Pig Butchering / Hybrid Investment Fraud

What the term describes.

Pig butchering, also called Sha Zhu Pan, is used here for hybrid investment fraud: a personal connection is cultivated as a route to someone’s money. The apparent investment feels like a shared project rather than a direct request for funds. Financial grooming describes the trust-building; pig butchering combines it with a staged investment and sustained financial exploitation. The offender-derived term is dehumanising. We include it for recognition while referring to affected people respectfully.

1 / Contact and connection

The approach may be a supposed wrong-number message, dating match, professional contact or friendly conversation. Early exchanges focus on everyday life, shared interests and future plans. Personal information can help the offender tailor a persona. Cases need not follow this sequence; it is an editorial model, not a fixed offender profile.

2 / A relationship becomes an investment pitch

The contact describes personal success, a helpful relative or special market knowledge. They recommend an app or platform and coach account setup and purchases. Funds often pass through a genuine cryptocurrency service before moving to an external address. The legitimacy of the first service does not establish the legitimacy of the ultimate recipient. Supposed forex or other investments may also feature.

3 / Apparent success lowers caution

Displayed profits, supposedly successful fellow investors and an early small withdrawal can reinforce trust. A displayed balance does not establish that assets exist or are available to withdraw. Video calls can also build confidence. The verifiable contracting entity, payment route and independent checks remain crucial.

4 / Escalation and blocked withdrawals

Additional payments are framed as an opportunity, a way to offset losses or a condition of withdrawal. Some affected people use savings, sell assets or borrow. Withdrawal attempts trigger supposed taxes, security deposits or release charges. This is a critical warning: do not pay simply to rescue money already committed. A fee is not inherently fraudulent, but its basis, recipient and payment route require independent verification.

5 / Disappearance and renewed targeting

The contact or platform may disappear, followed by approaches from supposed investigators, lawyers or recovery specialists. A new friendly contact may also steer the person towards another investment. Similarities alone do not prove shared perpetrators. Recovery fraud can compound the original loss.

Psychology without victim blaming

Closeness, reciprocity, social proof and hope can gradually displace independent checking. Money already committed creates pressure to make one last payment. These are conditions of manipulation, not evidence of low intelligence. Responsibility for deception lies with offenders. Supporters should offer calm help, preserve records and enable independent review rather than shame the affected person.

CyberForensics: what can be investigated

Domain history, identity claims, technical artefacts and recorded transactions can support an investigation. A wallet connection does not automatically identify a person; on-chain data alone cannot establish recoverability. Do not connect a wallet to unfamiliar sites for supposed tests. A detailed mandated investigation may involve suitable specialists.

Fake liquidity pools

A genuine wallet app can still be used to access a fraudulent liquidity pool. In the Sophos case, no malware installation was needed: social engineering led the person to authorise access to funds. An unknown smart-contract approval can therefore be dangerous even without sharing a seed phrase. Use the Wallet & Transaction Check before granting permissions.

Wallet & Transaction Check →

Another victim perspective

The study, FinCEN and OHCHR describe links with organised crime and trafficking into scam compounds. People sending messages may themselves be forced to commit crimes. This does not justify assumptions about a particular contact’s nationality, location or individual responsibility.

What the study establishes — and what it does not

Marie-Helen Maras and Emily R. Ives examine 59 cases involving US targets in their 2024 paper. They analysed more than 1,300 news articles and court documents from 1 January 2018 to 1 November 2023. This is exploratory document-based case selection, not a representative population study. News coverage, database access and incomplete information limit the findings. It reveals documented mechanisms, not a general fraud probability, a validated personal risk profile or a current worldwide case count. A lawsuit or seizure order is not a conviction.

Already paid or shared access?

Pause further payments, contact your bank or payment service through official channels promptly and preserve chats, URLs and transaction records. Secure compromised access through a safe channel. Do not follow a supposed recovery agent’s instructions to make more payments. Do not expose seed phrases or credentials in public reports.

Evidence Timeline → Recovery Scam Check → Wallet & Transaction Check → Complaint Route Finder → Professional services → Financial Grooming →

Sources and evidence

The 2024 academic paper is the main document source; FinCEN provides an official warning, OHCHR adds human-rights context and Sophos supplies a technical case study. These source types are not interchangeable. Historical case details are not automatically current.