How to Avoid the Slaughter

One increasingly common form of cryptocurrency scam is the euphemistically-named “pig butchering” scheme. Pig butchering involves fraudsters who pose as successful traders to then entice unsuspecting victims to invest with them and make incredible returns. The fraudsters first take the time to build trust with their victims on social media, text, or dating applications, before promising to teach them how to multiply their life savings with cryptocurrency, forex trading, or other financial markets. After the scammer “feeds” their victims (the pigs) with promises of huge profits, they then butcher them, cutting off communication and absconding with the money the unsuspecting targets had invested.

Scammers adopt a variety of disguises intended to build trust with their targets, including posing as mutual friends or former colleagues of a victim in order to initiate a seemingly-legitimate conversation. Pig butchering fraudsters will provide fake websites and apps that allow victims to supposedly track their investments. These sites give the impression that the initial investment is rapidly growing. However, when the victims try to cash out their returns, the scammers delay by requesting further information or informing “investors” that they need to pay income taxes or some other fee in order to withdraw. Luckier victims will walk away here, but those that take this bait simply lose even more money. Ultimately, victims are not able to retrieve the money they had invested and the fraudsters cut off contact with the victims, completing the scam.

The Rise of Pig Butchering Scams

According to the FBI, pig butchering scams resulted in losses of more than $429 million in 2021. More than 75% of victims lost at least half their net worth and approximately one-third were driven into debt as a result of pig butchering scams.

The Global Anti-Scam Organization reported that 67% of victims of pig butchering scams are women between the ages of 25 and 40, who lost an average of US$121,926. Similar studies conducted in Australia and China reflected this skew, with approximately 69% of reported victims being women.

Perhaps surprisingly, 32% of pig butchering victims hold a graduate degree. This is a heavy overrepresentation, as only 13.1% of the U.S. population holds an advanced degree.

The Global Anti-Scam Organization also found that victims of pig butchering schemes tend to be unfamiliar with how regulated brokers work, were targeted at a vulnerable time in their lives, and had substantial savings to invest.

How to Detect and Avoid Pig Butchering Schemes

The FBI has released four tips to avoid falling victim to pig butchering and similar scams.

Verify Investment Opportunity Claims

Conduct comprehensive due diligence on any and all investment opportunity claims. Pig butchering scammers often approach their victims for unrelated purposes to build trust and only introduce the fraudulent investment prospects later on once they have established a relationship with the victims. Exercise extreme caution when strangers or long-lost contacts reach out to propose investment opportunities.

Double-Check Domain Names

Many pig butchering scammers create domains that mimic the websites of legitimate financial institutions. Make sure to always check domain names, especially for cryptocurrency exchanges, to detect the subtle changes that characterize fraudulent websites.

Do Not Download Suspicious Software or Apps

Stop and evaluate investing apps or software before downloading anything. In order to confirm the validity of an app, pay attention to details provided on app stores, such as the developer, seller, and application description. If the developer name is unknown, contains misspellings, or closely mimics a well-known brand or organization, it could be a fraudulent app. Most app stores include links to the developer’s website, so always check to see if these links point to an authentic site before proceeding. Exercise caution if unknown websites ask you to download applications or software.

If an Investment Opportunity Sounds Too Good, It Likely Is

The golden rule of investment due diligence applies here. If an investment opportunity sounds too good to be true, it likely is. Pig butchering scams often promise guaranteed returns, which should always be considered a major red flag.

Law Enforcement Action Against Pig Butchering Schemes

On October 13, 2022, the U.S. Justice Department unsealed an indictment for eleven residents in New York and New Jersey for allegedly defrauding victims of approximately $18 million from pig butchering schemes. The defendants were indicted for money laundering conspiracy, wire fraud conspiracy, bank fraud conspiracy, passport fraud conspiracy, and aggravated identity theft, among other charges, for their roles in these schemes. This indictment marks the largest indictment of individuals for committing and defrauding victims through pig butchering schemes.

On November 21, 2022, the U.S. Attorney’s Office for the Eastern District of Virginia announced the seizure of seven domains used in pig butchering schemes. These domains were all spoofed versions of the Singapore International Monetary Exchange website.

Victims lost over $10 million in this particular instance of pig butchering.

On-Chain Investigation of Pig Butchering

Not all pig butchering scams utilize cryptocurrency. This can make the flow of funds hard to track through the often-opaque world of banking. However, for those that do, we can easily use blockchain analysis to trace stolen funds and identify scammers’ wallets.

In the previously mentioned case, once victims accessed a spoofed Singapore International Monetary Exchange website, they were provided with one of seven deposit addresses on the Ethereum blockchain. After the victim transferred funds to these wallets, the scammers would transfer the funds to a common intermediary deposit address.

From there, the funds were transferred to decentralized exchanges (DEXs) where ETH was swapped for stablecoins. From there, the funds were transferred to numerous other addresses and later off-ramped by converting the cryptocurrency into fiat currency by depositing numerous OKX addresses. According to the U.S. Secret Service, the fraudsters likely chose to use OKX to off-ramp the stolen cryptocurrency to fiat currency as the exchange is based in the Seychelles and is not available for use in the United States. Exchanges that make a point of operating outside of United States jurisdiction are less likely to respond to U.S. search warrants and subpoenas, helping provide cover to international scammers and money launderers.

In this case, the scammers continued this scam from approximately May to August 2022, with at least five identified victims whose funds were transferred, stolen, and laundered through this series of on-chain transactions.

Pig butchering combines manipulation tactics with complex money laundering techniques, resulting in multiple layers of fraud. Analyzing on-chain activity gives quantifiable insights into the mechanisms and magnitude of pig butchering scams. Equipped with the knowledge of how they work and what to be on the lookout for, potential targets can better identify and avoid falling victim to such scams.

The Importance of Understanding Pig Butchering Scams

CertiK’s mission to secure the Web3 world includes spreading awareness and information on known and identified scams. By understanding common tactics used by fraudsters, users can better detect and avoid these scams. On-chain activity can be analyzed and evaluated to also better understand the money laundering methods of these scammers.

If you suspect you are being contacted by a scammer, you can report it to the FBI using their Internet Crime Complaint Center. Users can additionally warn the community by reporting suspicious projects directly from the CertiK Security Leaderboard. Community alerts are shared in real-time via @CertiKAlert.

Pig butchering scams are one of many ways in which unscrupulous actors seek to part unsuspecting investors from their money. For further reading, check out our analysis of front running scams, which are becoming increasingly prevalent on YouTube.

See the CertiK blog for the official post to this article