Pig Butchering Scams: What the Data Shows

A small business owner. A university professor. A retiree. Three very disparate lives but with one thing in common: these individuals all fell victim to pig butchering. Also known by the phrase “Shā Zhū Pán” in reference to their apparent origins in South East Asia, these cryptocurrency scams rely on psychological manipulation to wipe out victims’ life savings on the promise of making large returns on their investments. 

It is difficult to know how much money has been lost to pig butchering scams as only a small number of victims - by some estimates as few as 15% - report them to police. However, TRM’s analysis of on-chain transaction data, combined with proprietary source intelligence including interviews with the individuals singled out above, has identified several key characteristics of pig butchering scams. They include:

• The widespread use of Tether by scammers
• Significant interconnectivity between individual pig butchering scams
• Links to transnational organized criminal groups

The Tether Trail

Once cryptocurrency reaches a scammer’s wallet, it is typically shuffled from wallet to wallet in a complex web of transactions between scammers and money launderers (sometimes the same people), with each wallet accumulating funds from additional victims along the way. Funds often move circuitously, making it difficult for investigators to follow the money and to separate victim funds from other tokens.

In the case of one victim interviewed by TRM Investigators, losses of over $1 million spread over 15 transactions were traced to 11 different centralized exchanges. These fund movements consistently included multiple hops through intermediary addresses.

Victim funds typically end up reaching a few main exchanges, where they are often swapped for Tether (USDT) on Tron before continuing to be cycled through the money laundering network both via the main exchanges and unhosted wallets. Victims generally send funds in Tether as well, though usually on Ethereum, while a smaller percentage of victims paid in bitcoin or USDT on Tron.

The reasons for the popularity of Tether on Tron among pig butcherers appears to mirror those among both legitimate and other illicit actors: it is a stablecoin, and the Tron blockchain has low transaction fees and high speed, making USDT on Tron cheap and quick to launder.

Pig Butchering Scams Are Often Interconnected

TRM data indicates that cryptocurrency wallets that receive victim funds from individual pig butchering scams are also often associated with other scams. Furthermore, in a random sample of addresses to which victims stated they sent funds, over 75% exhibited signs of sophisticated on-chain money laundering activity.

While investigations taking a case-by-case approach to individual scams can result in relatively quick turnarounds for seizures, this finding suggests that a holistic, network science-based approach can prove useful in scaling up law enforcement efforts against pig butchering. 

The below graph illustrates a typical example of a pig butchering scheme studied by TRM Labs, showing the interconnected networks spanning multiple scams. Each color represents the scammer addresses in three different cases. As shown by the connections between the three coloured webs, the scammers appear to be operating multiple scams either in succession or in conjunction. In addition, the scammers appear to be relying on the same underlying money laundering network, with the same addresses appearing in multiple cases.   

The average amount received by addresses linked to one of the scammers depicted in the chart above was around $26.8 million, with the median around $5.1 million. While not all of those transactions could be definitively sourced to pig butchering victims, and some of the volume could be money laundering, TRM research suggests that hundreds of millions of dollars are likely to be stolen each year.

Clear Links to Transnational Organised Crime

Far from being the work of lone scammers, over half of the pig butchering schemes studied by TRM (spanning 2021 - December 2022) exhibited apparent links to large transnational organized crime groups. Many appear to be operating from South East Asia, according to TRM research, which is consistent with widespread reports of pig butchering and human trafficking networks based in Laos, Myanmar, Cambodia and other neighboring countries. Less than a quarter of addresses showed no apparent signs of belonging to these sophisticated money laundering networks, a possible sign that they were orchestrated by individuals or smaller scam groups.

No Shame in Speaking Out

In 2021, the FBI’s Internet Crime Complaint Center, known as IC3, received more than 4,300 complaints related to pig butchering, with cumulative losses of over USD 400 million. Reports from FBI field offices suggest that the crime wave is not slowing down.

Most victims fail to recover their funds, but many law enforcement agencies in the US and abroad are trying to change that. To be effective, it’s critical for law enforcement to identify funds for seizure before they leave exchanges.

Because of their intimate nature, pig butchering scams often leave victims confused and ashamed for having been duped into giving away their life’s savings to opportunistic scammers. Yet as TRM’s analysis shows, pig butchering is in fact a series of highly sophisticated operations often carried out by interlinked professional transnational crime syndicates. Reporting cases to local and national law enforcement, as well as on crowdsourced tools such as Chainabuse, remains essential to fighting back.