Pig Butchering Scam Investigation
Forensic documentation for sha zhu pan victims.

Pig butchering (sha zhu pan) is the romance-to-crypto investment scam pattern that drove $4.4 billion+ in US victim losses in 2023. SleuthX produces the forensic case file that supports IC3 and FBI referral, IRS theft-loss documentation, civil counsel, and licensed asset-recovery partner introduction. We do not recover funds directly and we do not take fees contingent on recovery.

Try SleuthX now Schedule confidential call

You met someone on a dating app, a social platform, or what looked like a wrong-number text.

Over weeks or months they earned your trust.

They were warm, attentive, present in your life.

At some point they introduced you to crypto investing, then to a specific platform that they said had been good to them.

The platform looked professional.

Your first deposit produced a real-looking gain.

So did your second.

Then they encouraged you to scale.

When you finally tried to withdraw, the platform demanded a fee.

Then a tax.

Then a recovery deposit.

Then it went silent.

Or the person you trusted simply disappeared.

The amount lost typically runs from tens of thousands to several million dollars.

This is pig butchering, and we exist to produce the evidentiary record that makes the recovery and prosecution pathways tractable.

Important. We do not recover funds directly.

We deliver forensic investigation, evidence preservation, and coordination with the parties who can pursue recovery: law enforcement, civil counsel, licensed asset-recovery partners, and the IRS for theft-loss tax treatment.

The crypto-recovery industry is full of operators who promise recovery and either do nothing or are themselves running a second-round scam targeting victims who have already been scammed once.

The FBI and FTC have issued repeated warnings about this.

Our work is the honest version of pig-butchering response: forensic case-file production at hourly rates, no fees contingent on recovery, and the explicit acknowledgement that fund recovery is controlled by law enforcement and licensed counsel, not by us.

Quinnlan Varcoe, Founder and CEO, oversees every pig butchering investigation and reviews every case before findings leave the system.

Alex Riffenburgh, Co-Founder, brings the offensive-security discipline and takes investigations and field operations going forward.

Engagements are confidential, NDA-protected, and structured to begin within 48 hours of the consultation, or same-day when the loss is recent and perishable evidence (live platform screenshots, active messaging, in-window bank intervention) needs to be preserved.

Pricing is hourly at $400 per hour, the same standardized rate every SleuthX engagement bills at, including expert witness. The alternative is a done-for-you device package from $3,000, each including the $995 lifetime license.

Sliding-scale pricing is on the table on the first call for victims who lost retirement, savings, or home-equity funds.

What pig butchering actually is

Pig butchering is called sha zhu pan (shā zhū pán, literally "pig-killing plate") in Mandarin, the language in which most of the operational scripts are written.

The metaphor is industrial: the victim is the pig, the trust-building phase is the fattening, and the rapid escalation of deposits before the platform vanishes is the butchering.

Operations are typically run from organized criminal compounds in Southeast Asia, in Cambodia, Myanmar (especially the Shwe Kokko and KK Park complexes), Laos, and to a lesser extent the Philippines, where the operators on the keyboard are frequently themselves trafficking victims forced to run the scripts under armed guard.

The criminal organization above the operators is what attribution work targets.

The US Treasury OFAC has sanctioned specific compounds and individuals tied to these operations, and the FBI Cyber Division has stood up dedicated task-force capacity for pig-butchering response.

The structure of a pig-butchering operation

Initial contact. A wrong-number text, a LinkedIn message, a dating-app match, a Facebook friend request, an Instagram DM, a WhatsApp introduction. The contact pretext is engineered to feel coincidental. The persona is typically a successful professional in their thirties to fifties with photos of an attractive lifestyle (travel, restaurants, business success).
Relationship cultivation. Weeks to months of consistent, warm, attentive communication. The persona shows interest in the victim's life, work, family, hopes. The relationship may become romantic; in some variants it remains a close friendship or business mentorship. The persona is never available to meet in person, and typical excuses include international travel, a deployed military rotation, an offshore engineering project, an ongoing business deal in another country.
Investment introduction. The persona casually mentions crypto trading success or family-office investing. The introduction is gradual and framed as the persona helping the victim build wealth, often with the persona offering to teach or guide. A specific platform is named. The platform looks professional, has a working dashboard, and may be backed by what appears to be a custodian or licensing partner.
First deposit and fictitious gain. The victim deposits a small amount. The dashboard shows a real-looking gain. The victim is encouraged to withdraw a portion to confirm the platform works. The withdrawal succeeds. This seeds trust at exactly the moment the victim's skepticism would otherwise kick in.
Escalation. Subsequent deposits scale. The persona provides increasingly compelling reasons to deposit more, such as a time-limited opportunity, a tax-advantaged window, a custodian requirement that the account hit a tier threshold to qualify for the persona's help. Deposits often reach retirement, savings, or home-equity funds.
Withdrawal block and escalating fees. The victim attempts a larger withdrawal. The platform demands a tax, a fee, or a security deposit. The persona reassures the victim that the requirement is normal and offers to front it. The victim pays. The next requirement appears. Eventually the platform stops responding, the persona stops messaging, or both.
Second-round recovery scam. The victim, now searching for help, finds advertised crypto-recovery services. Many of these are themselves pig-butchering operations targeting victims who have already been scammed. The pattern: an upfront fee, frequently in crypto, frequently with the framing that the fee is required to start the recovery process, followed by either nothing or a second round of social engineering for additional payments. We exist to be the honest alternative to this layer.

What a pig butchering forensic engagement produces

Communication preservation. Forensic capture of the full communication thread with the persona across chat apps (WhatsApp, Telegram, Signal, WeChat), dating-app DMs, social-media DMs, voice notes, video calls, screenshots of the trading platform's dashboard, screenshots of any KYC documents the persona shared, and the exact wording used at each escalation point. The capture is timestamped, hashed, and preserved under chain of custody.
Persona analysis. Reverse-image search and metadata analysis on every photo the persona shared. Identification of the real person whose images were stolen, where attribution is possible. Linguistic and behavioral analysis on the communication thread to detect script-driven patterns, language transitions consistent with multiple operators handing off, and timing patterns consistent with an Asian operating shift behind a US-aligned persona.
Platform infrastructure attribution. Domain registration records and historical DNS for the trading platform, hosting infrastructure, payment-rail off-ramps, fake-custodian and fake-license claims documented and cross-referenced against known scam infrastructure. Where the platform is connected to a known operating cluster, the case becomes part of a broader picture that supports law-enforcement task-force attention.
Wallet and transaction documentation. Full record of every deposit, with the wallet address, transaction hash, USD value at the time of transfer, the chat-thread context that drove the deposit, the platform-dashboard screenshot that justified it. Documentation of every subsequent fee or recovery payment in the same format.
On-chain tracing coordination. Coordination with specialist blockchain-tracing firms (Chainalysis, TRM Labs, Crystal Blockchain partners) for the on-chain analytical work that follows funds from the victim's wallet through laundering hops to the off-ramp. Tracing alone is not the case file; tracing combined with the social-engineering forensics is.
Off-ramp identification. Where the funds came to rest. If a US, EU, UK, or other cooperating-jurisdiction exchange, the receiving exchange has KYC on the cash-out party and law-enforcement subpoena power becomes available. If a non-cooperating jurisdiction or a privacy-coin chain, the case file still supports IRS theft-loss treatment and civil suit but the recovery calculus changes.
Wire-fraud overlay where applicable. Many pig-butchering cases include a bank wire layer where funds moved fiat-to-crypto through an intermediary. The wire layer creates a separate evidentiary stream supporting the bank's fraud unit, a SAR against the receiving account, and a wire-fraud predicate for law-enforcement engagement.
Written report. Court-admissible methodology, structured for the specific recovery and prosecution pathways that apply to your case: FBI IC3 and Cyber Division referral, US Treasury OFAC sanctions reporting where the operation maps to a sanctioned entity, IRS Form 4684 and Schedule A theft-loss documentation, your bank's fraud unit, your state attorney general's consumer-protection unit, your cyber and crime insurance carrier, civil counsel pursuing recoverable defendants, and licensed asset-recovery partner introduction.

What the engagement does not include

Direct fund recovery. Asset recovery is the domain of law-enforcement seizure, civil counsel, exchange cooperation, and IRS theft-loss treatment. We coordinate the introduction and provide the forensic evidence package.
Promises of recovery. We promise to deliver the forensic case file. The case file makes recovery materially harder for institutions to dismiss; recovery itself is controlled by the parties with subpoena power and asset-seizure authority.
Fees contingent on recovery. That structure aligns the operator with overpromising rather than with delivering what the case actually warrants, and is the structural marker of the recovery-scam ecosystem we exist to be the alternative to.
Contact with the scammer. This almost always makes things worse. If the operator believes the victim has gone to investigators, the platform vanishes, evidence disappears, and any remaining recovery window closes.
Legal advice. We are forensic investigators. Where the case requires legal action, we coordinate with civil counsel and you work directly with that attorney on legal strategy.
A single automated wallet trace and a one-line result. Pig-butchering cases need integrated social-engineering and on-chain forensics, not a wallet lookup.

Pig butchering by the numbers (FBI IC3 + Treasury OFAC reporting)

The FBI Internet Crime Complaint Center logged $4.4 billion+ in US victim losses to confidence-investment scams (the IC3 category that includes pig butchering) in 2023.

Crypto investment scams are the largest single fraud-loss category in IC3 reporting, exceeding BEC and ransomware combined for individual-victim totals.

Average loss per reporting victim sits in the $150,000 to $300,000 range, but the distribution is heavy-tailed with substantial cases in the multi-million dollar range.

The US Treasury OFAC has sanctioned specific compounds tied to pig-butchering operations and the State Department has named pig-butchering operations as a national-security concern given the human-trafficking layer at the operator level.

The whole recovery infrastructure requires a forensic case file as the entry point. That means IC3 referral, FBI Cyber Division engagement, state attorney general consumer-protection units, IRS theft-loss treatment, civil suit against recoverable defendants, and licensed asset-recovery partners.

That is what we produce.

Related SleuthX pages

Crypto scam recovery: investment-scam forensics for cases that do not have a romance-pretext layer (fake brokers, fake DeFi, fake yield, ICO scams).
Romance scam investigation: social-engineering forensics for romance-scam cases that did not include a crypto investment surface.
Wire fraud recovery: bank-wire layer of pig-butchering cases that included a fiat-to-crypto conversion through a mule account or intermediary.
SIM swap attack recovery: where the loss followed a SIM swap that bypassed exchange-account MFA before the pig-butchering escalation.
Elder fraud investigation: when the targeted person is an older adult and pig-butchering forensics needs to be combined with senior-fraud reporting overlay.
Identity theft investigation: when the pig-butchering chain included new-credit-line fraud or synthetic identity downstream.
Digital forensics for attorneys: civil-suit and expert-witness support in pig-butchering litigation.

A confidential, structured engagement.

Confidential Consultation

A direct conversation with Quinn, the founder and CEO who oversees every engagement. NDA-protected. No sales process.

Scoped Engagement

A clear written proposal with defined deliverables, timeline, and pricing. No hidden costs.

Investigation and Findings

Forensic work conducted to court-admissible standards, with regular communication and a written summary you can act on.

Quinnlan Varcoe

Founder & CEO

GIAC-certified · 9 industry certifications

With operational experience across Fortune 50 security programs and the defense industrial base, Quinnlan founded SleuthX in 2022 to provide clients with the caliber of expertise typically reserved for the largest enterprises. Her work in threat intelligence and digital forensics has earned the trust of 26,000+ cybersecurity professionals who follow her analysis.

“26,000 professionals follow my work because I say what others won't — and I can back it up technically.”

Fortune 50 BackgroundDefense IndustryThreat IntelligenceDigital PrivacyIncident Response

Frequently asked about pig butchering investigation

What is pig butchering?

Pig butchering, called sha zhu pan in Mandarin (shā zhū pán, literally 'pig-killing plate'), is an industrialized confidence-investment scam pattern that combines romance scam social engineering with fake crypto investment platforms. The 'pig' is the victim, the 'fattening' is the trust-building phase that may run weeks or months, and the 'butchering' is the rapid escalation of crypto deposits before the platform vanishes. The operation is typically run from organized criminal compounds in Southeast Asia (Cambodia, Myanmar, Laos), where the operators on the keyboard are frequently themselves trafficking victims forced to run scripts under armed guard. The FBI IC3 reported $4.4 billion+ in US losses to pig butchering and crypto investment scams in 2023, and the figure has continued to climb in subsequent reporting periods. This is the dominant crypto-scam vector for individual victims.

How is pig butchering investigation different from generic crypto scam recovery?

Pig butchering is functionally one operation with two surfaces: a romance-scam social-engineering pretext and a crypto-loss event. The forensic methodology has to integrate both. We document the social-engineering timeline (how the persona introduced themselves, the trust-building methodology, the scripted handoff to the trading platform, the language patterns that signal a scripted operation), preserve the full communication thread (chat apps, dating-app DMs, voice notes, screenshots of the fake platform), perform persona and infrastructure analysis on the scammer's identity claims, document wallet addresses and transaction hashes for every deposit and any subsequent fee or recovery payment, coordinate with specialist blockchain-tracing partners for the on-chain analytical work, identify the off-ramp jurisdictions and exchanges where funds came to rest, and structure the case file for IC3, FBI Cyber Division, IRS Form 4684 and Schedule A theft-loss documentation, civil counsel pursuing recoverable defendants, and licensed asset-recovery partner introduction. Generic crypto-recovery firms skip the social-engineering layer; we run both because pig butchering cases need both.

Can the funds actually be recovered?

Sometimes, partially, and through pathways that are controlled by parties other than us. The first thing to know about pig-butchering recovery is that no private firm has the authority to recover crypto on its own. Recovery happens through (a) law-enforcement seizure when funds are traced to a regulated exchange that cooperates with subpoenas, (b) civil counsel pursuing recoverable defendants where attribution is strong enough to support service of process, (c) cooperation from the receiving exchange where funds came to rest if the case is escalated through the right channels, and (d) IRS Form 4684 / Schedule A theft-loss treatment that can recover a meaningful portion of the loss through tax outcomes when other pathways do not produce results. We deliver the forensic case file that makes those pathways tractable. We do not promise recovery and we do not take fees contingent on recovery. Anyone in the crypto-recovery industry who promises specific recovery percentages or charges fees in crypto upfront should be treated as a second-round scam. That is the dominant pattern in advertised crypto-recovery services and the FBI and FTC have issued repeated warnings.

How much does a pig butchering investigation cost?

You have two ways to work with us. Run the investigation yourself in the SleuthX tool for $995 once. That is lifetime access, with usage metered from a prepaid balance you top up anytime. Or have our team do it for you in a done-for-you device package: $3,000 for one device, $7,000 for three, $12,000 for five, each including the $995 lifetime license. Where the case expands beyond a package (multi-month grooming, multiple personas across multiple platforms, layered crypto and wire transfers, parallel romance-scam and investment-scam streams that need integrated forensics), it is scoped per case at a flat $400/hour, with no multipliers. Sliding-scale pricing is available on the first call for victims who lost retirement, savings, or home-equity funds.

I sent crypto from a US exchange. Does that help?

Materially, yes. When the crypto leaves a KYC-compliant US exchange (Coinbase, Kraken, Gemini, Binance.US, Crypto.com), the exchange has the sender's verified identity on file, the destination wallet, the timing, and the transaction-hash records. That information becomes the seed for downstream tracing, and where the funds eventually land at another KYC-compliant exchange, the receiving exchange has the cash-out party's identity on file as well. The chain of custody from US exchange → criminal-controlled wallet → laundering hops → off-ramp at receiving exchange is the evidentiary spine of the case. If the receiving exchange is a regulated US or EU institution, law-enforcement subpoena power can compel that information; if the receiving exchange is in a non-cooperating jurisdiction, the case file still supports IRS theft-loss treatment and civil suit. Either way, sending from a US exchange leaves a forensic trail. The exchanges most useful to law enforcement are the ones with operating offices in the US, EU, UK, Canada, Australia, Japan, or Singapore.

What if I sent funds across multiple deposits over months?

Pig-butchering operations almost always run this pattern of starting small, showing fictitious gains, and escalating. The forensic methodology documents every deposit individually with the wallet, transaction hash, USD value at the time of transfer, and the social-engineering context that drove that specific deposit (the message that asked for it, the platform-dashboard screenshot showing the fake gain that justified it). Multiple deposits over time make the case stronger, not weaker, because the pattern of escalating deposits paired with the fictitious-gains dashboard is itself evidence of criminal intent at the operator's level. The IRS theft-loss documentation captures all of it. Civil suit damages capture all of it. Law-enforcement referral captures all of it.

I was told to wire money to buy crypto for the platform. Does that still count as pig butchering?

Yes, and the case has an additional surface: the bank wire layer. Many pig-butchering operations route funds through bank wires to crypto-conversion intermediaries (sometimes legitimate exchanges, sometimes mule accounts at consumer banks) before the funds reach the criminal-controlled crypto wallet. The bank wire creates a separate evidentiary stream that supports a wire-fraud claim with your bank's fraud unit, a Suspicious Activity Report against the receiving account, and law-enforcement engagement on the wire-fraud predicate even when the crypto-loss layer is harder to act on. We document both the wire-fraud and crypto-fraud chains in the same engagement and structure the case file for both pathways. If the wire was sent within the past 24 to 72 hours, our wire-fraud recovery work is also relevant and should be coordinated immediately because wire-recall windows are short.

What about elderly family members? My parent sent the money.

Pig-butchering operations target older adults systematically, frequently through social media platforms and dating apps where the trust-building phase is well-suited to victims with time and isolation. Cases involving elderly victims pair pig-butchering forensics with elder-fraud forensic methodology because the legal protections, recovery pathways, and prosecution priorities differ. State Adult Protective Services and elder-fraud-specific FBI initiatives become active referral channels. Power-of-attorney documentation, financial-institution senior-fraud reporting, and state attorney general elder-fraud units are part of the recovery package. We coordinate the full picture in a single engagement and structure the case file for the additional senior-fraud reporting overlay.

Can the report support a civil suit against the receiving exchange?

Sometimes, depending on the exchange and the facts of the case. Civil claims against receiving exchanges are an active area of plaintiff litigation in 2025-2026, particularly where the exchange (a) failed to act on KYC/AML red flags that were apparent at the time of receipt, (b) processed transactions in patterns inconsistent with the receiving party's stated profile, or (c) ignored documented victim complaints that should have triggered account holds. The forensic case file supports plaintiff counsel evaluating whether the facts support a claim. We do not provide legal advice and do not represent that any specific exchange is liable in any specific case, but we structure the report so that plaintiff counsel reviewing it can make that determination on their own analysis.

How fast does the investigation start?

Within 48 hours of the consultation for standard cases. If the loss is recent (within the past 72 hours), if the platform is still accessible (the dashboard still loads, the operator is still messaging), or if a wire is still inside the recall window, the engagement is structured to begin same-day so that perishable evidence can be preserved before it disappears, including live platform screenshots, active messaging, and in-window bank intervention. Same-day work bills at the same flat $400/hour rate, with no surge or after-hours multipliers. Otherwise the standard 48-hour structure applies.

Schedule a confidential consultation

A direct conversation with Quinn, the founder and CEO who oversees every engagement. NDA-protected. No sales process. Most engagements begin within 48 hours.

Free, confidential · NDA-protected · no obligation.