What a pig butchering scam is
A pig butchering scam is a long-running fraud in which someone builds a personal relationship with a target, often posing as a romantic interest or a new friend, before steering the conversation toward a cryptocurrency investment. The name comes from the Chinese term sha zhu pan, which describes fattening a pig before slaughter: the scammer spends weeks or months making the target feel valued and trusted before taking their money.
Because the emotional relationship comes first and the financial request comes second, this fraud is often described as a crypto romance investment scam rather than a simple investment pitch. The relationship is the delivery mechanism; the fake trading platform is where the money actually disappears.
How it works in practice
The pattern usually starts with an unsolicited message on a dating app, social network, or messaging platform, often from a profile with polished photos and a patient, warm tone. The person invests real time in conversation, sometimes for weeks, before casually mentioning that they trade cryptocurrency and have made good money doing it.
The target is invited to try a small deposit on a platform the other person recommends. Early withdrawals are usually allowed, and sometimes even encouraged, because a small win builds confidence and makes the next, larger deposit feel safe. As trust grows, the requests get bigger. The target may be urged to borrow money, move savings, or use a wallet the other person helped them set up.
At some point the pattern breaks. Withdrawals stop working, a sudden tax or fee becomes due before funds can be released, or the person who started the conversation goes silent. By then, the money sent to the platform's accounts and wallet addresses is effectively gone.
Warning signs to look for
A few signals repeat across these cases and are worth treating as hard stops rather than minor doubts.
- Someone you have never met in person moves quickly from casual chat to talking about their crypto trading success.
- You are asked to install a specific app or use a specific website to trade, rather than a platform you chose on your own.
- Early withdrawals work smoothly, then a new deposit, fee, or tax payment is suddenly required before you can withdraw again.
- Pressure to act quickly, borrow money, or keep the relationship and the investment secret from friends or family.
- The trading platform has no verifiable ownership information and no track record you can find outside the platform itself.
What to do if you are targeted
Stop sending money the moment a platform asks for an unexpected fee, tax, or additional deposit before releasing funds already in the account. That single request is one of the clearest signs that something built on a relationship has turned into a fraud, whatever the platform calls itself.
Do not rely on reassurances from the person you have been messaging, even if the relationship feels genuine, because keeping the conversation going is what produces more money for them. Before sending or moving further funds, check the platform's website with a website checker and any wallet address it has given you with a wallet checker. A platform with no verifiable history, or a wallet tied to reported fraud, is a reason to stop, not a reason to send more.
If money has already been sent, preserve every message, transaction record, and wallet address involved. That record is what any reporting or recovery effort will depend on, and it matters more the longer time passes.
How TrustSniffer checks for this
TrustSniffer looks at both sides of this kind of fraud: the website or platform the target is told to use, and the wallet addresses the money is sent to. Our analysis has covered 3372 websites, and 17145 cryptocurrency wallet addresses have been assessed for exactly these patterns, including platforms and wallets that show up repeatedly in reports of relationship-led investment fraud.
You can run a suspicious platform through the website checker or a wallet address through the wallet checker before sending anything. You can also browse confirmed cases in the sanctions directory or see the broader pattern of activity on the Risk Index.
