Pig Butchering Scams Explained: Trace Them On-Chain

‍

Summary

• A pig butchering scam is a long-term confidence scam, where a stranger spends weeks earning their victim’s trust online, then guides them onto a counterfeit crypto trading platform where deposits are pocketed by the scammers and withdrawals are impossible.
• Americans reported over $7.2 billion in crypto investment fraud losses to the FBI in 2025, and the UN estimates regional scam losses across East and Southeast Asia, Australia and New Zealand reached as high as $114.1 billion.
• The scheme follows six predictable stages, from a "wrong number" text to frozen withdrawals and fake "tax" demands, with proceeds laundered mostly via USDT on TRON.
• Every on-chain transfer remains publicly visible, so victims and investigators can use Arkham to trace scam wallets, spot exchange deposits, and provide law enforcement with a stronger case.

What Is a Pig Butchering Scam?

A pig butchering scam is a form of confidence scam in which a fraudster poses as a friend, partner or mentor and uses that bond to siphon funds or data from a victim, usually via means of fraudulent investment schemes.

The name comes from the Chinese phrase shā zhū pán, which directly translates to “pig slaughtering plate”. Scammers call their targets "pigs": the weeks of attention are the feeding, and the final theft is the slaughter. The U.S. Treasury's Financial Crimes Enforcement Network (FinCEN) issued a formal alert on the scheme in September 2023, noting that it is largely run by Southeast Asian criminal groups that use trafficked workers to reach millions of people.

How to Trace a Scam Wallet With Arkham

The trace begins with the address the victim was instructed to deposit into. Arkham ties addresses to real-world entities using a library of more than 4 billion labelled addresses and 1.2 million entities, providing context to kick off any trace.

1. Look up the scam address or entity: Paste the deposit address into Arkham's search bar. If Arkham has attributed it, the entity's name and category will show up. Otherwise, you can still see the balance, full transaction history and any behavioral tags on its entity page. If you have access to Arkham’s API subscription, each address can also be further queried to return a risk score from 0 to 100 evaluating its exposure to illicit funds, along with a short explanation on the risk vectors it is exposed to.
2. Read the entity labels and counterparty breakdown: Check the tags first, since sanctioned or banned addresses are flagged there. Then open the Top Counterparties tab to see who the wallet has been interacting with. Labelled counterparties, such as exchanges or OTC desks, show where the money tends to land.

‍

‍

3. Follow the outflows: Filter transactions by chain, token, value or date. In pig butchering cases, look for multiple inflows from victims followed by one large consolidation transfer, then for transfers into an exchange deposit address. Arkham's Visualizer and Tracer turn those hops into a graph to facilitate the process.
4. Set an alert: Create an alert on the address so Arkham notifies you when funds move again. A fresh transfer to an exchange is often the most useful lead for law enforcement to work with.

‍

‍

The same checks work as prevention. Arkham's label set covers known illicit actors alongside exchanges and funds, and its tags page lists the categories it applies. Checking an address this way before sending funds takes about a minute. Our guide to wallet screening walks through the process in greater detail.

How Big Is the Problem?

Pig butchering is one of the costliest frauds on record. The FBI's 2025 Internet Crime Report logged 61,559 complaints of cryptocurrency investment fraud, up 48% on 2024, with reported losses of $7.228 billion. Victims aged 60 and over lost $2.76 billion of that total. The FBI attributes most of these schemes to organized groups in Southeast Asia that use trafficked people as forced labor.

‍

‍

Outside of the U.S., the figure grows even larger. The UN Office on Drugs and Crime's July 2026 threat assessment put 2025 scam losses across East and Southeast Asia, Australia and New Zealand at between $88.3 billion and $114.1 billion, with people from at least 80 countries found inside scam compounds. In 2023, the UN Human Rights Office estimated that at least 120,000 people in Myanmar and roughly 100,000 in Cambodia may be held and forced to run online scams.

The Chen Zhi Case

The October 2025 U.S. case illustrated the alleged scale of one network, although governments, researchers and journalists had documented the wider scam-compound industry for years. Prosecutors in Brooklyn unsealed an indictment charging Chen Zhi, chairman of Cambodia's Prince Holding Group, with wire fraud conspiracy and money laundering conspiracy for running forced-labor scam compounds ringed by high walls and barbed wire. The DOJ also filed to forfeit roughly 127,271 BTC, then worth about $15 billion, the largest forfeiture action in its history. The Treasury sanctioned 146 related targets the same day.

Upon further investigation, Arkham revealed that the Bitcoin seized was part of the 127,426 BTC that had been drained from the LuBian mining pool on December 28, 2020, through a weakness in its private key generation. The indictment later placed LuBian inside Prince Group's laundering network, where mining turned scam money into coins with no criminal history. The forfeiture complaint listed the original LuBian wallets as the seized property, consolidating the seizure into U.S. Government's holdings, which currently sit at just over 306,000 BTC. It has never been disclosed how the U.S. Government took control of the coins. In January 2026, Cambodia said Chen had been arrested and extradited to China.

How Do Pig Butchering Scams Work?

Most cases move through the same six stages.

1. Initial contact: The first message tends to look like an accident: a text meant for someone else, a dating app match, a social media comment or a recruiter-style note on LinkedIn. The IC3 lists texts, social media, ads and dating apps as the usual openings.
2. Fattening the pig: Weeks of daily chat follow, full of photos, meals and personal stories. The scammer usually quickly suggests moving the chats over to a messaging platform such as WhatsApp or Telegram. The subject of money never comes up at this point, with the main objective to become a trusted voice in the victim's life.
3. The investment hook: Almost in passing, the scammer mentions their success trading crypto and offers to teach the victim. They direct their victims to a specific "platform", usually a fake exchange or DeFi site dressed to look like a real one. After a small initial deposit and initial “profits” on screen, the victim is often allowed to withdraw a modest "profit" to build their trust in the legitimacy of the platform.

‍

‍

4. Escalation: With trust in place, the investment amounts climb. The investment platform interface shows the victim steady, fabricated gains, and the FBI also notes that victims are sometimes offered loans to invest more. At this point, the scammers often employ urgency tactics as well, a closing window for special promotions, a VIP tier on the platform, or a trade opportunity that is only open for a short period.
5. The slaughter: Once the victim tries to cash out a large enough sum, the withdrawal stalls. They are told to pay "taxes" or an "unlocking fee" first. Each payment triggers a new demand until the victim stops paying, and then the platform and the scammer disappear.
6. Laundering: UNODC describes stablecoins, particularly USDT on TRON, as a preferred choice for Asian crime syndicates engaged in cyber-enabled fraud and money laundering. Prosecutors in the Chen Zhi case described Prince Group associates splitting funds across scores of addresses and then pulling them back into a few. Peel chains, hops between blockchains, OTC brokers, exchange deposits and mixers like Tornado Cash, are also common next steps to further obfuscate their on-chain trail.

Why Do Pig Butchering Scams Use Crypto?

For the scammer, crypto solves several problems at once. Payments cross borders in minutes, with no middlemen to question the nature of these cross-border transactions. Confirmed transfers on-chain also cannot be reversed. Addresses are pseudonymous and cost effectively nothing to create, so a single operation can run thousands of them. USDT on TRON tends to be a preferred choice for criminals for its stable value, ease of use, pseudonymity and low fees.

However, crypto also works against them. Every transaction sits on a public ledger that never forgets, which is how investigators linked Lubian’s 2020 mining-pool theft to the 2025 forfeiture of Prince Group's assets. Major stablecoin issuers often have a blacklist function as well, enabling them to freeze tokens involved in illicit activity. In June 2025, the DOJ filed to forfeit more than $225.3 million tied to investment fraud laundering, directly mentioning Tether for their proactive assistance. Governments can also sanction and freeze addresses directly. According to Arkham data, as of October 2025, Chen Zhi’s sanctioned wallets still hold over $1.5B worth in BTC. 

For Compliance Teams: Automating the Checks

The Arkham API exposes the same data programmatically. One query returns an address's entity match, labels and risk score, broken down by exposure to theft proceeds, sanctioned addresses, mixers and more. Transfer history can be filtered by counterparty, token or time window and fed into a rules engine that holds or blocks risky deposits automatically. Build with Arkham API to get started.

What to Do if You’ve Been Scammed

The first step is to stop sending any more money to the scammers, including any "fee" to release your balance. Paying it only extends the scam and increases your losses. Gather all evidence relating to the scam: wallet addresses, transaction hashes, the platform's URL and domain, usernames, phone numbers and chat logs. These are the details FinCEN asks financial institutions to include when reporting suspected pig butchering.

Report quickly. In the U.S., file at ic3.gov; the IC3 asks for full transaction details whatever the amount lost, since they can help freeze funds. In other jurisdictions, report the scam to your national police or fraud reporting center, and notify any centralized exchange that received your money. Be wary of anyone who contacts you offering to recover your funds. Scammers often target victims a second time, using the promise of recovery to exploit their panic. 

A report to law enforcement is more effective with the relevant blockchain analysis attached. A short timeline built on Arkham, showing the deposit address, each hop and the exchange where the funds arrived, gives police and compliance teams a specific account to act on instead of a general complaint. This is especially so in jurisdictions where law enforcement may not be as experienced with the investigation of crypto-related crimes. Our explainer on blockchain forensics dives deeper into how investigators assemble these cases.

Conclusion

Pig butchering succeeds by exploiting patience and trust of victims rather than any technical flaw. The weeks of friendly messages and social engineering are the real strategy, with the fake platforms forming the closer. Yet, the crypto that makes the scam an efficient one also leaves a permanent record on the blockchain. From the LuBian coins to frozen USDT, recent cases show that funds traced on-chain can still be found, flagged and, in some cases, even seized.