In 2025, Americans filed 61,559 complaints about cryptocurrency investment fraud with the FBI and reported losing $7.228 billion to it, more than to any other kind of online crime, according to the FBI’s Internet Crime Complaint Center (IC3) 2025 report. People aged 60 and over lost $2.76 billion of that sum. Most of the money went the same way: a stranger became a friend, the friend shared an investment tip, and the tip led to a trading app that the stranger controlled.
That script has a nickname, the pig butchering scam. It is a long con. It can run for weeks before crypto is mentioned at all, and by then the victim trusts the person on the other end of the chat more than any bank or adviser. The FBI notes that the scams are “largely perpetrated by organized criminal enterprises based in Southeast Asia”, often using trafficked people as forced labour to type the messages.
Below, the scam is followed from the first text message to the last fake “tax” bill, with the official numbers on both sides of the Atlantic and what to do once money has gone. Our overview of crypto scams covers every family of fraud in brief. The previous lesson of this path, on Ponzi and pyramid schemes in crypto, dealt with schemes that pay old investors with new money. Pig butchering works differently: there is no investment at all, only a screen showing one.
What a pig butchering scam is, and where the name comes from
The term is a translation of the Chinese “sha zhu pan”. The US Treasury’s financial intelligence unit, FinCEN, used it in an alert published on 8 September 2023, where it explains the image: the scammers fatten a hog before slaughter. In their own slang, victims are the “pigs”. The weeks of messages, compliments and small talk are the fattening. The large deposits at the end are the slaughter.
Official reports have since moved away from the nickname. The FBI’s 2024 report still described cryptocurrency investment fraud as “also known as ‘pig butchering'”; the 2025 report drops the phrase and speaks only of cryptocurrency investment fraud. The two labels describe the same thing, and readers still search for the first one, so this lesson uses both.
Two features set it apart from the scams covered earlier in this path. The first is time: a rug pull or a pump and dump plays out in hours or days, while a pig butchering scam can take months. The second is that it often does not look like an investment pitch at the start. It looks like a wrong number, a dating match or a message from an old classmate. Romance is one door in, not the only one: the FBI and FinCEN both describe victims approached as new friends, as long-lost acquaintances or through investment chat groups.
How the scam works, step by step
The FBI’s annual report, its public warnings and FinCEN’s 2023 alert describe the same sequence. The details vary from one gang to another; the shape rarely does.
Step 1: a message that asks for nothing
The first contact is harmless by design. FinCEN lists text messages and direct messages on social media, “usually under the guise of accidentally reaching a wrong number” or of trying to reconnect with an old friend. Other doors are dating apps, social networks and professional networking sites. The IC3 2025 report adds advertisements to that list.
The sender apologises for the mistake, then keeps chatting. The profile pictures show someone attractive and well off: travel, restaurants, a nice car, a busy job in finance or e-commerce. FinCEN notes that scammers often present a profile built around wealth and an enviable lifestyle. Nothing is asked for. That is the point.
Step 2: weeks of attention, then a move to a private app
The new contact soon suggests moving to WhatsApp, Telegram or another messaging app; the FBI says scammers “quickly move the conversation to a messaging platform”. Then comes the slow part. Good-morning messages, photos of meals, questions about your family, sympathy when you are tired. In a romance version, declarations of affection arrive early. FinCEN describes this phase as the scammer communicating over time to establish trust and build a relationship.
No official source gives a typical length for this phase; it is counted in weeks or months rather than days. What matters is that by the end of it, the victim is talking to someone who feels like a close friend, and who has never asked for a cent.
Step 3: the tip, and a platform only they can show you
Money enters the conversation sideways. The contact mentions that an uncle, a mentor or “an analyst friend” helps them trade crypto, gold or currencies, and that it has paid for the lifestyle in the photos. They do not ask you to send them anything. They offer to show you how.
FinCEN describes what follows: the victim is pointed to websites or apps “designed to appear legitimate” but controlled or manipulated by the scammer. The IC3 report adds a variant where victims are added to investment groups whose members pose as industry insiders. The scammer may walk the victim through buying crypto on a real exchange, sometimes by asking for screenshots or for remote access to the victim’s phone or computer. The coins are bought legitimately. Then they are sent to a deposit address shown inside the fake platform, which belongs to the gang.
That transfer is the moment the money is lost. Once a crypto transaction is confirmed, nobody can reverse it, as our guide to how crypto transactions work explains, and the address the victim pasted was never an account in their name. Everything after this point happens on a screen the criminals draw.
Step 4: fake profits and a withdrawal that works
The balance on the platform climbs. FinCEN says the returns shown are “extraordinary” and “have been fabricated”. To remove the last doubt, the scammer may let the victim withdraw a small sum, which arrives for real. The trick is cheap for the gang, which pays it out of the victim’s own deposits, and it is very effective.
Confidence rises with the balance. The victim adds savings, then borrowed money. FinCEN reports victims who emptied tax-advantaged retirement accounts or took home equity lines of credit and second mortgages. The IC3 report says victims are also offered “loans” to encourage larger investments. Among the cases where the FBI stepped in during 2025, one victim was about to cash out $750,000 from a 401(k) retirement plan, another to sell her house to invest $500,000.
Step 5: bigger deposits, then taxes, fees and silence
When the victim slows down, the platform can show sudden losses that only a new deposit will “cover”. When the victim asks to withdraw everything, a new obstacle appears: a tax, a fee or a penalty to pay first, always from fresh money. The FBI calls these charges “a final attempt to exploit money from the victims before the scammers disappear”. The withdrawal-fee trick has its own lesson later in this path, on fake investment platforms; here, it is enough to know that the FBI tells victims not to pay extra fees or taxes to withdraw, because the balance being held back does not exist.
After the last payment, FinCEN notes, the scammer simply cuts off contact. The friend, the mentor and the platform all disappear together, because they were always the same people.
Step 6: the second scam, the recovery offer
Victims are then targeted again. Someone calls or writes claiming to be a lawyer, a “blockchain investigator”, a regulator or a police unit, and offers to trace and recover the stolen coins for an upfront fee. The FBI counted 10,516 complaints about recovery scams in 2025, with $1.4 billion in reported losses, and noted rising complaints about people impersonating government officials and recovery firms.
The pattern reaches Europe too. On 12 January 2023 the French market regulator, the AMF, warned that callers claiming to work for it were offering victims of investment scams to recover their money, with what appeared to be the AMF’s switchboard number on screen. The AMF said it never contacts savers on its own initiative and has no power to recover lost funds. Italy’s market regulator, Consob, warned on 21 February 2025 of fake lawyers using its name and logo to promise victims of online trading sites that they would recover their money, for a fee. Consob does not recover debts for anyone, and called these “truffe al quadrato”, scams squared.
The fake trading app is the trap, not the person
Most victims never meet the scammer, and most never see the money leave their control. What they see is an app or a website with a professional dashboard: live-looking charts, a balance in dollars or in USDT, a support chat, sometimes a “VIP level”. It is a stage set.
FinCEN describes several forms. Some are websites made to look like real trading platforms, sometimes imitating well-known names. Some are apps downloaded from a link or a third-party website rather than from an official app store, which FinCEN lists as a red flag. Others are legitimate applications fitted with third-party plugins that let the scammer falsify what the victim sees. Newer disguises exist too. An FBI warning of 14 March 2023 names “liquidity mining” and “play-to-earn” schemes, and FinCEN describes fake games that promise rewards to players.
In every version, the numbers on screen are written by the scammers. The “profit” is a figure in their database. The deposit address shown on the platform is a wallet they control, and FinCEN names bitcoin, ether, tether (USDT) and TRX among the currencies known to be used in these scams. The difference between your own crypto wallet and a balance shown on someone else’s website is the point to keep: if you cannot move the coins yourself, with your own keys, you do not hold them. Our guide to crypto addresses explains why an address tells you nothing about who owns it.
The infrastructure behind these sites is an industry of its own. On 29 May 2025 the US Treasury sanctioned Funnull Technology, a Philippines-based company that, according to OFAC as reported by Elliptic, bought internet addresses from mainstream cloud providers and sold them on to criminals hosting scam sites, facilitating $200 million in losses reported by victims.
Who sends the messages: the scam compounds of Southeast Asia
The person typing is often a victim too. The FBI’s 2025 report says these scams are run largely by organised criminal groups in Southeast Asia that use trafficked people as forced labour. A United Nations Office on Drugs and Crime (UNODC) report released on 21 July 2026 identified people from at least 80 countries and territories inside scam compounds in the region, according to OCCRP.
The largest case so far targets one company. On 14 October 2025, the US Department of Justice unsealed an indictment in Brooklyn against Chen Zhi, founder and chairman of Cambodia’s Prince Holding Group, for wire fraud conspiracy and money laundering conspiracy. Prosecutors allege that the group ran forced-labour compounds in Cambodia where trafficked workers carried out crypto investment fraud, and that Chen managed them directly. These are allegations: Chen has not been tried in the United States, and the Prince Group has called the US and UK accusations “baseless”, according to OCCRP. The same day, prosecutors filed a civil forfeiture complaint against about 127,271 bitcoin, worth roughly $15 billion at the time, which the DOJ called “the largest forfeiture action in the history of the Department of Justice”. The Treasury sanctioned 146 people and entities tied to the group and moved to cut off Huione Group, a Cambodian financial group it says laundered at least $4 billion between August 2021 and January 2025.
The case is far from closed. Cambodia arrested Chen Zhi on 6 January 2026 and sent him to China, not to the United States, OCCRP reported. On 25 September 2026, Judge Rachel P. Kovner of the federal court in Brooklyn ruled that nine people who said they were fraud victims lacked standing to contest the forfeiture, because they could not trace their losses to the seized wallets, CryptoSlate reported. That ruling did not complete the forfeiture, which was still pending as of October 2026. If the government wins, victims can ask the DOJ for remission, a discretionary payment.
Other actions target the system rather than one boss. On 12 November 2025 the Treasury sanctioned the Democratic Karen Benevolent Army, an armed group in Burma, and companies it linked to scam centres, and the US launched a Scam Center Strike Force aimed at compounds in Burma, Cambodia and Laos. The Treasury release cited a US government estimate that Americans lost at least $10 billion to Southeast Asia-based scam operations in 2024, up 66% on a year earlier.
Pig butchering scam figures: what the FBI and Europe report
Numbers on this fraud come from three kinds of source: complaints filed with police, estimates built from blockchain data, and regional studies. They measure different things and should not be added together.
United States: the FBI’s 2024 and 2025 figures
The IC3 figures are the most detailed available. They count only complaints that victims filed, so the real losses are higher. Romance and investment fraud are reported in separate categories, and a romance that turns into a fake investment can land in either.
| Category (complaints / reported losses) | 2024 | 2025 |
|---|---|---|
| All internet crime complaints | 859,532 / $16.6 billion | 1,008,597 / $20.877 billion |
| All cryptocurrency complaints | 149,686 / $9.3 billion | 181,565 / $11.366 billion |
| Crypto investment fraud | 41,557 / $5.8 billion | 61,559 / $7.228 billion |
| Crypto investment fraud, victims aged 60+ | 8,043 / $1.6 billion | 13,685 / $2.76 billion |
| Confidence and romance fraud (all payment types) | 17,910 / $672 million | 23,159 / $929 million |
| Recovery scams | no comparable figure | 10,516 / $1.4 billion |
| Crypto ATM and kiosk fraud | 10,956 / $246.7 million | 13,460 / $389 million |
Two details in those figures matter for readers. The losses are not confined to retirees: Americans aged 40 to 59 reported $2.3 billion in crypto investment fraud losses in 2025, and those in their thirties $412.6 million. And across all crypto-related complaints, the average reported loss was $62,604.
The FBI also tries to stop scams in progress. Its Operation Level Up, launched in January 2024 with the US Secret Service, uses IC3 data to find and warn victims. In 2025 it contacted 3,780 victims of crypto investment fraud; 78% did not know they were being scammed, and 38 were referred to a victim specialist for suicide intervention. The FBI puts the losses avoided at about $226 million that year and more than $500 million since launch.
Worldwide estimates do not agree, and why
Chainalysis, a blockchain analytics firm, wrote on 13 January 2026 that crypto scams received at least $14 billion on-chain in 2025 and estimated that about $17 billion was stolen through scams and fraud over the year, as more scam addresses are identified. It counts all scam types, and names pig butchering and high-yield investment programmes as the dominant categories by volume, without a separate dollar figure for pig butchering.
UNODC’s July 2026 report, as summarised by OCCRP, estimated scam losses of $88.3 billion to $114.1 billion in 2025 in East and Southeast Asia, Australia and New Zealand. That is a regional estimate of all scam losses, crypto or not. The gap between $17 billion and $114 billion is a gap in method and scope, not a contradiction: no source counts pig butchering alone worldwide.
Europe and the UK: plenty of warnings, little hard data
Europe has no figure comparable to the FBI’s. Europol’s Internet Organised Crime Threat Assessment 2026 calls fraud schemes “the fastest-growing area of organised crime” and says investment fraud, “particularly related to cryptocurrencies, is especially prevalent”. Member states name investment fraud, business email compromise, romance and tech-support scams among the most common types. Europol adds that generative AI lets fraudsters personalise their approach. It gives no loss total for romance or crypto investment fraud.
National data is just as thin. Italy’s Polizia Postale, in its annual report for 2025, recorded 27,085 proceedings for economic and financial cybercrime with more than 269 million euros stolen, and described fake online trading offers promoted with AI deepfakes of well-known people, without a separate romance figure. France publishes no official statistic on romance scams that Coindaro could find. In the UK, police and banks publish romance and investment fraud data on different definitions, and there is no official total for crypto investment fraud as of October 2026. Readers in Europe should treat any single “European pig butchering total” they see online with suspicion.
Warning signs, in the order you meet them
Each of these signs, on its own, can have an innocent explanation. Two or three together, in this order, describe the script almost exactly. They come from FinCEN’s red flags, the FBI’s warnings and the Federal Trade Commission’s advice.
- A stranger writes to a “wrong number”, or a dating match or professional contact moves the chat to WhatsApp or Telegram within days.
- The new friend mentions, unprompted, a lifestyle paid for by trading crypto, gold or forex, and offers to teach you rather than asking for anything.
- The investment only exists on a website or app you reached through their link, or through a file to install outside the official app stores.
- You are asked to share screenshots of your exchange account or to install a remote-access app “so they can help”.
- Returns are high and steady, there is a deadline (“the window closes tonight”), and you feel pressure to decide before talking to anyone.
- You are encouraged to borrow, remortgage or close a retirement account to put in more.
- A small withdrawal works, then a larger one is blocked until you pay a tax, a fee or a “verification deposit”.
- After you lose money, someone you never contacted offers to recover it for a fee.
The habits that block the scam are simple to state. Never send money or crypto to someone you have only met online; the FTC’s advice puts it in almost those words. Check any platform with your national regulator before depositing a cent: in the US the CFTC published an advisory on 7 February 2022 about forex, precious metals and digital asset romance scams, and in the UK the FCA keeps a register of authorised firms and a warning list. Never give anyone remote access to a device you use for money, and never share your recovery words: our guide to seed phrase security explains why.
Already sent money? What to do in the first days
Stop paying. No tax, fee, penalty or “unlock deposit” will release a balance that never existed, and each new payment only extends the scam.
Keep everything: the chat history, the contact’s usernames and phone numbers, the platform’s web address, every wallet address you sent to and every transaction ID. The FBI asks for exactly these details in a report. Write down the dates and amounts while you remember them.
Tell your bank and the exchange you used at once. A crypto transfer cannot be reversed, but a bank wire sent days ago can sometimes be stopped, and an exchange or a stablecoin issuer can sometimes freeze funds that reach an account it controls. Our guide to how centralized exchanges work explains why those platforms know their customers and can act; stablecoins such as USDT can be frozen by their issuer. None of this is guaranteed, and no source gives a typical recovery rate.
Then report it, in your own country:
- In the United States, file a complaint with the FBI’s IC3 at ic3.gov and report to the FTC at ReportFraud.ftc.gov.
- UK victims report to Report Fraud at reportfraud.police.uk or on 0300 123 2040: the City of London Police service replaced Action Fraud from 4 December 2025, with a full public launch in January 2026.
- In France, an online scam can be the subject of a complaint on the Interior Ministry’s THESEE platform, reached through service-public.fr, and the Info Escroqueries line, 0 805 805 817, gives advice free of charge on weekdays. The 17Cyber service directs victims to the right channel.
- In Italy, the Polizia Postale takes reports and complaints about online crime through its website, commissariatodips.it, and Consob answers questions on unauthorised investment offers.
Do not pay a private “recovery” company that contacts you, and be wary of any that advertises a guaranteed result. Recovery offers are the second half of the same crime, as the IC3 figures above show.
Talk to someone you trust. Shame keeps victims paying and keeps them silent; the scammers rely on it. That 78% of the victims the FBI warned in 2025 did not know they were being scammed says more about the quality of the script than about the people who believed it.
Why careful, intelligent people fall for it
The scam does not depend on greed or ignorance. It depends on time. After weeks of daily messages, the scammer is not a stranger offering a deal but a friend sharing what works for them, and the first test withdrawal turns doubt into proof. The victims in the FBI’s age table include every age group, from people in their twenties to retirees.
Tools make the script cheaper to run. Europol notes that generative AI helps fraudsters personalise their messages, and Chainalysis found that scam operations with on-chain links to AI service vendors took in about $3.2 million on average, against about $719,000 for the others. Fake photos, smooth translation and scripted replies mean the “person” can write fluent English, French or Italian at any hour.
The defence does not need technical knowledge. It needs one rule held firmly: a person you have met only online never decides where your money goes, however long you have known them. The next lesson of this path looks at the platforms themselves, with clone sites, regulators’ blacklists and the withdrawal-fee trick in detail, and how to check a site before sending anything.
