Pig Butchering Scam Investigation
Forensic documentation for sha zhu pan victims.

Pig butchering (sha zhu pan) is the romance-to-crypto investment scam pattern that drove $4.4 billion+ in US victim losses in 2023. SleuthX produces the forensic case file for IC3 and FBI referral, IRS theft-loss documentation, and civil counsel. We do not recover lost money. We do not take fees that depend on the outcome.

Call (239) 241-8095

You met someone on a dating app, a social platform, or what looked like a wrong-number text.

Over weeks or months they earned your trust.

They were warm, attentive, present in your life.

At some point they introduced you to crypto investing, then to a specific platform that they said had been good to them.

The platform looked professional.

Your first deposit produced a real-looking gain.

So did your second.

Then they encouraged you to scale.

When you finally tried to withdraw, the platform demanded a fee.

Then a tax.

Then one more deposit to unlock the account.

Then it went silent.

Or the person you trusted simply disappeared.

The amount lost typically runs from tens of thousands to several million dollars.

This is pig butchering, and we document it for the police, the IRS and counsel.

Important. We do not recover lost money.

We deliver forensic investigation, evidence preservation, and coordination with law enforcement, civil counsel, and the IRS for theft-loss tax treatment.

Many services that promise to get crypto back for a fee either do nothing or are themselves running a second scam aimed at victims who have already been scammed once.

The FBI and FTC have issued repeated warnings about this.

Our work is the honest version of pig-butchering response: forensic case-file production at hourly rates, no fees that depend on the outcome, and the plain statement that whether funds come back is controlled by law enforcement and licensed counsel, not by us.

Quinnlan Varcoe, Founder and CEO, oversees every pig butchering investigation and reviews every case before findings leave the system.

Alex Riffenburgh, Co-Founder, brings the offensive-security discipline and takes investigations and field operations going forward.

Engagements are confidential and NDA-protected. Start early when the loss is recent, because live platform screenshots, active messaging and in-window bank intervention are perishable evidence.

Done-for-you work comes as a device package. Fixed fee by number of devices. You see your exact price before you sign. Work beyond the packages, including expert-witness work, is priced in writing before it starts.

Call (239) 241-8095

What pig butchering actually is

Pig butchering is called sha zhu pan (shā zhū pán, literally "pig-killing plate") in Mandarin, the language in which most of the operational scripts are written.

The metaphor is industrial: the victim is the pig, the trust-building phase is the fattening, and the rapid escalation of deposits before the platform vanishes is the butchering.

Operations are typically run from organized criminal compounds in Southeast Asia, in Cambodia, Myanmar (especially the Shwe Kokko and KK Park complexes), Laos, and to a lesser extent the Philippines, where the operators on the keyboard are frequently themselves trafficking victims forced to run the scripts under armed guard.

The US Treasury OFAC has sanctioned specific compounds and individuals tied to these operations, and the FBI Cyber Division has stood up dedicated task-force capacity for pig-butchering response.

The structure of a pig-butchering operation

Initial contact. A wrong-number text, a LinkedIn message, a dating-app match, a Facebook friend request, an Instagram DM, a WhatsApp introduction. The contact pretext is engineered to feel coincidental. The persona is typically a successful professional in their thirties to fifties with photos of an attractive lifestyle (travel, restaurants, business success).
Relationship cultivation. Weeks to months of consistent, warm, attentive communication. The persona shows interest in the victim's life, work, family, hopes. The relationship may become romantic; in some variants it remains a close friendship or business mentorship. The persona is never available to meet in person, and typical excuses include international travel, a deployed military rotation, an offshore engineering project, an ongoing business deal in another country.
Investment introduction. The persona casually mentions crypto trading success or family-office investing. The introduction is gradual and framed as the persona helping the victim build wealth, often with the persona offering to teach or guide. A specific platform is named. The platform looks professional, has a working dashboard, and may be backed by what appears to be a custodian or licensing partner.
First deposit and fictitious gain. The victim deposits a small amount. The dashboard shows a real-looking gain. The victim is encouraged to withdraw a portion to confirm the platform works. The withdrawal succeeds. This seeds trust at exactly the moment the victim's skepticism would otherwise kick in.
Escalation. Subsequent deposits scale. The persona provides increasingly compelling reasons to deposit more, such as a time-limited opportunity, a tax-advantaged window, a custodian requirement that the account hit a tier threshold to qualify for the persona's help. Deposits often reach retirement, savings, or home-equity funds.
Withdrawal block and escalating fees. The victim attempts a larger withdrawal. The platform demands a tax, a fee, or a security deposit. The persona reassures the victim that the requirement is normal and offers to front it. The victim pays. The next requirement appears. Eventually the platform stops responding, the persona stops messaging, or both.
The second scam. The victim, now searching for help, finds advertised services that promise to get the money back for a fee. Many of these are themselves pig-butchering operations targeting victims who have already been scammed. The pattern: an upfront fee, frequently in crypto, frequently framed as required to release the funds, followed by either nothing or a second round of social engineering for additional payments. We exist to be the honest alternative to this layer.

What a pig butchering forensic engagement produces

Communication preservation. Forensic capture of the full communication thread with the persona across chat apps (WhatsApp, Telegram, Signal, WeChat), dating-app DMs, social-media DMs, voice notes, video calls, screenshots of the trading platform's dashboard, screenshots of any KYC documents the persona shared, and the exact wording used at each escalation point. The capture is timestamped, hashed, and preserved under chain of custody.
Persona analysis. Reverse-image search and metadata analysis on every photo the persona shared. Identification of the real person whose images were stolen, where it can be found. Linguistic and behavioral analysis on the communication thread to detect script-driven patterns, language transitions consistent with multiple operators handing off, and timing patterns consistent with an Asian operating shift behind a US-aligned persona.
Platform infrastructure records. Domain registration records and historical DNS for the trading platform, hosting infrastructure, payment-rail off-ramps, fake-custodian and fake-license claims documented and cross-referenced against known scam infrastructure. Where the platform is connected to a known operating cluster, the case becomes part of a broader picture that supports law-enforcement task-force attention.
Wallet and transaction documentation. Full record of every deposit, with the wallet address, transaction hash, USD value at the time of transfer, the chat-thread context that drove the deposit, the platform-dashboard screenshot that justified it. Documentation of every later fee payment in the same format.
Wallet records for law enforcement. We document the wallet addresses, transaction hashes and platform screens you have, for IC3 and counsel. Blockchain analytics firms and law enforcement do the on-chain analysis, and the report gives them the starting records.
Wire-fraud overlay where applicable. Many pig-butchering cases include a bank wire layer where funds moved fiat-to-crypto through an intermediary. The wire layer creates a separate evidentiary stream supporting the bank's fraud unit, a SAR against the receiving account, and a wire-fraud predicate for law-enforcement engagement.
Written report. The report records the hash values, the method, the tools and their versions, and the exhibits, structured for FBI IC3 and Cyber Division referral, US Treasury OFAC sanctions reporting where the operation maps to a sanctioned entity, IRS Form 4684 and Schedule A theft-loss documentation, your bank's fraud unit, your state attorney general's consumer-protection unit, your cyber and crime insurance carrier, and civil counsel.

We examine only a device you own. Before we start, you sign a form stating that you own it.

What the engagement does not include

Getting money back. That is the domain of law-enforcement seizure, civil counsel, exchange cooperation, and IRS theft-loss treatment. We provide the forensic evidence package.
Promises about the money. We promise to deliver the forensic case file. Whether money comes back is controlled by the parties with subpoena power and asset-seizure authority.
Fees that depend on the outcome. That structure rewards overpromising, and it is the marker of the second-scam operators described above.
Contact with the scammer. This almost always makes things worse. If the operator believes the victim has gone to the authorities, the platform vanishes, evidence disappears, and any remaining window to act closes.
Legal advice. We are forensic examiners. Where the case requires legal action, we coordinate with civil counsel and you work directly with that attorney on legal strategy.
A single automated wallet trace and a one-line result. Pig-butchering cases need integrated social-engineering and on-chain forensics, not a wallet lookup.

Pig butchering by the numbers (FBI IC3 + Treasury OFAC reporting)

The FBI Internet Crime Complaint Center logged $4.4 billion+ in US victim losses to confidence-investment scams (the IC3 category that includes pig butchering) in 2023.

Crypto investment scams are the largest single fraud-loss category in IC3 reporting, exceeding BEC and ransomware combined for individual-victim totals.

The US Treasury OFAC has sanctioned specific compounds tied to pig-butchering operations and the State Department has named pig-butchering operations as a national-security concern given the human-trafficking layer at the operator level.

Each of those routes starts from a forensic case file: IC3 referral, FBI Cyber Division engagement, state attorney general consumer-protection units, IRS theft-loss treatment, and civil suit.

That is what we produce.

Related SleuthX pages

Crypto scam forensics: investment-scam forensics for cases that do not have a romance-pretext layer (fake brokers, fake DeFi, fake yield, ICO scams).
Romance scam investigation: social-engineering forensics for romance-scam cases that did not include a crypto investment surface.
Wire fraud investigation: bank-wire layer of pig-butchering cases that included a fiat-to-crypto conversion through a mule account or intermediary.
SIM swap attack investigation: where the loss followed a SIM swap that bypassed exchange-account MFA before the pig-butchering escalation.
Elder fraud investigation: when the targeted person is an older adult and pig-butchering forensics needs to be combined with senior-fraud reporting overlay.
Identity theft investigation: when the pig-butchering chain included new-credit-line fraud or synthetic identity downstream.
Digital forensics for attorneys: civil-suit and expert-witness support in pig-butchering litigation.

A confidential, structured engagement.

Confidential Consultation

A direct conversation with Quinn, the founder and CEO who oversees every engagement. NDA-protected. No sales process.

Signed Engagement

The price is fixed by the number of devices. Before any work starts, you sign the agreement and the chain-of-custody form.

Examination and Report

A named examiner works the devices and accounts you sent and writes a report with the hash values, the method, the tools and their versions, and the exhibits.

Frequently asked about pig butchering investigation

What is pig butchering?

Pig butchering, called sha zhu pan in Mandarin (shā zhū pán, literally 'pig-killing plate'), is an industrialized confidence-investment scam pattern that combines romance scam social engineering with fake crypto investment platforms. The 'pig' is the victim, the 'fattening' is the trust-building phase that may run weeks or months, and the 'butchering' is the rapid escalation of crypto deposits before the platform vanishes. The operation is typically run from organized criminal compounds in Southeast Asia (Cambodia, Myanmar, Laos), where the operators on the keyboard are frequently themselves trafficking victims forced to run scripts under armed guard. The FBI IC3 reported $4.4 billion+ in US losses to pig butchering and crypto investment scams in 2023, and the figure has continued to climb in subsequent reporting periods. This is the dominant crypto-scam vector for individual victims.

How is a pig butchering investigation different from other crypto scam services?

Pig butchering is functionally one operation with two surfaces: a romance-scam social-engineering pretext and a crypto-loss event. The forensic methodology has to integrate both. We document the social-engineering timeline (how the persona introduced themselves, the trust-building methodology, the scripted handoff to the trading platform, the language patterns that signal a scripted operation), preserve the full communication thread (chat apps, dating-app DMs, voice notes, screenshots of the fake platform), perform persona and infrastructure analysis on the scammer's identity claims, document wallet addresses and transaction hashes for every deposit and every later fee payment, work with blockchain analytics firms on the on-chain analysis, and structure the case file for IC3, FBI Cyber Division, IRS Form 4684 and Schedule A theft-loss documentation, and civil counsel. Many crypto services skip the social-engineering layer; we document both because pig butchering cases need both.

Can I get the money back?

Sometimes, partially, and only through parties other than us. We do not recover lost money. No private firm has the authority to seize crypto on its own. Money comes back, when it does, through law-enforcement seizure when funds reach a regulated exchange that cooperates with subpoenas, through civil counsel suing a defendant who can be served, or through cooperation from the receiving exchange where the funds came to rest. A theft loss may matter for your taxes. Ask a tax professional. We deliver the forensic case file those parties work from, and we do not take fees that depend on the outcome. Anyone who promises a specific percentage back, or charges fees in crypto upfront, should be treated as a second scam. That is the dominant pattern in advertised crypto services, and the FBI and FTC have issued repeated warnings.

I sent crypto from a US exchange. Does that help?

It can help. When the crypto leaves a KYC-compliant US exchange (Coinbase, Kraken, Gemini, Binance.US, Crypto.com), the exchange has the sender's verified identity on file, the destination wallet, the timing, and the transaction-hash records. That information becomes the seed for downstream tracing, and where the funds eventually land at another KYC-compliant exchange, the receiving exchange has the cash-out party's identity on file as well. The chain of custody from US exchange → criminal-controlled wallet → laundering hops → off-ramp at receiving exchange is the evidentiary spine of the case. If the receiving exchange is a regulated US or EU institution, law-enforcement subpoena power can compel that information; if the receiving exchange is in a non-cooperating jurisdiction, the case file still supports IRS theft-loss treatment and civil suit. Either way, sending from a US exchange leaves a forensic trail. The exchanges most useful to law enforcement are the ones with operating offices in the US, EU, UK, Canada, Australia, Japan, or Singapore.

What if I sent funds across multiple deposits over months?

Pig-butchering operations almost always run this pattern of starting small, showing fictitious gains, and escalating. The forensic methodology documents every deposit individually with the wallet, transaction hash, USD value at the time of transfer, and the social-engineering context that drove that specific deposit (the message that asked for it, the platform-dashboard screenshot showing the fake gain that justified it). The pattern of escalating deposits paired with the fictitious-gains dashboard is itself evidence of criminal intent at the operator's level. The IRS theft-loss documentation captures all of it. Civil suit damages capture all of it. Law-enforcement referral captures all of it.

I was told to wire money to buy crypto for the platform. Does that still count as pig butchering?

Yes, and the case has an additional surface: the bank wire layer. Many pig-butchering operations route funds through bank wires to crypto-conversion intermediaries (sometimes legitimate exchanges, sometimes mule accounts at consumer banks) before the funds reach the criminal-controlled crypto wallet. The bank wire creates a separate evidentiary stream that supports a wire-fraud claim with your bank's fraud unit, a Suspicious Activity Report against the receiving account, and law-enforcement engagement on the wire-fraud predicate even when the crypto-loss layer is harder to act on. We document both the wire-fraud and crypto-fraud chains in the same engagement and structure the case file for both. If the wire went out recently, call your bank's wire-recall desk now, because wire-recall windows are short, and see our wire fraud investigation page.

What about elderly family members? My parent sent the money.

Pig-butchering operations target older adults systematically, frequently through social media platforms and dating apps where the trust-building phase is well-suited to victims with time and isolation. Cases involving elderly victims pair pig-butchering forensics with elder-fraud forensic methodology because the legal protections, reporting routes, and prosecution priorities differ. State Adult Protective Services and elder-fraud-specific FBI initiatives become active referral channels. Power-of-attorney documentation, financial-institution senior-fraud reporting, and state attorney general elder-fraud units are part of the case file. We coordinate the full picture in a single engagement and structure the case file for the additional senior-fraud reporting overlay.

Can the report support a civil suit against the receiving exchange?

Sometimes, depending on the exchange and the facts of the case. Civil claims against receiving exchanges are an active area of plaintiff litigation in 2025-2026, particularly where the exchange (a) failed to act on KYC/AML red flags that were apparent at the time of receipt, (b) processed transactions in patterns inconsistent with the receiving party's stated profile, or (c) ignored documented victim complaints that should have triggered account holds. The forensic case file supports plaintiff counsel evaluating whether the facts support a claim. We do not provide legal advice and do not represent that any specific exchange is liable in any specific case, but we structure the report so that plaintiff counsel reviewing it can make that determination on their own analysis.

What does it cost, and can I pay over time?

A device examination is a fixed price set by the number of devices: one, two to three, or four to five. Each price includes a set number of examiner hours. You can start with one device, and you can ask about paying over time. You see your exact price before you sign.

Where are you, and do I have to send my phone?

We are based in Naples, Florida, and examine devices in Naples and in California. Before any work starts you sign one page: the agreement and the chain-of-custody form. The agreement you sign explains how to hand over or ship your device.

What if the examination finds nothing?

We do not promise a result. You get a written report on completion covering each device and each account you sent, whatever it shows.

Can you show who did it?

An examination can show what happened on a device or account, and when. It often cannot show who was behind it, and we will not tell you it can.

Will police, a court or my lawyer take it seriously?

We cannot promise how police, a court or a lawyer will treat the report. We can tell you what it contains: the hash values, the method, the tools and their versions, and the exhibits.

What happens next, and how long does it take?

You sign the engagement letter, and your card is charged when you sign. Most examinations are finished one to two weeks after you sign, provided your devices reach us promptly. If you need it sooner, ask us to rush it.

Is this a person or an AI?

This line is answered by the SleuthX team, and by the SleuthX assistant, an AI, when the team cannot pick up. A named examiner examines your device and signs the report.

Whose device can you examine?

We examine only a device you own. Before we start, you sign a form stating that you own it. If that statement is false, the evidence can become unusable in court.