ʻO Crypto Investment ('Pig Butchering') nā hoʻopunipuni a me ka hoʻopunipuni a ka mea hoʻihoʻi hoʻopunipuni¶
He ʻokoʻa nā helu ulia pōpilikia ma ka ʻāina. Hoʻohana kēia ʻaoʻao i ka 911, ka helu no ʻAmelika a me Kanada. Nui nā ʻāina ʻē aʻe i hoʻohana i ka 112, 999, a i ʻole ka helu ʻē aʻe. E huli i ka helu no kou ʻāina.
Realizing that an online cryptocurrency, gold futures, foreign exchange (Forex), or decentralized finance (DeFi) liquidity-mining platform where you invested your savings is actually a Sha Zhu Pan ("Pig Butchering") scam is one of the most devastating financial and emotional crises a person can experience. Operated by transnational organized crime syndicates across Southeast Asia and globally, these scams spend weeks or months building a trusted romantic, friendship, or mentorship bond via WhatsApp, Telegram, LinkedIn, Instagram, Dating Apps, or an "accidental wrong-number text" before guiding you onto a counterfeit trading app or malicious Web3 smart contract.
The defining moment of a Pig Butchering scam happens when you try to withdraw your displayed account balance, often showing hundreds of thousands of dollars in fabricated profits, and the platform freezes your withdrawal, demanding that you first wire 15 to 30 percent in external "personal income taxes," "AML verification deposits," "blockchain gas clearance fees," or "credit score upgrades" to release your money. This guide gives you immediate, crystal-clear triage instructions to stop the financial bleeding, revoke live smart-contract drain permissions on your self-custody wallet, file actionable blockchain freeze requests with law enforcement and stablecoin issuers (Tether and Circle), and protect yourself from the Fake Crypto Recovery Agent ("Second Scam") vultures who target victims days later.
E hana i kēia i kēia manawa¶
- STOP sending any more money, never pay a "tax," "withdrawal fee," "AML security deposit," "gas fee," or "account unfreeze fee" to unlock a frozen balance. In 100 percent of legitimate regulated brokerages and cryptocurrency exchanges (such as Coinbase, Kraken, Gemini, Fidelity, or Interactive Brokers), any applicable transaction fees or tax withholdings are deducted directly from the balance inside your account. Any platform demanding that you send new out-of-pocket funds from your bank or external wallet to "unlock" an existing balance is a 100 percent fraudulent simulation. The millions of dollars displayed on your screen are fake HTML numbers controlled by the scammer's backend database; paying the "20 percent tax" will simply result in a new excuse ("cross-border audit fee") until you have zero dollars left.
- If you connected a self-custody wallet (Coinbase Wallet, MetaMask, Trust Wallet, Phantom, Rabby, or Ledger) to a "Liquidity Mining / AI Yield Node" DApp, immediately revoke all Unlimited Token Approvals (
Approve / Permit2) OR move remaining funds in your wallet to a brand-new seed phrase. Many Pig Butchering scams tell you that your funds are "safe because they never leave your own Coinbase Wallet or Trust Wallet." In reality, clicking "Join Mining Pool" or "Receive Voucher" made you sign a malicious ERC-20 / TRC-20increaseAllowancea i ʻoleApprove(Unlimited)smart contract permission that lets the scammer's contract sweep 100 percent of the USDT/USDC sitting inside your wallet whenever they choose. Visitrevoke.cashimmediately or follow our cryptocurrency wallet drain and seed phrase compromise alakai. - Preserve every single blockchain Transaction Hash (
TxID), Deposit Wallet Address, URL, and WhatsApp/Telegram chat log BEFORE you confront or block the scammer. The moment you accuse the scammer of fraud, they will click "Delete Chat for Both Sides" on Telegram or WhatsApp and shut down the fake trading website, erasing the evidence you need for law enforcement and tax casualty loss deductions. Use a second phone or computer to photograph and export the entire chat history, screenshot your deposit history showing the exact 42-character (0x...), 34-character (T...), orbc1...destination wallet addresses, and copy every 64-character Transaction Hash (TxID) from your real exchange (Coinbase, Kraken, Binance, Crypto.com). - If you sent a bank wire transfer, ACH transfer, or credit/debit card payment within the last 24 to 72 hours, call your bank's Wire Fraud Department immediately to request an emergency SWIFT Recall / FinCEN Rapid Response freeze. While irreversible blockchain transactions cannot be undone by your bank, bank-to-bank wire transfers to shell company accounts (often disguised as "import/export," "jewelry," or "consulting" LLCs in Hong Kong, New York, London, or Singapore) can sometimes be intercepted in correspondent banking queues if recalled within 24 to 48 hours. See our bank account breach and wire recall guide.
- NEVER hire any "Crypto Recovery Agency," "Blockchain Ethical Hacker," or "Cyber Refund Law Firm" that advertises on Google, YouTube comments, Reddit, Telegram, or Instagram. Every single private company or individual claiming they can "hack the scammer's wallet" or "recover your stolen USDT for an upfront fee or retainer" is running a Recovery Room Scam (often operated by the exact same syndicate that stole your money in the first place). Only sworn government law enforcement agencies with judicial seizure warrants can instruct Tether (
USDT), Circle (USDC), or centralized exchanges to freeze and burn/reissue stolen funds. - Prioritize your mental health and personal safety right now. Transnational scam syndicates employ teams of psychological manipulators trained to induce shame, isolation, and acute financial despair. Remember that doctors, software engineers, attorneys, bank CEOs, and retirees fall victim to this industrial-scale crime every single day. If you or a loved one are experiencing overwhelming despair or thoughts of self-harm, reach out to a trusted family member immediately and call your local crisis line (in the United States and Canada, call or text 988 for the Suicide & Crisis Lifeline; in the United Kingdom, call 111 or Samaritans at 116 123; or call your local emergency number at 911, 112, or 999, see all helu pilikia).
Why the 'Small Test Withdrawal' worked at the beginning of the scam
Almost every victim of a Pig Butchering scam asks: "How could the platform be fake when it let me withdraw 500 dollars or 2,000 dollars right back to my real bank account during the first week?" That early withdrawal is the deliberate "baiting" phase of the scam script. When you first test the platform with 1,000 dollars, the scammers manually send you 1,200 dollars of real USDT out of their operational petty-cash wallet to convince you that the withdrawal button works and to disarm your skepticism. Once that 200-dollar payout convinces you to liquidate your 401(k), home equity line of credit, or life savings and deposit 50,000 or 250,000 dollars, the trap snaps shut and no further withdrawals are ever permitted.
Crypto investment scam & DeFi drain emergency triage decision tree¶
flowchart TD
Root["Suspected Crypto Investment Scam ('Pig Butchering') or Frozen Withdrawal"] --> StopPay["RULE 1: Stop All Transfers Immediately, Never Pay 'Taxes', 'Gas', or 'AML Verification Fees'"]
StopPay --> ModeCheck{"How Were Your Funds Transferred or Connected?"}
ModeCheck -->|"Option A: Connected Self-Custody Wallet (Coinbase Wallet, Trust Wallet, MetaMask) to a 'Mining / Yield' DApp"| WalletRescue["1. Open revoke.cash immediately & revoke all Unlimited USDT/USDC Token Approvals<br/>2. If USDT is still showing in your own wallet address, immediately transfer it to a brand-new hardware/software wallet before the scammer sweeps it"]
ModeCheck -->|"Option B: Sent Crypto (BTC, ETH, USDT, USDC) to a Deposit Address on a Fake Exchange App/Website"| TraceFreeze["1. Export all TxID hashes & Scammer Deposit Addresses BEFORE blocking scammer<br/>2. Trace hops on Etherscan / Tronscan / Breadcrumbs to find the Exchange Deposit Consolidation Address<br/>3. File FBI IC3 (US) / Action Fraud (UK) report + notify Tether/Circle & Destination Exchange Compliance"]
ModeCheck -->|"Option C: Sent Bank Wire (SWIFT / Fedwire / SEPA / Faster Payments) within Last 72 Hours"| BankRecall["Call Bank Wire Fraud Dept Immediately: Request Emergency SWIFT gpi Stop-and-Recall & FinCEN Rapid Response Referral"]
WalletRescue --> DeviceCheck["Audit Computer & Phone: Uninstall AnyDesk/TeamViewer, Delete Rogue iOS TestFlight / Enterprise Profiles, Rotate Exchange Passwords"]
TraceFreeze --> DeviceCheck
BankRecall --> DeviceCheck
Anatomy of the 3 technical variants of "Pig Butchering" platforms¶
Understanding which technical mechanism the syndicate used against you determines whether any funds are still sitting inside your own wallet waiting to be rescued right now:
| Scam Architecture Variant | How the Victim Experiences It | What Actually Happens on the Blockchain | Hiki iā ʻoe ke hoʻopakele i nā kālā i koe i kēia manawa? |
|---|---|---|---|
1. ʻO ka hoʻololi ʻana i ka Centralized Exchange / Trading App (Sideloaded ma o Apple TestFlight, iOS Enterprise Profile, WebClip hoʻopunipuni, a i ʻole domain spoofed e like me coin-pro-vip[.]com) |
Hoʻokumu ʻoe i kahi moʻokāki ma kahi pūnaewele nani a i ʻole ka polokalamu kelepona, kope i kahi helu waihona (0x... a i ʻole T...), a hoʻouna i ka crypto mai kāu moʻokāki Coinbase/Kraken maoli. Ma ka ʻaoʻao, nānā ʻoe i nā kiʻi kukui kukui a hoʻokō i 60-kekona "nodes / binary options / gold futures" kālepa e lanakila ana i ka 20% i kēlā me kēia manawa. |
** ʻO nā palapala kālepa a me kāu koena moʻokāki $300,000 he 100% hoʻopunipuni i ka waihona waihona.** I loko o 3 mau minuke o kāu waihona maoli i hōʻea ai i ka helu ʻeke ʻeke scammer, kahi palapala ʻakomi i kāʻili i kāu USDT/BTC maoli i kahi ʻeke holoi holoi waena. | ** ʻAʻole hiki ke hoʻihoʻi ʻia mai ka polokalamu hoʻopunipuni.** Pono ʻoe e ʻimi i nā hops blockchain (TxID) mai kāu helu helu waihona mua a hiki i ka hoʻololi ʻana i waho-ramp a waiho i kahi noi hoʻokuʻu kānāwai. |
| 2. Mea hoʻoheheʻe ʻia ʻo Web3 DeFi "Liquidity Mining / Smart Pool" (Ua komo ʻia i loko o ka polokalamu kele pūnaewele o Coinbase Wallet, Trust Wallet, MetaMask, a i ʻole SafePal) | 'Ōlelo ka scammer iāʻoe: * "ʻAʻole ponoʻoe e hoʻouna i ke kālā i kekahi. E mālama wale i kāu USDT i loko o kāu Wallet Coinbase kūhelu pono'ī, wehe i ka polokalamu kele pūnaewele DApp, e hele i kēia loulou waiʻauʻau mining, a kaomi i ka 'Receive Voucher / Join Node' no ka loaʻaʻana o 1.5% i kēlā me kēia lā. "* | Ke kaomi ʻana iā "Receive Voucher" a i ʻole "Confirm" i puka mai ai kahi hana aelike akamai i ʻike maoli ʻia Approve(Spender: ScammerContract, Amount: Unlimited USDT). I ka wā mua, haʻalele ka scammer i kāu USDT i kāu ʻeke a hoʻouna iā ʻoe i nā uku liʻiliʻi i kēlā me kēia lā no laila e hoʻonui ʻoe i ke kālā; i ka wā i piʻi ai kāu ʻeke ʻeke kālā, kāhea kā lākou ʻaelike transferFrom() a hoʻokahe i 100% o kāu USDT i 1 kekona. |
** ʻAe, INA ʻaʻole lākou i huki i ke kumu:** Inā ʻo kāu USDT maoli ** e noho mau ana i kāu helu Coinbase Wallet / Trust Wallet i kēia manawa **, e hele koke i revoke.cash e hoʻopau i ka ʻae ʻana i ka hōʻailona, A i ʻole e hoʻouna koke i kāu USDT mai loko mai o kēlā pēke i kāu moʻokāki Coinbase Exchange maoli ma mua o ka hoʻolaha ʻana o ka scammer. |
| 3. Kākoʻo Kākoʻo Loaʻa Loaʻa i ka Bank/Exchange Drain (Alakaʻi ʻo Scammer iā ʻoe ma luna o ka kaʻana ʻana i ka pale a i ʻole AnyDesk / TeamViewer / Zoom) | Hiki i ke "mea aʻoaʻo" a i ʻole "manakia moʻokāki VIP" ke kōkua iā ʻoe e hoʻonohonoho i kāu Kraken, Coinbase, a i ʻole uea panakō ma luna o ka māhele pale, a i ʻole e hoʻokomo i kahi hāmeʻa kākoʻo mamao ma kāu kamepiula/kelepona. | Lawe ka scammer i kāu mau kuki kau, nā kī API, a i ʻole nā code 2FA, a i ʻole ke kiaʻi ʻana i kāu pale i ka wā e hoʻopaʻa inoa ana i kā lākou helu haʻalele ʻana ma kāu moʻokāki kūpono. | Hoʻokaʻawale koke i ka kamepiula mai Wi-Fi, wehe i nā mea hana mamao (e ʻike i kā mākou kākoʻo ʻenehana scam a me ke alakaʻi wehe ʻana iā AnyDesk), a laka i kāu moʻokāki hoʻololi maoli. |
KaʻAnuʻu Hana 1: Ka mālama ʻana i nā hōʻike forensic (E hana i kēia ma mua o ke kū ʻana i ka scammer)¶
ʻO ka mea hewa nui loa i hana ʻia ʻo ka leka uila ʻana i ka scammer *"Ua ʻike wau he scammer ʻoe, e hoʻihoʻi mai iaʻu i kaʻu kālā a i ʻole e kāhea ana au i ka FBI."
Ma mua o ka haʻi ʻana i kahi huaʻōlelo i ka scammer, e hoʻohālike ʻoe e "hana me kāu panakō e hōʻiliʻili i ke kālā ʻauhau/hōʻoia" no 30 mau minuke ke unuhi ʻoe i kēia pūʻulu hōʻike pololei:
- ** Hoʻopuka i kēlā me kēia Blockchain Transaction Hash (
TxID) a me ka helu ʻeke kālā mai kāu hoʻololi REAL**: - E komo i loko o ka hoʻololi cryptocurrency kūpono a i ʻole ka ʻeke āu i hoʻohana ai e kūʻai a hoʻouna i ka crypto (e like me Coinbase, Kraken, Robinhood, Crypto.com, Gemini, Binance, Cash App, a i ʻole PayPal).
- E wehe i kāu Transaction / Withdrawal History no kēlā me kēia hoʻoili āu i hoʻouna ai i ka paepae scam.
- E kope a mālama ma ke ʻano he kikokikona maʻalahi (ʻaʻole wale nā kiʻi paʻi kiʻi, no ka mea pono nā mea noiʻi i nā kaula alphanumeric kope-pasteable):
- Ka lā, ka manawa, a me ka helu kālā UTC/Crypto o kēlā me kēia unuhi.
- Waiwai a me Blockchain Network (e.g.,
USDT on Tron TRC-20,USDC on Ethereum ERC-20, a i ʻoleBitcoin BTC). - **Kou wahi ʻeke kālā hoʻouna **.
- Ka helu wahi ʻeke ʻeke kālā a ka Scammer i loaʻa / waiho ʻia (e laʻa.
0x71C...a i ʻoleTX9k...). - Ka Hash Transaction Hexadecimal 64-hua (
TxID/TxHash) no kēlā me kēia hoʻoili hoʻokahi.
- ** Kiʻi a hoʻopaʻa ʻia i ka Fake Trading App / Website ʻoiai hiki iā ʻoe ke komo i loko **:
- E hoʻopaʻa i kahi wikiō kelepona mau e hōʻike ana:
- ʻO ka ** URL pololei / inoa inoa ** o ka paepae hoʻopunipuni ma ka pahu helu mākaʻikaʻi.
- ʻO kāu helu **Account Dashboard / UID helu ** hoʻopunipuni, mōʻaukala kālepa hoʻopunipuni, a me ka pale "Deposit" e hōʻike ana i ka helu ʻeke kālā i ka paepae i hāʻawi ʻia iā ʻoe.
- ʻO ka "Customer Service / VIP Support" pukaaniani kamaʻilio i loko o ke kahua kahi e koi ai lākou i ka 15 a i ka 30% ʻauhau a i ʻole ka uku AML (ʻoi aku ka nui o nā helu ʻeke kālā a lākou e hāʻawi ai no ka uku ʻana i ka "ʻauhau," no ka mea ke nānā ikaika ʻia kēlā ʻeke e ka syndicate i kēia lā).
- ** E hoʻokuʻu aku i ka WhatsApp, Telegram, a i ʻole ka waihona kamaʻilio Signal **:
- Ma WhatsApp: E wehe i ke kamaʻilio me ka scammer -> kaomi i ko lākou inoa ʻaoʻao ma luna -> e ʻōwili i lalo a kaomi ** Export Chat -> Include Media** -> mālama i ka
.zipwaihona i kāu kamepiula a i ʻole Google Drive/iCloud. E paʻi paʻi kiʻi i kā lākou helu kelepona, nā kiʻi ʻaoʻao, a me nā memo leo a i ʻole nā leo kelepona wikiō. - Ma Telegram: E wehe i Telegram Desktop ma ke kamepiula -> wehe i ke kamaʻilio -> kaomi i ka ** ʻekolu kiko (
⋮) ma ka ʻaoʻao ʻākau hema -> Export chat history** -> nānā i nā pahu a pau (Photos, Voice messages, Video messages) a hoʻokuʻu aku e like me HTML/JSON. Kaomi pū i kā lākou ʻaoʻao e nānā inā ʻike ʻia kā lākou helu ** Telegram User ID ** (ʻaʻole like@usernameska mea e hoʻololi ai nā scammers i kēlā me kēia lā, ʻo ka helu Telegram User ID paʻa mau).
KaʻAnuʻu Hana 2: Pehea e ʻimi ai i kāu kālā i ʻaihue ʻia ma ka blockchain a noi i kahi Tether pilikia (USDT) / Hoʻokuʻu kūʻai¶
ʻAʻole like me ke kālā kino i hoʻokomo ʻia i loko o kahi ʻeke, kēlā me kēia Bitcoin (BTC), Ethereum (ETH / ERC-20), a me Tron (TRX / TRC-20) hoʻopaʻa paʻa ʻia ka hana ma ka waihona puke lehulehu a hiki ʻole ke hoʻololi ʻia. ʻO nā hui laundering ʻē aʻe e pono e hoʻoneʻe i nā kālā ʻaihue ma o kekahi o nā chokepoint ʻelua kahi e hiki ai ke hoʻopaʻa ʻia nā waiwai e ka hoʻokō kānāwai:
Chokepoint 1: Centralized Stablecoin Smart Contracts (Tether USDT a Circle USDC)¶
Ma luna o 80 ka nui o nā scam Butchering Pig e koi i ka uku ma USDT (Tether) ma ka Tron (TRC-20) a i ʻole Ethereum (ERC-20) blockchain, a i ʻole USDC (Circle).
- ʻO ka mea i ʻike ʻole ʻia e ka hapa nui o ka poʻe i hoʻopilikia ʻia, ʻo ka ** Tether (USDT)** a me Poai (USDC) Ua loaʻa i nā ʻaelike akamai kekahi hana hoʻomalu i kapa ʻia ʻo addBlackList(address) / freeze(address).
- Ke loaʻa ʻo Tether Limited a i ʻole Circle i kahi noi hoʻopaʻa kānāwai e hōʻike ana i ka ʻaihue USDT a i ʻole USDC ke noho nei i loko o kahi helu ʻeke ʻeke hui unhosted (0x... a i ʻole T...), Hiki iā Tether ke hoʻokuʻu i kēlā helu ʻeke kālā ma ka blockchain no laila ʻaʻole hiki i ka mea scammer ke neʻe a hoʻolilo i ka USDT, a ma ke kauoha hoʻokuʻu ʻia e ka ʻaha, hiki iā Tether ke ** puhi (destroyBlackFunds) nā hōʻailona paʻa i loko o ka ʻeke a ka scammer a me ka mint pani USDT hoʻi pololei i ka mea i pepehi ʻia**.
Chokepoint 2: Centralized Exchange (CEX) Nā Wallets Hoʻohui Hoʻohui¶
E hoohuli i aihue BTC, ETH, a i ʻole USDT i loko o ke kālā fiat (Chinese Yuan, US Dollars, Thai Baht, a i ʻole UAE Dirhams), hoʻoili kālā nā scammers ma o 2 a 6 mau ʻeke "hop" waena ma mua o ka waiho ʻana iā lākou i kahi Deposit Address ma kahi Centralized Exchange nui (e like me Binance, OKX, HTX/Huobi, Bybit, Gate.io, KuCoin, a i ʻole Kraken).
Pehea e huli ai i kāu TxID i loko o 5 mau minuke me ka hoʻohana ʻana i nā mea ʻimi poloka lehulehu¶
- ** Hoʻopili i kāu Hash Transaction (
TxID) i loko o ka mea huli poloka mana no ia pūnaewele**: - Ethereum (
ETH,USDT-ERC20,USDC): Kipaetherscan.io - Tron (
TRX,USDT-TRC20): Kipatronscan.org - Bitcoin (
BTC): Kipamempool.spaceaiʻoleblockchair.com - Visual Multi-Hop Graph Tracer (ʻĀpana manuahi): Kipa
breadcrumbs.appaiʻolemetasleuth.ioa hoʻopili i kāu helu helu scammer e hoʻopuka i kahi kiʻi kahe ʻike maka e hōʻike ana i kēlā me kēia hop. - E hahai i nā hops i mua mai kāu helu waihona:
- Kaomi ma ka Scammer's Deposit Address (
To:field) in your original transaction, then click theToken Transfers (ERC-20 / TRC-20)tab to see where the scammer moved your tokens next. - Follow the large outbound transfers 1 to 4 hops forward until you see either:
- A high-balance "Holding / Piggybank" Wallet: An unlabelled wallet currently holding $50,000 to $10,000,000+ in static
USDTa i ʻoleUSDC(prime target for an immediate Tether / Circle Smart-Contract Freeze). - A Labeled Exchange Deposit Address: On Etherscan or Tronscan, the final destination address will suddenly show a public nametag like
Binance 14,OKX 7,HTX 2, a i ʻoleBybit. The wallet one step immediately before (From:) that labeled exchange hot wallet is the scammer's personal Customer Deposit Address at that exchange (which corresponds to an internal account with KYC documents, IP logs, and freezable funds).
- A high-balance "Holding / Piggybank" Wallet: An unlabelled wallet currently holding $50,000 to $10,000,000+ in static
Step 3: Official law enforcement & exchange reporting checklist (In exact priority order)¶
Law enforcement agencies receive thousands of vague complaints daily; complaints that merely say "I lost $80,000 to a girl named Sophia on WhatsApp" get queued for months. In contrast, a structured report titled "URGENT LIVE CRYPTO FREEZE REQUEST: $80,000 USDT-TRC20 Currently Sitting in Unhosted Wallet [Address] / Deposited to Binance via TxID [Hash]" gives cybercrime agents something they can freeze the same afternoon.
1. United States Victims¶
- FBI Internet Crime Complaint Center (
ic3.gov): File an immediate report athttps://www.ic3.gov. Put all Transaction Hashes (TxIDs), Scammer Wallet Addresses, and any Identified Destination Exchange (e.g., Binance/OKX/Tether) in the dedicated financial transaction fields so the FBI's Recovery Asset Team (RAT) and Virtual Asset Unit (VAU) automated parsers index the wallet addresses immediately. - United States Secret Service (USSS) Field Office & Local Police Report: E kelepona i kou wahi U.S. Secret Service Cyber Fraud Task Force field office ma ke kelepona (i helu ʻia ma
secretservice.gov/contact/field-offices) A e hele i loko o kāu keʻena mākaʻi kūloko no ka loaʻa ʻana o ka Police Incident Report Number (pono ʻoe i kēia helu hihia mākaʻi no ka hoʻomaka ʻana i kahi pilikia pilikia ma Binance, OKX, a i ʻole Tether). - Commodity Futures Trading Commission (CFTC) & SEC: E hoʻouna i kahi ʻōlelo hoʻopiʻi/hoʻopunipuni ma
cftc.gov/complaintasec.gov/tcr.
2. United Kingdom, Canada, European Union, and Australia Victims¶
- United Kingdom: File an immediate report with Action Fraud (
actionfraud.police.uka kelepona paha0300 123 2040) and request an NFRC (National Fraud Intelligence Bureau) Crime Reference Number. If bank transfers were involved within the UK, invoke the Authorized Push Payment (APP) Fraud Reimbursement / Contingent Reimbursement Model rules with your bank immediately. - Canada: File a police report with your local police service's Financial Crimes Unit AND submit all wallet addresses to the Canadian Anti-Fraud Centre (
antifraudcentre-centreantifraude.ca). - Australia: Report immediately through ReportCyber (
cyber.gov.au) and the National Anti-Scam Centre (scamwatch.gov.au), and contact your bank's scam escalation team. - European Union: File a criminal complaint (
Anzeige/Plainte) at your local national police station to obtain a case reference number for Europol / national cyber units.
3. Direct Notification to Destination Exchanges & Stablecoin Issuers (With Your Police Case Number)¶
Once you have your Police Report Number and IC3 Confirmation Number, submit a direct Victim Freeze Support Ticket to the compliance department of the exchange where your traced funds landed (or to Chainalysis / TRM Labs public victim portals):
- Binance Law Enforcement / Victim Freeze Request: Open a support chat at binance.com -> Report Stolen Funds -> provide the exact Deposit TxID, the Binance Deposit Address, and your Police Report + Officer Contact Email so Binance places a temporary 7-day courtesy compliance hold while awaiting the officer's formal request.
- OKX / HTX / Bybit / Kraken / Coinbase: Email or submit a ticket through their official Law Enforcement / Fraud Report portal with your traced TxID chain and investigating officer email.
Step 4: Securing your devices, real accounts, and identity after the scam¶
During a Pig Butchering scam, victims often gave the scammer far more than just cryptocurrency:
- Did you upload a photo of your Passport, Driver's License, or Social Security Number during "KYC Verification" on the fake trading site? If yes, the syndicate now holds a high-resolution scan of your government ID and will sell it or use it for identity fraud. Immediately freeze your credit files with Equifax, Experian, and TransUnion using our identity theft response guide.
- Did you install an app on your iPhone using an "Enterprise Developer Profile," "WebClip," or Apple TestFlight? Go to Settings > General > VPN & Device Management on your iPhone right now, tap any listed Enterprise App / Configuration Profile, and tap Delete Profile / Delete App.
- Did you download an
.apkfile onto your Android phone outside the Google Play Store? Uninstall the app immediately, turn on Google Play Protect, and if you granted the app Accessibility permissions, back up your photos and factory-reset the phone (see our stalkerware, spyware, and keylogger detection on phones alakaʻi). - Did the scammer ever ask you to install AnyDesk, TeamViewer, RustDesk, or screen-share your computer? Follow our tech support pop-up scam and remote desktop removal alakaʻi i ka hoʻomaʻemaʻe ʻana i nā ʻelele hele mamao ʻole, a hoʻololi i nā ʻōlelo huna a me 2FA ma kāu waihona kālā a me kāu leka uila.
- **Kūkaʻi i kahi Certified Public Accountant (CPA) a i ʻole loio ʻauhau e pili ana i nā lula ʻauhau ʻauhau / ʻaihue **: Ma kekahi mau ʻāina (e like me lalo o IRS Internal Revenue Code Section 165©(2) ma ʻAmelika Hui Pū ʻIa no nā hana i hoʻokomo ʻia no ka loaʻa kālā, e ʻike i ka Chief Counsel Memorandum 2025110 kahi i hoʻopaʻa ʻia ai ke Kuhina Nui. Hiki i ka mea uku ʻauhau ke koi i kahi ** ʻAhue Loss Deduction ** ma kā lākou hoʻihoʻi ʻauhau inā mālama lākou i kā lākou hōʻike mākaʻi, waiho ʻia IC3, a me nā moʻolelo kālepa.
Pehea e ʻike ai a pāpā i ka "Fake Crypto Recovery Agent" (The Second Scam)¶
I loko o nā lā a i ʻole mau pule o ka lilo ʻana o ke kālā i kahi scam Pig Butchering, e ʻimi ʻia ʻoe e ka Recovery Room Scam:
- Pehea lākou e ʻike ai iā ʻoe:
- ** Hoʻomaka hou ʻia e ka Original Syndicate**: ʻEkolu pule ma hope o ka ʻaihue ʻana i kāu kālā, ʻo ka scam call center like me nā leka iā ʻoe ma WhatsApp a i ʻole leka uila e hoʻohālike ʻia ʻo "Interpol Cyber Division," "The Global Blockchain Asset Recovery Commission," "Tether Refund Bureau," a i ʻole **"Law Firm / Cyber Forensics Company." ʻo ia ka mea e kani ai lākou i ka manaʻo kupanaha.
- Social Media Bot Swarms: Inā ʻōlelo ʻoe ma YouTube, Reddit, X (Twitter), a i ʻole Facebook e pili ana i ka hoʻopunipuni ʻia, pane koke nā bots: "Ua nalowale au i $90k, akā hoʻomaikaʻi i ke Akua
@Cyber_Trace_Recovery_Officialma Telegram/Instagram ua loaʻa hou ka 100% o kaʻu kālā i nā hola 48." - Pehea ka hana ʻana o ka Recovery Scam:
- Hōʻike ka "mea hoʻolaʻa" iā ʻoe i kahi kiʻi hoʻopunipuni e ʻōlelo ana ua "loaʻa a hoʻopaʻa i kāu mau kālā ʻaihue i loko o kahi ʻaelike akamai / darknet escrow wallet," a noi iā ʻoe e uku ** $1,500 a i $ 5,000 ma mua no ka "soft-contract activation software," "bridging liquidity," a i ʻole "legal bond bond insurance" 2,000 kālā o ETH no nā uku kinoea (kahi i ʻaihue ʻia e ka bot sweeper automated i 0.5 kekona).
- Ka lula hiki ʻole ke haʻihaʻi:
- ** ʻAʻohe mea hacker pilikino, hui hoʻolaʻa, a i ʻole ʻoihana forensic ma ka Honua ka hiki ke hoʻohuli i kahi kālepa blockchain a i ʻole ke kāʻei i ke kī pilikino o ka scammer.**
- ** ʻAʻole e koi nā ʻoihana hoʻokō kānāwai (FBI, Secret Service, Action Fraud, Europol) a me Tether/Circle i ka poʻe i hōʻeha ʻia i ka uku, ka ʻauhau, a i ʻole ka waihona kinoea cryptocurrency e hoʻihoʻi i nā kālā i hopu ʻia.**
Nīnau pinepine¶
My scammer says that if I don't pay the 20% withdrawal tax within 48 hours, the platform will freeze my account permanently, charge me a 5% daily late fee, and report me to the IRS / credit bureaus for tax evasion or money laundering. Can they ruin my credit or have me arrested?
No, every word of that threat is a complete fabrication designed to induce panic so you wire them one last payment before you think clearly. The fake trading website has zero connection to the IRS, HMRC, FinCEN, or any credit bureau (Equifax, Experian, TransUnion). You do not owe taxes on fabricated profits that never existed on a fake website, and a criminal syndicate operating out of an illegal compound cannot file a credit report or lawsuit against you. Block them after exporting your chat logs and do not send a single cent more.
The person who introduced me to the platform video-called me on FaceTime/WhatsApp every day for two months, she was a real person I saw on camera, so how could she be a scammer?
Modern Pig Butchering compounds do not rely only on stolen static photos. Syndicates employ human models ("camera hosts") kept specifically in staged luxury apartment sets to conduct live 5-minute video calls and send personalized daily cooking or gym videos to hundreds of victims simultaneously while a team of keyboard operators handles the text chats, or they use real-time GPU **Deepfake Face-Swap and Voice-Cloning software** over OBS Virtual Camera. Even if you saw a real face on a live video call, the investment platform they directed you to is 100 percent controlled by the syndicate. See our [deepfake voice clone and AI impersonation scams](../digital-and-tech/deepfake-voice-clone-and-ai-impersonation-scams.md) guide.
The scammer offered to pay "half" of my $30,000 tax/unfreeze fee out of their own pocket if I come up with the other $15,000. Doesn't that prove they are really trying to help me?
No, this is known in fraud investigations as the **"Co-Payment / Half-Share Trap"** and is Stage 4 of every standard Pig Butchering manual. Because the scammer's coworkers run the fake trading website, typing "+$15,000" into your on-screen tax balance costs the scammer **zero real dollars**, they simply edit a number in their database (or send USDT from one of their own wallets back to another one of their own wallets) to make you think they generously chipped in $15,000 for you, guilting you into wiring your last real $15,000.
I bought the cryptocurrency on Coinbase/Kraken and sent it to the scammer myself, will Coinbase or my bank reimburse me like a stolen credit card?
When you personally log into your bank or cryptocurrency exchange, pass 2FA, and authorize an outbound wire or crypto withdrawal (even under the psychological manipulation of a scammer), banks classify the transaction as an **"Authorized Push Payment (APP)"** rather than an unauthorized account hack. In the United States, Regulation E and the Electronic Fund Transfer Act generally cover *unauthorized* transfers (where a hacker broke into your account), not authorized scam transfers, though you should still file a formal bank fraud report and law enforcement asset-freeze request immediately. In the United Kingdom, however, mandatory **Payment Systems Regulator (PSR) APP Fraud Reimbursement rules** require UK banks to reimburse victims of Faster Payments / CHAPS authorized push payment scams up to statutory limits unless the customer acted with gross negligence.
Nā alakaʻi pili¶
- Hoʻokaʻawale ʻia ka ʻeke kālā Cryptocurrency a me nā huaʻōlelo huaʻōlelo
- ʻAhaʻi ka waihona kālā a me nā hoʻoili uea ʻole
- Deepfake leo clone a me AI impersonation scams
- Pane ʻaihue ʻike a me ka hoʻihoʻi ʻana i ka hōʻaiʻē
- Kākoʻo ʻenehana i ka scam pop-up a me ka wehe ʻana i ka papapihi mamao
- ʻO ka sextortion a me ka leka uila pūnaewele
- Papa kuhikuhi helu pilikia
Nānā ʻia nā kumu¶
- Federal Bureau of Investigation (FBI) Internet Crime Complaint Center (IC3) (United States): *Cryptocurrency Investment Fraud ("Pig Butchering") Nā Hoʻolaha Hoʻolaha Lapaʻau, Nā Kaʻina Hana Hoʻihoʻi Hoʻihoʻi (RAT), a me nā ʻōlelo aʻo hoʻopunipuni Crypto Recovery Schemes *.
- Pūnaehana Hoʻopiʻi Hoʻopaʻa Hana Waiwai (FinCEN) (Keʻena Waihona o ʻAmelika Hui Pū ʻIa): FinCEN Alert FIN-2023-Alert005: Prevalent Virtual Currency Investment Scam i ʻike mau ʻia ʻo "Pig Butchering" (Red Flags and Rapid Response Program).
- Commodity Futures Trading Commission (CFTC) & Securities and Exchange Commission (SEC) (United States): Ke keʻena o ka Investor Education and Advocacy Alert: Relationship Investment Scams and Fraudulent Asset Recovery Firms.
- National Cyber Security Center (NCSC) & Payment Systems Regulator (PSR) (United Kingdom): Authorized Push Payment (APP) Fraud Reimbursement Rules and Romance/Investment Scam Guidance.
- Ke Keʻena o Nā Aupuni Hui Pū ʻIa no ka Laʻau Laʻau a me ka Karaima (UNODC) & INTERPOL: Transnational Organized Crime and Casinos, Cyber Fraud, and Fake Investment Compound Operations Analysis.