Crypto Romance Scams, Known As Pig Butchering Fraud, Trend Rapidly Growing Online

Key Takeaways

Crypto Legal tracks multiple threats known as Sha Zhu Pan, or “Pig Butchering” threats. These are confidence-based threats similar to romance scams. The threat actors lure a victim into depositing cryptocurrency into a fake cryptocurrency exchange. The threat actor steals the money.

These pig butchering threats are typically managed by a large industry of professional fraud actors. They can be initiated on dating apps, social media platforms, or text messages.

Crypto Legal researchers have spent the last three months engaged with numerous threat actors and developed detections to combat this growing threat. Based on our interactions the threat actors do little, if any, reconnaissance in the target selection phase. Threat actors are trained to not click links. All attempts to send them tracking links were met with rebuke and often resulted in being blocked.

Overview

Oh, hey there dear reader. It is a pleasure to meet you. You seem very smart and tech-savvy to be reading this blog. I bet we could be friends. Maybe something more? My uncle has taught me all about social engineering. He is highly intelligent and has many things to teach you. Let’s move this chat to WhatsApp and you can talk to him about Sha Zhu Pan or “Pig Butchering” ok?

The Process

The Sha Zhu Pan (Shāzhūpán) or “Pig Butchering” threat initially became popular in China, before spreading to other parts of East Asia and eventually, and more recently, English-speaking countries.

The U.S. Federal Bureau of Investigation (FBI) published an advisory in April 2022 detailing the cryptocurrency-based social engineering scheme that has become increasingly popular. Many victims of this type of attack have reported losing thousands to millions of dollars. According to the Global Anti Scam Organization (GASO), whose founder was a victim of a pig butchering campaign, the average victim loses almost $122,000 USD, and two-thirds of victims are women ages 25 to 40.

This pig butchering threat starts with an innocuous conversation with an attractive stranger on social media. They often pretend to have the wrong number, or they just jump right into the pleasantries. In between gushing compliments and photos of their lunch, they usually begin to discuss how they own a restaurant, beauty or nail salon, or other similar small business. Congratulations, you have just met your handler!

The Lure In

After chatting with the target for a few days, the threat actor will mention how they enjoy travel and the finer things in life, and that they couldn’t have done it without the guidance of their mentor, typically a friend or relative (like a kindly uncle).

If the victim is on a social media platform like Twitter, LinkedIn, or Tinder they will start suggesting taking the conversation to Telegram or WhatsApp. They will entice a target with suggestive language, such as “let’s take this to a more private chat 😉” and send racy “selfies” to encourage the victim to reciprocate and send compromising photos.

Once there, the conversation may continue along as a friendship, or they may shift the conversation similar to romance fraud and ask victims for risqué photos or videos. When they feel enough of a rapport has been established, they will invite the victim to chat with their “mentor” to discuss how they can make money.

The Mentor

This next phase of the fraud varies based on the threat actors’ preferences. The handler or “kindly uncle” may send the victim cryptocurrency investing white papers or help them set up a Coinbase or Crypto account. Obtaining a cryptocurrency wallet if the victim does not have one already is an integral part of the scheme.

The fraudsters may work with the victim on an individual basis or invite them to a chat group, typically on WhatsApp, Discord, or Telegram, where dozens of other people are making money by following a “Plan Analyst,” the person who runs the individual or group chats and shares crypto advice to lend credibility to their grift.

Crypto Legal researchers found that once on WhatsApp or Telegram, they started receiving invitations to private cryptocurrency trading groups, and other Pig Butchering threat actors reached out frequently. Most did not seem to be aware the researcher was already in an existing group. It appears that the threat actors’ contact lists get shared without any context or enrichment.

Ultimately, the victims will all be led to a fake cryptocurrency website or mobile application. The threat actors will tell victims to purchase a small amount of cryptocurrency, typically Tether (USDT), on Coinbase.com or Crypto.com. Actors will ask the victims to send screenshots of their accounts to confirm they are playing along and to lay the groundwork for further instructions later. Victims will be directed to make a specific purchase (usually less than $1,000 USD) using the fake crypto site during a set window of time.

If the victim complies, they will be “rewarded” with a 10 to 20% profit almost immediately in their account balance. These wins are made up though and the money has already left the platform and into the threat actors’ wallets. The handler will be very congratulatory but will urge caution as cryptocurrency can be a very volatile investment. They say, however, if people stick with “The Plan” they will make even more money.

These under $1,000 purchases will go on for a bit, depending on how long it takes for a victim to begin fully trusting the threat actor, and the victim’s balance on the site will continue to grow. Once they have gained trust, the actor will tell the victim it is time to invest a larger sum. The threat actors are engaging in a well-known behavioural procedure called “classical conditioning,” in which a person’s behaviour is trained to respond to a reward. In this case, investing a small amount in a fake platform and receiving a seemingly legitimate payout enough times so that a larger investment feels logical.

The Big Con

Once the victim is accustomed to using the platform and increasing their account balance – or “fattened up” in Pig Butchering parlance – they will be encouraged to make larger investments. Threat actors will encourage victims to take out loans, refinance their houses, sell stock holdings, etc.

If the victim starts to worry or wants to take out money, threat actors will allow them to take out a small sum, but explain the rest must remain due to taxes, international law, or anything else to placate the victim.

If this fails, threat actors will use more coercive tactics. Some victims have reported the threat actors have threatened to release any compromising photographs or videos that were previously shared, threatened to report the victim for tax fraud, or claimed that fees must be paid before closing the account. In the end, very little, if any, of the victims’ money will return to their accounts. The threat actors will shut down the website and domain and a new domain will be set up for their next victims.

The Victims

While the Pig Butchering scam is a relatively new trend in the English-speaking world it has been endemic in East Asia, especially China, for many years. In addition to cryptocurrency-based lures, these criminal enterprises have used gold, forex, stocks, and other subjects to exploit their victims. Such schemes are successful due to the intimate nature of the conversations leading up to the “slaughter”. The emotional manipulation, friendly tone, and sheer duration of the pre-exploitation phase allow genuine feelings to develop.

These emotions are then exploited to manipulate the victim. Genuine emotions also fuel under-reporting of these types of losses, as people feel shame about being duped and betrayed by someone they trusted, and do not wish to share with family, friends, or even law enforcement. Some victims have reported becoming suicidal. Causing shame and embarrassment are key goals for these pig butchering threat actors that leverage this type of social engineering to exploit victims, similar to romance fraud. This ensures their schemes have longevity due to victims keeping their exploitation private.

Fake Story

Another reason the threat actors are so successful is the sheer scope of the criminal enterprise. According to GASO, many people are employed to write curated scripts, and these branching scripts are constantly refined as more and more people are duped. They utilize trainers to instruct new recruits on how to react when things go off script.

Some alleged training documents have been leaked online from people who claim to be inside of these organizations.

They likely employ IT staff to stand up websites and apps as the speed at which it is done would require a professional. Threat actors appear to have been trained to not click links. When our researcher sent URLs capable of obtaining IP/location data, they were rebuked by the threat actors and typically resulted in our researcher being blocked.

While some of these actors willingly participate in criminal activity, many are reportedly unwilling victims themselves. According to a recent report in Vice, many people conducting pig butchering fraud in Cambodia are victims of human trafficking and are being held against their will by people who force them to conduct the illicit activity. Recently, Cambodian authorities announced a crackdown on illegal employment schemes supported by human trafficking and slave labour.

Know Who You Are Talking To

The recent increase in this type of scam is concerning. Exposure has forced threat actors to pivot into new markets which may explain the rise in reported cases in English-speaking countries and an increase in pig butchering message lures received on social media platforms. Only by shining a light on these practices can we force these criminals back into the dark pits they climbed out of.

While education is the cornerstone defence against social engineering-based threats, unfortunately, it isn’t foolproof. Throughout these engagements, Crypto Legal analysts have been adding malicious crypto sites and their email verification domains to block lists and Crypto Legal threat detection rules. Emerging Threats network IDS detections are also being developed to detect malicious crypto sites.

Ways to spot a pig butcher:

The 3 P’s – Pretty Polite People messaging you out of the blue.

They will ask to switch platforms – often citing it as safer, more convenient.

If you have been a victim of a Pig Butchering scam please contact us immediately to evaluate your case.

Find below some websites related to Pig Butchering scams: