Essay · 2 min read
Pig butchering: how the scam works, and the trail it leaves on-chain
The fraud is patient, personal and industrial. The money still has to move, and that is where it shows.
By Kyeson Blake Utley ·
Before I founded GhostKey, much of my work was tracing cryptocurrency for people who had lost it to scams. One kind of case came up more than any other: the slow, friendly investment fraud known as pig butchering. The name comes from the scammers themselves. They "fatten" the victim with attention and fake profits before taking everything.
It is worth understanding how it works, because almost every victim I spoke to believed they were too careful to fall for it.
How the scam unfolds
The approach. It starts with a message that looks like a mistake: a wrong-number text, a misdirected chat, a friendly reply on a dating app or professional network. The scammer apologizes, keeps talking, and builds a relationship over weeks.
The opportunity. Eventually the new friend mentions the trading they do on the side, usually crypto, sometimes gold or forex. They never push. They show screenshots and offer to teach.
The fake platform. The victim is guided to a polished trading app or website. It is entirely controlled by the scammers. Deposits appear, profits appear, and an early small withdrawal goes through, which builds trust.
The squeeze. When the victim tries to withdraw the larger balance, new obstacles appear: a tax, a verification fee, an account upgrade. Each payment unlocks another demand, until the victim stops paying or runs out of money.
Who is on the other end
Many of these operations run out of large scam compounds, and investigations by journalists and the United Nations have documented that some of the people typing those messages are themselves trafficking victims, held and forced to work. That is part of why I co-founded TRFFC, a non-profit project funding investigators who work on trafficking cases. The fraud and the trafficking are the same business.
The trail it leaves
The scammers control the story the victim sees. They do not control the blockchain.
Every deposit into a fake platform is a real transaction to a real address. Funds are typically consolidated, split across many wallets, swapped between assets, and moved toward exchanges where they can be cashed out. Stablecoins are common because they hold their value while in transit.
That movement is visible. Tracing follows the funds hop by hop, clusters addresses that behave like one operator, and looks for the point where money touches a regulated exchange. That is where law enforcement can sometimes freeze assets with legal process. Tracing does not guarantee recovery, but it turns a story into evidence. I walk through the full tracing process in my conference talk on crypto fraud and blockchain forensics.
If it happens to you
Stop paying. No fee will release your balance. The balance was never real.
Preserve everything: chat logs, the platform's address, and every transaction hash and wallet address you sent funds to.
Report it to the FBI's Internet Crime Complaint Center (ic3.gov) in the U.S., or your national equivalent, and to the exchange you sent funds from.
Beware of "recovery" offers. Victims are often targeted a second time by people promising guaranteed recovery for an upfront fee. Legitimate investigators and attorneys will not guarantee results, and will explain exactly what tracing can and cannot do.
The best defense is the oldest one: no stranger who found you by accident is going to make you rich.
