Pig-Butchering Scams: How the Money Moves

Cryptocurrency investment fraud commonly described as “pig butchering” is built around a fundamental deception: the victim believes money is being deposited into an investment account, while the assets are actually being transferred into infrastructure controlled by the fraud scheme.

The FBI describes these schemes as confidence-based frauds in which victims are persuaded to make increasingly large cryptocurrency investments through fraudulent platforms. FinCEN has similarly documented schemes in which victims are directed to purchase cryptocurrency and send it to addresses controlled by scammers and their co-conspirators.¹²

Understanding that distinction is the starting point for following the money.

The balance on the screen may have nothing to do with the blockchain

A fraudulent investment platform may look remarkably similar to a legitimate exchange.

It may display account balances, trading activity, investment returns, customer-service functions, transaction histories, and withdrawal controls. Some schemes even allow a victim to make a small withdrawal early in the relationship to reinforce the appearance that the investment is genuine.¹²

But the numbers displayed on the platform are not necessarily blockchain balances.

The critical question is where the cryptocurrency actually went.

If a victim purchases cryptocurrency through a legitimate exchange and then transfers it to an address supplied by the supposed investment platform, the blockchain records that transfer. A website may later tell the victim that the investment has increased substantially in value.

That displayed number does not establish that those assets exist.

The blockchain transaction establishes where the cryptocurrency was actually sent.

The investigation therefore begins with the transactions, not with the balance displayed by the fraudulent platform.

The victim’s transfers create the starting point

In many cryptocurrency investment scams, the victim first acquires cryptocurrency through a legitimate exchange or other virtual-asset service provider.

The scammer may guide the victim through opening the account, purchasing cryptocurrency, and withdrawing it. FinCEN has reported that scammers may provide detailed instructions, request screenshots, or otherwise assist victims through that process.¹

The victim is then instructed to transfer cryptocurrency to an address presented as the investment’s deposit address.

Those transactions create the initial evidentiary record.

A useful analysis should identify the assets transferred, the relevant blockchain transactions, the addresses involved, the dates and amounts, and, where reliably established, the subsequent movement of the funds.

The FBI specifically advises victims of cryptocurrency investment fraud to preserve cryptocurrency addresses, asset types, amounts, dates, and transaction hashes, as these details may be important to an investigation.²

The first receiving address is usually only the beginning

Finding the address that first received the victim’s cryptocurrency is not the same as determining where the assets ultimately went.

Fraud proceeds may move shortly after receipt.

Federal authorities have documented cryptocurrency investment fraud in which victim funds were transferred through multiple wallets and services. FinCEN has cited cases involving fraud proceeds that moved through numerous addresses and swapping services in an apparent effort to obscure their source.¹

Other investigations have involved significantly larger networks.

In a 2025 civil forfeiture action involving more than $225 million in cryptocurrency, where we represent more than one hundred of the alleged victims and have filed verified claims covering more than $70 million in combined client losses, the Department of Justice alleged that a laundering network executed hundreds of thousands of transactions and dispersed fraud proceeds across an extensive group of cryptocurrency addresses and accounts.³

The practical consequence is important:

A tracing analysis should not stop merely because the victim’s funds leave the first address associated with the scam.

That is often where the tracing work begins.

Consolidation can reveal connections

A victim may believe that an address provided by a fraudulent investment platform belongs exclusively to the victim’s supposed investment account.

That may not be true.

An address may receive assets from multiple sources. Separate transaction paths may later converge within common wallets, services, or other infrastructure.

Those connections can be significant.

When apparently separate transaction paths converge, the blockchain may reveal relationships that would not be apparent from examining a single victim’s transfer in isolation.

But the conclusions must be stated carefully.

The fact that funds from multiple addresses converge does not, by itself, establish that every upstream address was controlled by the same person. Nor does it necessarily identify the operator of the fraud.

It establishes an observable transactional relationship that may warrant further investigation.

The distinction between what the blockchain records and what an analyst can infer from the evidence remains important throughout the trace.

Asset conversion does not necessarily end the trace

Fraud proceeds do not always remain in the cryptocurrency that the victim originally transferred.

Assets may be converted into other cryptocurrencies or moved through services that facilitate asset swaps. FinCEN has identified asset conversion as one type of transaction activity that can appear in connection with these schemes.¹

A change in asset does not necessarily mean that the transaction path becomes unknowable.

The relevant question is whether the available evidence reliably supports continuity of the transaction path.

The level of confidence may vary.

A responsible report should therefore explain the strength of the conclusion rather than treating every later transaction as automatically attributable to the victim’s original assets.

Cross-chain movement changes the analysis

Funds may also move from one blockchain network to another.

That can complicate the analysis, but it does not necessarily make further tracing impossible.

The relevant question remains whether the available evidence supports a reliable connection between the activity observed on the different networks.

This is one reason a blockchain trace should not be reduced to a visual diagram.

The diagram may illustrate the movement.

The underlying analysis must establish whether the path being shown is supported by the evidence.

An identifiable service can become an important investigative point

One of the most significant developments in a trace occurs when funds reach infrastructure attributable to an identifiable service.

That may include a centralized cryptocurrency exchange, custodian, payment service, or another identifiable virtual-asset business.

The blockchain may establish that cryptocurrency was transferred into infrastructure associated with that service.

It ordinarily does not establish the identity of the customer who controlled the relevant account.

That information may exist outside the blockchain.

Depending on the service, jurisdiction, available records, and applicable legal process, additional evidence may exist to help identify the account or person associated with the transaction.

This is where blockchain tracing and legal process can intersect.

The question is no longer simply:

“Where did the cryptocurrency go?”

It becomes:

“What entity may possess additional evidence concerning the account or person that received it?”

The end of the visible blockchain path is not necessarily the end of the investigation

A trace can terminate for many reasons.

Funds may reach an exchange or other service. Subsequent activity may occur within systems that are not publicly visible on the blockchain. Assets may be combined with other funds. The available evidence may become insufficient to support a further conclusion.

A responsible report should say so.

The absence of a further provable on-chain path does not necessarily mean the assets disappeared.

It means the public blockchain may no longer provide enough information, by itself, to establish what happened next.

At that point, legally obtainable records or other investigative evidence may become more important than additional blockchain analysis.

Movement is not the same as ownership

A common analytical mistake is to move from:

“Victim funds reached this address”

to:

“This person owns this address.”

Those are different propositions.

A public blockchain records transactions among cryptographic addresses. The identity associated with an address may depend on additional evidence, including reliable attribution, service records, public information, legal process, or other investigative material.

The strength of that attribution should be stated.

An address reliably attributed to a known service presents a different evidentiary proposition from an unidentified private wallet that merely interacted with another address of interest.

The further a conclusion moves beyond the blockchain transaction itself, the more important it becomes to distinguish established fact from analytical inference.

Following the money can identify a larger network

Large cryptocurrency fraud operations are not necessarily built around isolated wallets created for one victim at a time.

Federal investigations have identified laundering networks involving large numbers of addresses, transactions, accounts, and suspected victims. This illustrates why transaction-level tracing can have consequences beyond a single individual’s loss.

A victim’s transfer may become one part of a much larger transaction network.

Connections among victims, wallets, services, and laundering infrastructure may help investigators understand that network and determine whether particular assets are associated with a broader fraud operation.

Traceability is not the same as recoverability

Tracing cryptocurrency matters.

It does not guarantee recovery.

Assets may be traceable to infrastructure outside practical legal reach. They may move before an exchange or law-enforcement agency can act. They may pass through multiple jurisdictions or services. Additional evidence may be required before property can be restrained.

Conversely, assets that have moved through numerous transactions may still reach an identifiable service or other point at which legal intervention becomes possible.

The relevant considerations may include where the assets moved, whether they remain identifiable, whether an identifiable service is involved, what jurisdiction applies, whether law enforcement is investigating the matter, and whether a forfeiture, restitution, remission, or other recovery process may become available.

No legitimate tracing analysis can promise recovery solely because a transaction path exists.

Timing matters

Cryptocurrency transactions can occur quickly, and fraud proceeds may begin moving before the victim realizes that the investment platform is fictitious.

For that reason, the evidentiary record should be preserved as early as possible.

The FBI advises victims of cryptocurrency investment fraud to stop sending additional money, report the matter through the Internet Crime Complaint Center, and provide detailed transaction information. The Bureau notes that timely reporting can assist investigative efforts and potential recovery.²

Important records may include cryptocurrency transaction information, exchange histories, bank records, screenshots of the fraudulent platform, communications with the scammers, website or application information, and records of any additional payments demanded to release the supposed investment.

Requests for additional “taxes,” “fees,” “verification payments,” or other charges are particularly important to preserve.

Victims should also be cautious of anyone who later promises guaranteed recovery in exchange for another upfront payment. Secondary recovery scams frequently target people who have already suffered an initial loss.

Do not confuse the fake account with the stolen assets

The essential point is simple.

The fraudulent platform is the story presented to the victim.

The blockchain records where the cryptocurrency actually moved.

A useful investigation separates the two.

It reconstructs the victim’s transactions, follows the strongest supportable transaction path, identifies significant points of movement or consolidation, distinguishes observable transactions from attribution, and identifies points at which additional legally obtainable evidence may exist.

That does not mean every transaction can be followed indefinitely.

It does not mean every wallet can be attributed to a person.

And it does not guarantee that stolen cryptocurrency can ultimately be recovered.

But it replaces the fictitious balance shown on a fraudulent investment platform with an evidentiary record of what actually happened to the money.