Pig butchering: how the long con works

Where the name comes from, and why it matters

The term is a translation of the Chinese phrase sha zhu pan, literally pig-butchering plate. In the fraud operators’ own metaphor, the victim is a pig to be fattened over time before slaughter. That framing is not incidental colour; it describes the method. Unlike a smash-and-grab scam that seeks a fast payment, pig butchering is engineered for patience. The fattening is the weeks of relationship-building, and the slaughter is the moment the accumulated deposits are taken. FinCEN and Chainalysis both use this structure to explain why the fraud is so effective: by the time money is discussed, the target is dealing with someone they consider a friend or partner, not a stranger.

Stage one: the relationship build-up

Contact usually begins somewhere that normalizes talking to strangers: a dating app, a social platform, or an out-of-the-blue message that appears to be a wrong number. The opener is friendly and low-pressure, and crucially says nothing about money or investing. Over days and weeks the correspondent becomes a fixture, messaging daily, sharing details of an attractive lifestyle, showing warmth and consistency. The relationship may be romantic or simply a close friendship. The objective of this stage is singular: to convert a stranger into a trusted confidant, because every later step relies on trust the victim has themselves granted.

Only once that trust exists is investing introduced, and it is introduced casually. The contact mentions, as a personal aside rather than a pitch, that they have been doing well trading crypto, often crediting a special platform, an insider method, or a relative who works in finance. They are not selling; they are sharing good fortune with someone they care about. This soft framing is what distinguishes pig butchering from an obvious investment scam. There is no cold pitch to reject.

Stage two: the fake investment platform

When the victim expresses interest, they are guided to a specific platform, a website or an app that the fraudster or their organization controls end to end. It is built to look like a legitimate trading venue: live-looking price charts, an order interface, an account balance, a support chat, and sometimes convincing branding and app-store presence. The victim is walked through funding the account, typically by buying cryptocurrency on a genuine exchange and then transferring it to a deposit address the platform provides.

That transfer is the pivot point. The funds leave the victim’s control and go to the fraud operation. Everything the victim sees afterward on the platform is an interface, not an account. The balances, positions, and prices are numbers the operator can display at will. The victim believes they hold assets on an exchange; in reality they hold a login to a screen.

Stage three: the fabricated-gains dashboard

The platform then shows the deposit growing. Trades appear to succeed, the balance rises quickly, and the dashboard reports returns that a real market would not deliver. Because the trusted contact is investing alongside the victim and showing their own apparent profits, the gains feel corroborated rather than suspicious. The purpose of the fabricated dashboard is behavioural: visible profit is the most effective possible argument for depositing more. The contact encourages exactly that, urging the victim to seize the opportunity, add funds, and scale up while the method is working.

To harden the illusion, operators frequently permit a small early withdrawal. A victim who deposits a modest sum, watches it grow, and successfully withdraws a portion concludes that the platform is real and honours redemptions. That single successful withdrawal is often the decisive proof that persuades the victim to commit far larger sums, sometimes their savings, and in documented cases money they borrow against retirement accounts, home equity, or from family. The early withdrawal is not a lapse by the fraudster; it is bait.

Stage four: the withdrawal-fee trap

The trap closes when the victim tries to withdraw a meaningful amount. Now the platform introduces an obstacle. A message states that before funds can be released, the account owes a tax, a fee, a deposit to meet a minimum balance, an anti-money-laundering verification, or a payment to unlock the account. FinCEN’s alert documents this precisely: victims attempting to withdraw are told they must first pay a purported tax or fee. The demanded payment must, of course, be made in new funds, because the balance shown on the platform is not real and cannot be used.

If the victim pays, a new obstacle appears. The tax is followed by a penalty, then a compliance hold, then a larger fee, each with a fresh justification and often heightened urgency, a deadline after which the account will be frozen. There is no amount that completes the sequence, because the goal is to extract additional payments from a victim who is now emotionally and financially committed and reluctant to accept that everything is lost. Eventually the platform stops responding, or the account is frozen, and the contact who introduced it goes silent or continues to string the victim along.

The tell, stated plainly

Two features, appearing together, identify this fraud regardless of how the story is dressed:

• A new online contact steering you toward a specific crypto platform, especially one framed around guaranteed, unusual, or insider gains, when you did not seek out that platform independently.
• A fee demanded before you can withdraw. No legitimate exchange requires you to send fresh outside funds to release a balance you already hold; trading fees and network fees are deducted from assets you control, never paid as a precondition to unlock your own money.

Either element alone warrants a full stop. Genuine investing does not begin with a friend or romantic interest routing you to a particular platform, and genuine withdrawals are not gated behind a separate up-front payment.

Several softer indicators tend to accompany the two defining ones and can surface the fraud earlier. The contact typically resists meeting in person or on a live video call, producing a steady stream of reasons why it is not possible; the investment is presented with a sense of exclusivity or time pressure, an opportunity that will not last; the platform, however polished, is one you cannot find corroborated through independent, reputable sources; and the returns are consistently positive in a way real markets are not. None of these alone proves fraud, but in combination with a relationship that migrated quickly from a dating or social app to daily private messaging, they describe the standard shape of the con. Recognizing the shape is more reliable than judging any single message, because each individual step is designed to seem reasonable in isolation.

What the structure implies for protection

Because the fraud weaponizes a relationship, the usual advice to only invest through platforms you trust is insufficient, the victim does trust the person, which is the vulnerability. More useful checks follow from the mechanism: be sceptical of any investment introduced by someone you met online and have never met in person; verify a platform’s legitimacy independently rather than through links the contact provides; treat guaranteed or unusually consistent returns as a defining red flag; and recognize the withdrawal fee for what it is, the moment the fraud reveals itself, not an administrative step. If a withdrawal is ever gated behind a payment, do not pay it; that payment cannot recover funds that were taken at the deposit stage. Preserve records, cease contact, and report to the appropriate authority, in the United States the FBI’s Internet Crime Complaint Center and the FTC.

Sources

• FinCEN Alert on Prevalent Virtual Currency Investment Scam (Pig Butchering)
• What is Pig Butchering? (Chainalysis)
• FBI Internet Crime Complaint Center (IC3)
• What to know about cryptocurrency and scams (U.S. FTC)