Pig Butchering: The $7.2B "Friendly" Crypto Scam You Need to Warn Your Parents About
Bottom line up front · updated October 28, 2026
Pig butchering is still the costliest scam Americans report: $7.2 billion lost to crypto investment fraud in 2025, per the FBI. A federal case unsealed October 27 shows a version that never asks you to send money. A dating-site match pitches an NFT “investment,” you keep the crypto in your own wallet, and one tap on a “spending cap request” lets the scammers take it. If a stranger is coaching you through approving anything in a crypto wallet, stop. If you already signed, revoke it and report it.
The text arrives from a number you don’t recognize. It’s warm, casual, slightly confused: “Hi Michael! Are we still meeting for lunch at the Italian place tomorrow?”
You’re not Michael. You text back: “I think you have the wrong number.”
“Oh! I’m so sorry! My apologies. I hope I didn’t bother you — have a great day!”
If you’re the kind of person who replies politely, maybe you add “no worries!” or “no problem.” And that’s it. A harmless crossed wire in a busy day.
Two days later, the “wrong number” person texts again. “Hi! I wanted to say thank you for being so nice the other day. Most people are so rude when you text a wrong number. I hope you don’t mind me saying hi — by the way, what do you do?”
Congratulations. You’ve just entered the opening sequence of pig butchering, the costliest kind of scam Americans report to the FBI. In 2025, Americans reported losing more to investment fraud than to any other kind of internet crime, and the FBI says cryptocurrency investment fraud alone was “the highest source of financial losses to Americans,” at $7.2 billion. Pig butchering is the best-known playbook in that category, and one of the fraud trends driving the biggest losses in 2026.
What is a pig butchering scam?
Definition
A pig butchering scam is a long-con investment fraud. A stranger builds a warm friendship or romance over weeks — often starting with a “wrong number” text — then steers the victim into a fake crypto or trading platform showing fake profits, and disappears with everything when they try to cash out.
New in 2026: the version where you never send a cent
Most of this guide describes the classic version, where the victim sends crypto to a fake trading platform. That still happens, a lot. A federal case unsealed on October 27, 2026 shows a variant that skips the sending.
The Justice Department’s Scam Center Strike Force charged six Africa-based defendants, with connections to Southeast Asia and China, over fake NFT investment sites. According to the announcement, the scammers “posed as beautiful women who met victims on dating websites,” got them to connect their crypto wallets to the sites, and then “surreptitiously pulled money from the victims’ wallets without their knowledge.” FBI investigators tied about 74 crypto wallets to roughly 800 victims around the country who reported losses after using fraudulent investment platforms.
The affidavit behind the charges is more specific, and the detail matters. “Connect your wallet” sounds like the dangerous step. On its own it mostly isn’t. The theft came from the prompt after it.
How the wallet-approval version works, step by step
- A match on a dating site. A woman’s profile, and soon a move to WhatsApp. One script on the alleged ringleader’s phones called the job “an emotional scam, using the [victim’s] feelings for us to get him to invest.”
- The NFT pitch. She brings up NFT investing and sends a link to a marketplace, which in the affidavit billed itself as “Everyone’s Favorite NFT marketplace.”
- You buy crypto and keep it yourself. Victims bought USDT, a dollar-pegged stablecoin, and held it in their own wallets. Nothing has left your hands, so nothing feels risky.
- “Connect your wallet.” The site prompts you to link it. An FBI agent testing one site in August did exactly that with a fresh MetaMask wallet.
- The spending cap request. Then a second prompt. Per the affidavit, it was “a spending cap request” that, if signed, would let a third party transfer unlimited USDT out of the wallet. Several victims named in the filing signed one.
- The pull. With that approval in place, the scammer’s address can move your USDT whenever it likes, so the job becomes getting you to deposit more. In one case in the filing, a deposit of 9,067.64 USDT was gone about 33 minutes after it landed.
Steps per the FBI affidavit in the D.C. Scam Center Strike Force case, unsealed 27 October 2026. The approval step is documented for several victims; the 33-minute example is a separate victim, and the filing does not say how that wallet was accessed. Amber marks the scammer’s move, red the point of loss, blue where you break it.
What a “spending cap” actually is
A token approval, which MetaMask calls a spending cap, is a permission you sign that lets another address move a set amount of one token out of your wallet. It stays on the blockchain until you revoke it. MetaMask’s help page puts it plainly: “Unlimited spending caps are dangerous.”
Why this matters. Most pig-butchering advice, ours included, says to watch for the moment someone asks you to send money to a platform. In this version that moment never really arrives, and the money sitting in your own wallet is exactly why people feel fine adding more. You didn’t hand over a password; you handed over a permission, and permissions don’t expire on their own.
What “pig butchering” actually means
The name comes from the Chinese phrase sha zhu pan (“killing pig plate”). The metaphor is grim: the scammer is the farmer, the victim is the pig. Before slaughter, you fatten the pig up. In scam terms, that means building trust and emotional connection over weeks or months, getting the victim to make small successful “investments” that appear to pay out, before eventually — the slaughter — getting them to put in everything they have and watching them discover they can never get a cent back.
The scam originated in China around 2017 and exploded globally after 2021, when the pandemic made remote social interaction normal and crypto made irreversible transfers trivial. Most pig-butchering operations are run out of industrial-scale scam compounds in Cambodia, Myanmar, and Laos — many of which use trafficked labor, and some of which, as a case unsealed in October 2026 shows, have moved as far as Madagascar. The U.S. Secret Service has a dedicated task force and the FBI treats it as a top-priority transnational crime.
Got a “wrong number” text from a stranger?
That warm, chatty message meant for someone else is how pig butchering opens. Paste it into our free SMS Scam Checker to see the patterns behind it — before a weeks-long con ever gets going.
Check a suspicious text →The exact playbook, step by step
Step 1: First contact (weeks 1–2)
The scammer reaches out via one of:
- A “wrong number” text (most common)
- A message on a dating app — Hinge, Bumble, Tinder, Christian dating sites, and especially niche apps for older singles
- A LinkedIn connection request — usually from an attractive-looking young professional claiming to work in finance
- A friendly DM on Facebook, Instagram, or WhatsApp
- A cold add on Words With Friends, Candy Crush, or other social games — particularly common for older victims
The goal at this stage is to move the conversation to a platform the scammer controls — usually WhatsApp, Telegram, Line, or Signal. Dating-app scammers will escalate from “let’s move to text” within a day or two. Wrong-number scammers are patient; they’ll chat on iMessage for weeks first.
Step 2: Relationship building (weeks 2–8)
The scammer — who is real, by the way, though not who they claim to be — plays a careful role. Common personas:
- An attractive 30-something woman, recently divorced, lives in Singapore or Hong Kong, works in “international finance.”
- A successful tech entrepreneur, travels a lot, “knows some things most people don’t.”
- A lonely widow/widower, warm and religious, sends good-morning texts every day.
The conversation is deliberately non-financial. The scammer asks about your day, your kids, your job. Sends photos of their (stolen) life: their dog, their gym, a view from their (stock) balcony. If you are a man being targeted on a dating app, there may be flirtation. If you are an older woman being targeted on Words With Friends, there may be daily devotional messages. The scammer matches to you.
This phase lasts weeks. In some cases, months. The scammer is never the one to bring up money. They wait for you to ask about their life — and then casually mention, oh, by the way, they’ve been doing well with crypto trading. Their uncle works at a Hong Kong-based exchange. They have early access to a platform that uses AI to detect crypto arbitrage opportunities. It’s not public, it’s very exclusive, but they could help you try it if you wanted.
Step 3: The small test investment (week 6–10)
You put in $500, maybe $1,000, on a legit-looking trading platform with a name like “GlobalFX-Pro” or “BitTrade Exchange.” The platform is entirely fake — it’s a website the scammers control, with numbers they fabricate — but it looks professional. It has charts, a dashboard, a mobile app. It looks exactly like real trading platforms because it was copied from one.
Your $1,000 “grows” to $1,400 in a week. The scammer congratulates you. You withdraw $200, just to test. The $200 comes to your bank account. The platform is legitimate. The scammer’s method works.
This withdrawal is the entire con. It is the single moment that makes every subsequent step feel safe. You have now proven to yourself that you can get money out.
Step 4: The scale-up (weeks 10–20)
You put in more. $10,000. $50,000. The scammer introduces you to their “mentor” or “uncle”, who can give you access to even better opportunities. You start putting in retirement money. Home equity. Money borrowed from family (“just for a month, I’m about to make a huge return”). The platform keeps showing you fabulous returns — 20%, 30%, 40% per month.
You try to withdraw again. This time, there’s a problem. There’s a “withdrawal tax” you didn’t know about. Or a “minimum trading requirement” before you can cash out. You need to deposit more to unlock the withdrawal.
Step 5: The slaughter
Real case from 2025: a Central Georgia man met a woman calling herself “Hnin Phyu” on Facebook in June. By November, he had transferred $164,000 to the scammers, including $32,000 in Bitcoin alone in a single month trying to pay the “taxes” needed to release his funds. The FBI was able to recover about $24,000. The rest is gone — sent to wallets in Myanmar.
This is not a one-off. The FBI’s warning on these schemes put individual losses anywhere from tens of thousands to millions of dollars.
Where the scam compounds went
Southeast Asia is still the center of this, but the October case shows compounds moving. Prosecutors say a group with ties to Malaysia and China opened compounds in Madagascar in early 2025, “likely having moved those operations from Cambodia after law enforcement action in that country.” In August 2026 an FBI team helped Madagascar’s police take down 13 compounds and seize more than 3,200 devices.
The court papers read like a call center with the worst HR policy imaginable: overnight shifts timed to American evenings, bonuses tied to money taken, a roster column headed “Discipline Fine.” Some workers told investigators they had been trafficked; the FBI says it hasn’t been able to substantiate that, and The Record reported investigators struggled to separate trafficking victims from paid staff.
For scale: the Strike Force, launched in November 2025, says it has restrained $1,006,460,156.82 in crypto tied to these schemes and seized 700 fake investment websites. Restrained means frozen, which isn’t the same as money back in victims’ accounts. The FBI’s 2025 Internet Crime Report counts about $7.7 billion in losses reported by people over 60, and the Justice Department says real totals are likely “significantly” higher. If you’re reading this for a parent, our page on the calls and messages that cost older adults the most has a printable sheet worth leaving by their phone.
The warning signs, in order of importance
1. An unsolicited text, DM, or connection from someone you don’t know
This is the single clearest signal. Friends don’t appear from nowhere. If someone you’ve never met starts a conversation with a compliment, a wrong-number pretense, or a flirty message, the probability they are a pig-butchering scammer is high. Not 100%, but high.
2. Movement to a messaging app
“Let’s move to WhatsApp / Telegram / Signal” is the pivot move. Every pig-butchering conversation eventually happens on a platform that’s hard to surveil and impossible to screenshot-report. If a stranger is pushing you off the platform where you met, pay attention.
3. They refuse to video call
A real person has a real face. A pig-butchering scammer almost never agrees to a live video call — and if they do, it’s a brief, grainy, AI-generated or deepfaked call that they’ll end with an excuse. If someone you’ve been texting for weeks refuses repeated requests for a video call, or cancels at the last minute every time, that is an extremely reliable signal. A 30-second FaceTime is a scammer’s kryptonite.
4. They introduce you to an “opportunity”
Any unsolicited financial opportunity from a new online contact is a scam. There are no exceptions. No uncle at a Hong Kong exchange. No tip on a platform with AI arbitrage. No special early access for “people they trust.” The shape of the pitch is the scam, independent of the specifics.
5. The platform has a weird name and no bank affiliations
Real investment platforms in the U.S. are regulated. They have SEC registrations, FINRA membership, and FDIC/SIPC-insured banking relationships. Scam platforms do not. If the platform’s name is something you’ve never heard of, if it’s registered offshore, if it doesn’t accept normal bank transfers, if you have to deposit via cryptocurrency — it’s fake.
6. The returns are too good
Professional hedge funds, run by Harvard PhDs with supercomputers, produce 10–15% annual returns in good years. If your new online friend is telling you they’re making 30% per month, someone is lying.
7. You can’t withdraw without depositing more
This is the tell at the end. Real exchanges don’t require you to deposit more to withdraw what you’ve already earned. If you’re being told about an unexpected “tax” or “minimum trading balance” or “verification fee,” the scam is on its final act. Stop immediately. Do not send another dollar. Every additional dollar will be “needed” because of a new made-up fee.
8. Someone walks you through connecting or approving something in your wallet
Real investments don’t need a stranger on WhatsApp coaching you through wallet pop-ups. If a link from an online contact asks you to “connect your wallet” and then approve a spending cap, reject it. A cap that says unlimited is the site asking for the keys.
If you’re in a relationship with a scammer right now and aren’t sure
Ask for a live, unplanned video call in the next hour. Do not give advance notice. If they refuse, defer, or come up with a reason it can’t happen, trust that signal. Do not send another cent until the call happens. If money has already moved: call the bank fraud line immediately, report to ic3.gov, and call the AARP Fraud Watch Helpline (1-877-908-3360). Do not engage with anyone offering “recovery services” — those are themselves scams targeting recent victims.
If you already connected a wallet or signed an approval
Move quickly, roughly in this order. None of it guarantees you’ll get anything back, and anyone who promises that is selling something.
- Stop depositing. Not another dollar, whatever you’re told about fees or a “locked” balance.
- Revoke the approval. In MetaMask, open Portfolio and look under the Spending Caps tab, then revoke anything you don’t recognize. Etherscan’s token approval checker does the same job for any Ethereum address. Revoking is itself a transaction, so MetaMask notes you’ll pay a network fee; keep a little ETH in the wallet for it.
- Move what’s left to a fresh wallet. If you’re unsure what else you signed, a new wallet with a new recovery phrase is the clean option. Never type a recovery phrase into a website.
- Write it all down. Your wallet address, the addresses your money went to, transaction IDs, the site, the profile, the WhatsApp number, screenshots. The FBI asks for receiving cryptocurrency addresses in reports.
- Report it. File at ic3.gov, which is what the Strike Force tells victims of these schemes to do, and tell the exchange where you bought the crypto. If the money came out of a bank account, call the bank’s fraud line too.
- Expect a second approach. People who lose money this way get targeted again by fake recovery firms and, lately, by people pretending to be the FBI. Recovery scams are common enough that we wrote a separate guide, and the bureau has warned about scammers posing as IC3 itself. Real law enforcement doesn’t charge a fee to return money.
Our first-hour checklist puts the bank calls and account lockdowns in order. If the scammer switches to asking for cash handed to a courier, that’s the courier version, a known follow-on.
How to talk to a family member who’s being pig-butchered
If you think it’s happening to someone you love, the hardest part is that they don’t feel scammed. They feel like they’re in a relationship, or like they’ve found a remarkable opportunity, or both. Telling them “you’re being scammed” will often backfire — they’ll defend the scammer, cut off contact with you, and go deeper.
What tends to work better:
- Curiosity, not accusation. “Tell me about this person you’ve been talking to. What do they do? How did you meet?” Keep asking questions. The inconsistencies will often emerge on their own.
- Ask specific questions. “When’s the last time you were on a video call with them?” “What’s their full name and city?” “Have you ever met anyone else in their life?”
- Share stories, not lectures. Send them The Tinder Swindler, the Netflix documentary. Share the Central Georgia man’s story. Let the story do the arguing.
- Suggest a low-cost test. “Can you try to withdraw $2,000 tonight, just as a test?” When the withdrawal fails or comes with a surprise tax, reality often breaks through.
- Loop in their bank. Many banks now have fraud-prevention staff trained specifically on pig butchering. A banker who says “this looks exactly like a scam pattern we’re seeing” can land harder than a family member saying it.
For a deeper dive on family-member romance scam intervention, see our guide on how to help someone who thinks they’re in love.
Teach the “wrong number” reflex before the text arrives.
ScamDrill includes pig-butchering opener simulations — safe versions of the exact “wrong number,” “LinkedIn connect,” and “friendly DM” openers that start real scams — so your family learns the pattern before it happens for real.
Start protecting your family →The one rule that stops pig butchering
We can boil this entire article down to one sentence, and we’d like you to send it to your parents, your kids, and your most-online relative:
“Do not invest money based on a relationship that started online with a stranger. Not $500. Not $50. Not ever. If someone you met on the internet tells you about a trading platform, an investment opportunity, or a way to make money together — it is a scam.”
That one rule — held absolutely, without exception — would prevent essentially every pig-butchering loss in America. It’s not about being smart. It’s not about being good at spotting scammers. It’s about having one bright line you will not cross, regardless of how convincing, emotional, or loving the person on the other end of the conversation seems.
For additional context, see how to protect elderly parents from scams and romance scam red flags. Veterans are a disproportionately targeted group for the romance-to-investment pipeline because of public service records and predictable VA-pension deposits — see our guide to scams targeting military veterans for the affiliation-hook variants.