔlawo ƒe Gbeƒãɖeɖewo, Recovery Asset Team (RAT) ƒe Dɔwɔnawo, kple Aʋatso Crypto Recovery Schemes Nuxlɔ̃ame.
  • Ganyawo ƒe Nuvlowɔwɔwo Dzi Kpɔkpɔ ƒe Habɔbɔ (FinCEN) (United States ƒe Ganyawo Gbɔkpɔƒe): FinCEN Nuxlɔ̃ame FIN-2023-Alert005: Virtual Currency Investment Scam si bɔ si woyɔna zi geɖe be "Haƒoƒo" (Aflaga Dzĩwo kple Nuwɔwɔ Kaba ƒe Ðoɖo).
  • Adzɔnuwo ƒe Etsɔme Asitsatsa Dɔwɔha (CFTC) & Dedienɔnɔ Kple Asitsatsa Dɔwɔha (SEC) (United States): Dɔwɔƒe si Kpɔa Gadelawo ƒe Hehenaƒe kple Taʋiʋli ƒe Nuxlɔ̃ame: Ƒomedodowo me Gadede Asi na Ametafatafawo kple Ameflunyawo Gbɔkpɔha siwo Kpɔa Nuwo Gbɔ.
  • Dukɔa ƒe Internet Dzi Dedienɔnɔ Dɔwɔƒe (NCSC) & Fexexe ƒe Ðoɖowo Dzikpɔla (PSR) (United Kingdom): Ametafatafa Fexexe (APP) ƒe Ametafatafa ƒe Fexexe ƒe Sewo kple Lɔlɔ̃/Gadede Asi na Ametafatafa ƒe Mɔfiame.
  • Dukɔ Ƒoƒuawo ƒe Dɔwɔƒe si Kpɔa Atike Vɔ̃ɖiwo Kple Nuvlowɔwɔ Gbɔ (UNODC) & INTERPOL: Dukɔwo Dome Nuvlowɔwɔ Kple Tsatsadada Siwo Woɖo Ðe Ðoɖo Nu, Internet Dzi Ametafatafa, Kple Aʋatso Gadede Dɔwɔƒewo ƒe Dɔwɔnawo Ŋuti Numekuku.