Crypto Investment ('Pig Butchering') Scams and Fake Recovery Agent Fraud¶

Realizing that an online cryptocurrency, gold futures, foreign exchange (Forex), or decentralized finance (DeFi) liquidity-mining platform where you invested your savings is actually a Sha Zhu Pan ("Pig Butchering") scam is one of the most devastating financial and emotional crises a person can experience. Operated by transnational organized crime syndicates across Southeast Asia and globally, these scams spend weeks or months building a trusted romantic, friendship, or mentorship bond via WhatsApp, Telegram, LinkedIn, Instagram, Dating Apps, or an "accidental wrong-number text" before guiding you onto a counterfeit trading app or malicious Web3 smart contract.

The defining moment of a Pig Butchering scam happens when you try to withdraw your displayed account balance, often showing hundreds of thousands of dollars in fabricated profits, and the platform freezes your withdrawal, demanding that you first wire 15 to 30 percent in external "personal income taxes," "AML verification deposits," "blockchain gas clearance fees," or "credit score upgrades" to release your money. This guide gives you immediate, crystal-clear triage instructions to stop the financial bleeding, revoke live smart-contract drain permissions on your self-custody wallet, file actionable blockchain freeze requests with law enforcement and stablecoin issuers (Tether and Circle), and protect yourself from the Fake Crypto Recovery Agent ("Second Scam") vultures who target victims days later.

Enza nunku mpindieu¶

1. STOP sending any more money, never pay a "tax," "withdrawal fee," "AML security deposit," "gas fee," or "account unfreeze fee" to unlock a frozen balance. In 100 percent of legitimate regulated brokerages and cryptocurrency exchanges (such as Coinbase, Kraken, Gemini, Fidelity, or Interactive Brokers), any applicable transaction fees or tax withholdings are deducted directly from the balance inside your account. Any platform demanding that you send new out-of-pocket funds from your bank or external wallet to "unlock" an existing balance is a 100 percent fraudulent simulation. The millions of dollars displayed on your screen are fake HTML numbers controlled by the scammer's backend database; paying the "20 percent tax" will simply result in a new excuse ("cross-border audit fee") until you have zero dollars left.
2. If you connected a self-custody wallet (Coinbase Wallet, MetaMask, Trust Wallet, Phantom, Rabby, or Ledger) to a "Liquidity Mining / AI Yield Node" DApp, immediately revoke all Unlimited Token Approvals (Approve / Permit2) OR move remaining funds in your wallet to a brand-new seed phrase. Many Pig Butchering scams tell you that your funds are "safe because they never leave your own Coinbase Wallet or Trust Wallet." In reality, clicking "Join Mining Pool" or "Receive Voucher" made you sign a malicious ERC-20 / TRC-20 increaseAllowance anyi Approve(Unlimited) smart contract permission that lets the scammer's contract sweep 100 percent of the USDT/USDC sitting inside your wallet whenever they choose. Visit revoke.cash immediately or follow our cryptocurrency wallet drain and seed phrase compromise mulombodi.
3. Preserve every single blockchain Transaction Hash (TxID), Deposit Wallet Address, URL, and WhatsApp/Telegram chat log BEFORE you confront or block the scammer. The moment you accuse the scammer of fraud, they will click "Delete Chat for Both Sides" on Telegram or WhatsApp and shut down the fake trading website, erasing the evidence you need for law enforcement and tax casualty loss deductions. Use a second phone or computer to photograph and export the entire chat history, screenshot your deposit history showing the exact 42-character (0x...), 34-character (T...), or bc1... destination wallet addresses, and copy every 64-character Transaction Hash (TxID) from your real exchange (Coinbase, Kraken, Binance, Crypto.com).
4. If you sent a bank wire transfer, ACH transfer, or credit/debit card payment within the last 24 to 72 hours, call your bank's Wire Fraud Department immediately to request an emergency SWIFT Recall / FinCEN Rapid Response freeze. While irreversible blockchain transactions cannot be undone by your bank, bank-to-bank wire transfers to shell company accounts (often disguised as "import/export," "jewelry," or "consulting" LLCs in Hong Kong, New York, London, or Singapore) can sometimes be intercepted in correspondent banking queues if recalled within 24 to 48 hours. See our bank account breach and wire recall guide.
5. NEVER hire any "Crypto Recovery Agency," "Blockchain Ethical Hacker," or "Cyber Refund Law Firm" that advertises on Google, YouTube comments, Reddit, Telegram, or Instagram. Every single private company or individual claiming they can "hack the scammer's wallet" or "recover your stolen USDT for an upfront fee or retainer" is running a Recovery Room Scam (often operated by the exact same syndicate that stole your money in the first place). Only sworn government law enforcement agencies with judicial seizure warrants can instruct Tether (USDT), Circle (USDC), or centralized exchanges to freeze and burn/reissue stolen funds.
6. Prioritize your mental health and personal safety right now. Transnational scam syndicates employ teams of psychological manipulators trained to induce shame, isolation, and acute financial despair. Remember that doctors, software engineers, attorneys, bank CEOs, and retirees fall victim to this industrial-scale crime every single day. If you or a loved one are experiencing overwhelming despair or thoughts of self-harm, reach out to a trusted family member immediately and call your local crisis line (in the United States and Canada, call or text 988 for the Suicide & Crisis Lifeline; in the United Kingdom, call 111 or Samaritans at 116 123; or call your local emergency number at 911, 112, or 999, see all nomba ya tshimpitshimpi).

Crypto investment scam & DeFi drain emergency triage decision tree¶

flowchart TD
    Root["Suspected Crypto Investment Scam ('Pig Butchering') or Frozen Withdrawal"] --> StopPay["RULE 1: Stop All Transfers Immediately, Never Pay 'Taxes', 'Gas', or 'AML Verification Fees'"]

    StopPay --> ModeCheck{"How Were Your Funds Transferred or Connected?"}

    ModeCheck -->|"Option A: Connected Self-Custody Wallet (Coinbase Wallet, Trust Wallet, MetaMask) to a 'Mining / Yield' DApp"| WalletRescue["1. Open revoke.cash immediately & revoke all Unlimited USDT/USDC Token Approvals<br/>2. If USDT is still showing in your own wallet address, immediately transfer it to a brand-new hardware/software wallet before the scammer sweeps it"]

    ModeCheck -->|"Option B: Sent Crypto (BTC, ETH, USDT, USDC) to a Deposit Address on a Fake Exchange App/Website"| TraceFreeze["1. Export all TxID hashes & Scammer Deposit Addresses BEFORE blocking scammer<br/>2. Trace hops on Etherscan / Tronscan / Breadcrumbs to find the Exchange Deposit Consolidation Address<br/>3. File FBI IC3 (US) / Action Fraud (UK) report + notify Tether/Circle & Destination Exchange Compliance"]

    ModeCheck -->|"Option C: Sent Bank Wire (SWIFT / Fedwire / SEPA / Faster Payments) within Last 72 Hours"| BankRecall["Call Bank Wire Fraud Dept Immediately: Request Emergency SWIFT gpi Stop-and-Recall & FinCEN Rapid Response Referral"]

    WalletRescue --> DeviceCheck["Audit Computer & Phone: Uninstall AnyDesk/TeamViewer, Delete Rogue iOS TestFlight / Enterprise Profiles, Rotate Exchange Passwords"]
    TraceFreeze --> DeviceCheck
    BankRecall --> DeviceCheck

Anatomy of the 3 technical variants of "Pig Butchering" platforms¶

Understanding which technical mechanism the syndicate used against you determines whether any funds are still sitting inside your own wallet waiting to be rescued right now:

Tshitupa 1: Dilama dia bijadiki bia malu a mikenji (Enza nunku KUMPALA kua wewe kumonangana ne muena tshinyangu)¶

Tshilema tshinene tshidi bantu badibu bakengesha benza ntshia kutumina muena tshinyangu mesaje "Ndi mumanye ne udi muena tshinyangu, mpingajila makuta anyi anyi ndi mbikila FBI." Diakamue paudi utuma mukenji au, muena mudimu wa tshisumbu etshi udi ufina pa butone bumue budi bumbusha tshisanji tshia Telegram/WhatsApp ku telefone yonso ibidi ne tshipangisha dibuela diebe mu site wa dishima wa dishima.

Kumpala kua kuamba dîyi kudi muena tshinyangu, enza bu udi "wenza mudimu ne banke webe bua kusangisha makuta a bitadi/a dijadika" munkatshi mua minite 30 paudi upatula bijadiki ebi menemene:

1. Tuma Hash yonso wa Blockchain Transaction (TxID) ne adrese wa tshibuta tshia makuta tshia mu tshisalu tshieba tshia bushuwa:
2. Buela mu tshisalu tshia makuta anyi mu tshibuta tshia makuta tshiuvua muenze natshi mudimu bua kusumba ne kutuma makuta (bu mudi Coinbase, Kraken, Robinhood, Crypto.com, Gemini, Binance, Cash App, anyi PayPal).
3. Kangula Transaction / Retraction History bua makuta onso audi mutume ku tshisanji tshia dishima.
4. Kopa ne ulame bu mukanda mupepele (ki nganu bimfuanyi bia pa tshiamu to, bualu bakebuludi badi dijinga ne milongo ya maleta ne nomba idibu mua kukopa ne kuela):
   • Dituku dilelela dia UTC, Dîba, ne bungi bua Dollar/Crypto bua dipatula dionso.
   • Asset & Blockchain Network (e.g., USDT on Tron TRC-20, USDC on Ethereum ERC-20, anyi Bitcoin BTC).
   • Adrese wa tshibombi tshieba tshia kutuma.
   • The Scammer's Receiving / Deposit Wallet Address (e.g., 0x71C... anyi TX9k...).
   • The 64-character hexadecimal Transaction Hash (TxID / TxHash) for every single transfer.
5. Screenshot and screen-record the Fake Trading App / Website while you can still log in:
6. Record a continuous smartphone video showing:
   • The exact URL / domain name of the fake platform in the browser address bar.
   • Your fake Account Dashboard / UID number, fake trade history, and the "Deposit" screen showing the wallet address the platform assigned to you.
   • The "Customer Service / VIP Support" chat window inside the platform where they demand the 15 to 30% tax or AML fee (especially any wallet address they provide for paying the "tax," as that wallet is actively monitored by the syndicate today).
7. Export the entire WhatsApp, Telegram, or Signal chat archive:
8. On WhatsApp: Open the chat with the scammer -> tap their profile name at the top -> scroll to the bottom and tap Export Chat -> Include Media -> save the .zip archive to your computer or Google Drive/iCloud. Also screenshot their phone number, profile photos, and any voice notes or video call recordings.
9. On Telegram: Open Telegram Desktop on a computer -> open the chat -> click the three dots (⋮) in the top-right corner -> Export chat history -> check all boxes (Photos, Voice messages, Video messages) and export as HTML/JSON. Also click their profile to check if their numeric Telegram User ID is visible (unlike @usernames which scammers change daily, the numeric Telegram User ID is permanent).

Step 2: How to trace your stolen funds on the blockchain and request an emergency Tether (USDT) / Exchange freeze¶

Unlike physical cash stuffed in a suitcase, every Bitcoin (BTC), Ethereum (ETH / ERC-20), and Tron (TRX / TRC-20) transaction is permanently recorded on a public, immutable global ledger. Even sophisticated laundering syndicates must eventually move stolen funds through one of two chokepoints where assets can be frozen by law enforcement:

Chokepoint 1: Centralized Stablecoin Smart Contracts (Tether USDT ne Circle USDC)¶

Over 80 percent of Pig Butchering scams demand payment in USDT (Tether) on the Tron (TRC-20) or Ethereum (ERC-20) blockchain, or USDC (Circle). - What most victims do not know is that both the Tether (USDT) and Circle (USDC) smart contracts contain a built-in administrative function called addBlackList(address) / freeze(address). - When Tether Limited or Circle receives an urgent law enforcement freeze request showing that stolen USDT anyi USDC is sitting inside an unhosted syndicate wallet address (0x... anyi T...), Tether can cryptographically freeze that wallet address on the blockchain so the scammer can never move or spend the USDT, and upon court forfeiture order, Tether can burn (destroyBlackFunds) the frozen tokens in the scammer's wallet and mint replacement USDT directly back to the victim.

Chokepoint 2: Centralized Exchange (CEX) Deposit Consolidation Wallets¶

To convert stolen BTC, ETH, anyi USDT into fiat currency (Chinese Yuan, US Dollars, Thai Baht, or UAE Dirhams), scammers transfer funds through 2 to 6 intermediate "hop" wallets before depositing them into a Deposit Address at a major Centralized Exchange (such as Binance, OKX, HTX/Huobi, Bybit, Gate.io, KuCoin, or Kraken).

How to trace your TxID in 5 minutes using free public block explorers¶

1. Paste your Transaction Hash (TxID) into the official block explorer for that network:
2. Ethereum (ETH, USDT-ERC20, USDC): Visit etherscan.io
3. Tron (TRX, USDT-TRC20): Visit tronscan.org
4. Bitcoin (BTC): Visit mempool.space or blockchair.com
5. Visual Multi-Hop Graph Tracer (Free tier): Visit breadcrumbs.app or metasleuth.io and paste your scammer deposit address to generate an automatic visual flow diagram showing every hop.
6. Follow the hops forward from your Deposit Address:
7. Fina pa Adrese wa tshibutshilu tshia muena tshinyangu (To: muaba) mu tshikondu tshieba tshia kumpala, pashishe tuaku pa Token Transfers (ERC-20 / TRC-20) tab bua kumona muaba uvua muena tshinyangu mubueje token yebe pashishe.
8. Londa bintu binene bidi bipatuka 1 too ne ku 4 kumpala too ne paudi umona tshimue tshia ku bintu ebi:
   • Tshibuta tshia makuta tshia bungi tshia "Holding / Piggybank": Tshibuta tshia makuta tshidi katshiyi ne tshimanyinu tshidi mpindieu ne dolare 50 000 too ne ku 10 000 000+ mu tshibutshilu USDT anyi USDC (tshipatshila tshia kumpala tshia diakamue Tether / Circle Smart-Contract Freeze).
   • A Labeled Exchange Deposit Address: Pa Etherscan anyi Tronscan, adrese wa ndekelu wa muaba udibu baya nealeje tshimpitshimpi tshimanyinu tshia patoke bu mudi Binance 14, OKX 7, HTX 2, anyi Bybit. Tshibuta tshia makuta tshitupa tshimue diakamue kumpala kua (From:) udibu bafunde ne: exchange hot wallet udi muena tshinyangu Adrese wa diteka dia makuta a muena mudimu ku tshisalu atshi (udi upetangana ne konte wa munda udi ne mikanda ya KYC, mikanda ya IP, ne makuta adibu mua kulama).

Tshitupa 3: Dikumbaja dia mikenji ne liste wa dishintakaja dia luapolo (Mu bulongame bulelela)¶

Bibambalu bia dilama dia mikenji bidi bipeta binunu ne binunu bia bilumbu bidi kabiyi biumvuika bimpe dituku dionso; bilumbu bidi anu biamba ne: "Ndi mujimije dolare 80 000 kudi nsongakaji mukuabu diende Sophia ku WhatsApp" bidi bienza mulongo munkatshi mua ngondo ya bungi. Kadi, luapolo lulongolola ludi ne tshiena bualu tshia ne: "DILOMBA DIA KUENZA MU MUSHINDU: $80,000 USDT-TRC20 Currently Sitting in Unhosted Wallet [Address] / Deposited to Binance via TxID [Hash]" udi upesha bena tshinyangu tshia ku Enternete tshintu tshidibu mua kukanga panyima pa midi.

1. United States Victims¶

• FBI Internet Crime Complaint Center (ic3.gov): File an immediate report at https://www.ic3.gov. Put all Transaction Hashes (TxIDs), Scammer Wallet Addresses, and any Identified Destination Exchange (e.g., Binance/OKX/Tether) in the dedicated financial transaction fields so the FBI's Recovery Asset Team (RAT) and Virtual Asset Unit (VAU) automated parsers index the wallet addresses immediately.
• United States Secret Service (USSS) Field Office & Local Police Report: Call your regional U.S. Secret Service Cyber Fraud Task Force field office directly by phone (listed at secretservice.gov/contact/field-offices) AND walk into your local municipal police department to get a formal Police Incident Report Number (you will need this police case number to trigger an emergency freeze at Binance, OKX, or Tether).
• Commodity Futures Trading Commission (CFTC) & SEC: File a whistleblower/fraud tip at cftc.gov/complaint ne sec.gov/tcr.

2. United Kingdom, Canada, European Union, and Australia Victims¶

• United Kingdom: File an immediate report with Action Fraud (actionfraud.police.uk or call 0300 123 2040) and request an NFRC (National Fraud Intelligence Bureau) Crime Reference Number. If bank transfers were involved within the UK, invoke the Authorized Push Payment (APP) Fraud Reimbursement / Contingent Reimbursement Model rules with your bank immediately.
• Canada: File a police report with your local police service's Financial Crimes Unit AND submit all wallet addresses to the Canadian Anti-Fraud Centre (antifraudcentre-centreantifraude.ca).
• Australia: Report immediately through ReportCyber (cyber.gov.au) and the National Anti-Scam Centre (scamwatch.gov.au), and contact your bank's scam escalation team.
• European Union: File a criminal complaint (Anzeige / Plainte) at your local national police station to obtain a case reference number for Europol / national cyber units.

3. Direct Notification to Destination Exchanges & Stablecoin Issuers (With Your Police Case Number)¶

Once you have your Police Report Number and IC3 Confirmation Number, submit a direct Victim Freeze Support Ticket to the compliance department of the exchange where your traced funds landed (or to Chainalysis / TRM Labs public victim portals): - Binance Law Enforcement / Victim Freeze Request: Open a support chat at binance.com -> Report Stolen Funds -> provide the exact Deposit TxID, the Binance Deposit Address, and your Police Report + Officer Contact Email so Binance places a temporary 7-day courtesy compliance hold while awaiting the officer's formal request. - OKX / HTX / Bybit / Kraken / Coinbase: Email or submit a ticket through their official Law Enforcement / Fraud Report portal with your traced TxID chain and investigating officer email.

Step 4: Securing your devices, real accounts, and identity after the scam¶

During a Pig Butchering scam, victims often gave the scammer far more than just cryptocurrency:

• Did you upload a photo of your Passport, Driver's License, or Social Security Number during "KYC Verification" on the fake trading site? If yes, the syndicate now holds a high-resolution scan of your government ID and will sell it or use it for identity fraud. Immediately freeze your credit files with Equifax, Experian, and TransUnion using our identity theft response guide.
• Did you install an app on your iPhone using an "Enterprise Developer Profile," "WebClip," or Apple TestFlight? Go to Settings > General > VPN & Device Management on your iPhone right now, tap any listed Enterprise App / Configuration Profile, and tap Delete Profile / Delete App.
• Did you download an .apk file onto your Android phone outside the Google Play Store? Uninstall the app immediately, turn on Google Play Protect, and if you granted the app Accessibility permissions, back up your photos and factory-reset the phone (see our stalkerware, spyware, and keylogger detection on phones mulombodi).
• Did the scammer ever ask you to install AnyDesk, TeamViewer, RustDesk, or screen-share your computer? Follow our tech support pop-up scam and remote desktop removal guide to purge unattended remote access agents, and rotate the passwords and 2FA on your real bank and email accounts.
• Consult a licensed Certified Public Accountant (CPA) or tax attorney regarding Tax Deduction / Theft Loss Rules: In some jurisdictions (such as under IRS Internal Revenue Code Section 165©(2) in the United States for transactions entered into for profit, see IRS Chief Counsel Memorandum 202511015), documented victims of investment/Pig Butchering fraud where the taxpayer had a profit motive may qualify to claim a Theft Loss Deduction on their tax return if they kept their police report, IC3 filing, and transaction records.

How to recognize and block the "Fake Crypto Recovery Agent" (The Second Scam)¶

Within days or weeks of losing money to a Pig Butchering scam, you will be targeted by the Recovery Room Scam:

1. How they find you:
2. Direct Re-Targeting by the Original Syndicate: Three weeks after stealing your money, the exact same scam call center messages you on WhatsApp or email pretending to be "Interpol Cyber Division," "The Global Blockchain Asset Recovery Commission," "Tether Refund Bureau," or a "Law Firm / Cyber Forensics Company." They already know the exact dollar amount you lost and your wallet address (because they are the ones who stole it), which makes them sound magically convincing.
3. Social Media Bot Swarms: If you comment on YouTube, Reddit, X (Twitter), or Facebook about being scammed, automated bots immediately reply: "I lost $90k too, but thank God @Cyber_Trace_Recovery_Official on Telegram/Instagram recovered 100% of my funds in 48 hours."
4. How the Recovery Scam works:
5. The "recovery specialist" shows you a fake screenshot claiming they "located and froze your stolen funds inside a smart contract / darknet escrow wallet," and asks you to pay $1,500 to $5,000 upfront for "smart-contract activation software," "bridging liquidity," or "legal bond insurance", or asks you to import a "recovery wallet" seed phrase and deposit 2,000 dollars of ETH for gas fees (which an automated sweeper bot steals in 0.5 seconds).
6. The Unbreakable Rule:
7. No private hacker, recovery company, or forensic firm on Earth has the technical capability to reverse a blockchain transaction or hack a scammer's private key.
8. Law enforcement agencies (FBI, Secret Service, Action Fraud, Europol) and Tether/Circle NEVER charge victims a fee, tax, or cryptocurrency gas deposit to return seized funds.

Nkonko itubu bela misangu ya bungi¶

Malu adi apetangana¶

• Cryptocurrency wallet drain and seed phrase compromise
• Bank account breach and unauthorized wire transfers
• Deepfake voice clone and AI impersonation scams
• Identity theft response and credit recovery
• Tech support pop-up scam and remote desktop removal
• Dishima dia masandi ne dishima dia ku Enternete
• Mukanda wa nomba ya tshimpitshimpi

Miaba mifumina¶

• Federal Bureau of Investigation (FBI) Internet Crime Complaint Center (IC3) (United States): Cryptocurrency Investment Fraud ("Pig Butchering") Public Service Announcements, Recovery Asset Team (RAT) Procedures, and Fake Crypto Recovery Schemes Warning.
• Financial Crimes Enforcement Network (FinCEN) (United States Department of the Treasury): FinCEN Alert FIN-2023-Alert005: Prevalent Virtual Currency Investment Scam Commonly Known as "Pig Butchering" (Red Flags and Rapid Response Program).
• Commodity Futures Trading Commission (CFTC) & Securities and Exchange Commission (SEC) (United States): Office of Investor Education and Advocacy Alert: Relationship Investment Scams and Fraudulent Asset Recovery Firms.
• National Cyber Security Centre (NCSC) & Payment Systems Regulator (PSR) (United Kingdom): Authorized Push Payment (APP) Fraud Reimbursement Rules and Romance/Investment Scam Guidance.
• United Nations Office on Drugs and Crime (UNODC) & INTERPOL: Transnational Organized Crime and Casinos, Cyber Fraud, and Fake Investment Compound Operations Analysis.