Crypto investment fraud and pig-butchering: the playbook step by step and the warning signs at each stage
Walk through the six stages of a pig-butchering scam, from the first wrong-number message to the blocked withdrawal, and learn the specific warning sign and the correct action at every stage.
What you will learn
- What "pig-butchering" means and how it differs from the crypto scams covered earlier on this site
- The six stages of the playbook and the warning sign at each stage
- Why a fake trading dashboard is so convincing and how to test it with arithmetic
- Where the money goes and why recovery is rare
Explanation
Pig-butchering (from the Chinese term sha zhu pan) is a long-term confidence fraud. The scammer builds a personal relationship over weeks or months (the "fattening"), then guides the victim into a fake crypto investment platform and takes everything (the "slaughter"). Phishing, rug pulls and fake wallets were covered in the course Bitcoin & Crypto Foundations; this lesson is about the human playbook, run from organised call centres, which uses crypto only as the payment rail because transfers are fast and irreversible.
The FBI's Internet Crime Complaint Center (IC3) reported for 2024 about $9.3 billion of losses to crypto-related fraud reported by US victims, of which about $5.8 billion was crypto investment fraud, the category that includes pig-butchering. Check the current BaFin and Bundeskriminalamt (BKA) warnings for German figures.
The six stages
| Stage | What happens | Warning sign | Correct action |
|---|---|---|---|
| 1. Contact | A "wrong number" text, a dating-app match or a social-media message; the chat soon moves to WhatsApp or Telegram. | A stranger continues after a wrong number; few, professional profile photos. | Do not reply; reverse-search the photos. |
| 2. Rapport | Daily messages for weeks about family and work. No money is mentioned. The scammer learns your income and savings. | Reluctance to video-call or meet; a rich "uncle" or "mentor" in finance. | Never share financial details with someone you have not met. |
| 3. Introduction | The friend shows screenshots of crypto gains and offers to teach you on "their" platform, a professional-looking app with live prices. | Not in any app store or regulator register; the friend, not you, chose it. | Search the name plus "scam"; check the BaFin warning list; refuse. |
| 4. Test deposit and withdrawal | You deposit a small sum, see a quick gain and may withdraw it. Trust is complete. | Near-daily gains; the friend "coaches" exact trades. | A small withdrawal proves nothing; it is a scripted step. |
| 5. Escalation | You move savings, sell investments, take loans. The dashboard shows large profits and a "limited-time" opportunity. | Pressure to invest more; suggestions to borrow. | Stop at the first suggestion to borrow; tell a trusted person offline. |
| 6. Slaughter | A withdrawal triggers a "tax", "fee" or "account frozen" demand. After one or more payments the platform and the friend vanish. | Any payment demanded to release your own money. | Pay nothing; preserve evidence; report (lesson 9). |
Why the dashboard is convincing
The platform shows real market prices from public feeds, a balance that updates in real time and chat support that answers within minutes. None of this is hard to build; the balance is a number in the scammer's database. The decisive tests are what arrives in an account or wallet only you control, and whether the implied return is possible at all.
Where the money goes
Deposits are usually made by buying crypto at a real exchange and sending it to a wallet address given by the "platform". The funds are then moved through many wallets, converted to stablecoins and cashed out abroad. Seizures are the exception, and any company that promises to trace and recover your crypto for a fee is the recovery-room scam from lesson 3.
Worked example
Hypothetical example: the "friend's" platform shows a gain of 3% per day. You deposit €5,000. Assumptions: gains compound daily; no fees or taxes.
- Balance after 30 days = €5,000 × 1.03^30 = €5,000 × 2.427 = €12,136. Shown "profit": €7,136 in one month.
- After 90 days = €5,000 × 1.03^90 = €5,000 × 14.30 = €71,500.
- After one year = €5,000 × 1.03^365 ≈ €5,000 × 48,483 ≈ €242 million.
No legal strategy turns €5,000 into €242 million in a year; if it existed, its owner would not teach strangers on a dating app. The arithmetic test takes two minutes. Note also the "tax" stage: at a shown balance of €71,500 a 20% "tax" demand equals €14,300, almost three times the original deposit, paid to protect a profit that is a database entry.
Common mistake
Practice activity
On paper: a relative shows you a chat with an online friend who has guided them to a crypto platform. The dashboard shows €18,000 after a €6,000 deposit six weeks ago. The friend now proposes a "node sale" that requires €10,000 more within 48 hours, and suggests a quick consumer loan. (a) Which stage is this? (b) What daily compound rate does €6,000 → €18,000 in 42 days imply, roughly? (c) Write the three sentences you would say to your relative.
Show solution
(a) Stage 5, escalation: pressure, time limit and the loan suggestion. (b) 18,000 / 6,000 = 3.0; the daily rate r satisfies (1 + r)^42 = 3, so r ≈ 2.65% per day, about 970% per year without compounding. Impossible as a genuine return. (c) Example: "The platform is not in any regulator's register and the return it shows is impossible, so the balance is not real. Do not send the €10,000 and do not take a loan. Let us save the chat and wallet addresses now and report it together."
Limitations: the implied-rate calculation is only a screening tool; a scam can also show modest returns and still steal the principal.
Key takeaways
- Pig-butchering is a relationship scam first and a crypto scam second; the crypto is only the irreversible payment rail.
- Each of the six stages has a clear warning sign: wrong number, no video, friend-chosen platform, test payout, loan suggestion, tax to withdraw.
- Test the implied return with compound arithmetic; 3% per day is €242 million from €5,000 in a year.
- Recovery is rare and paid recovery offers are a second scam.
Next step
The next lesson examines affinity fraud, where the person recommending the investment is not an online stranger but a real friend, colleague or community member.
Self-check
Answer the questions, then check your answers. You can retry as often as you like.
Automatic self-check for your own revision. Your answers are checked in your browser and are not seen or assessed by us. It is not an exam and not a qualification.
Your progress
“Complete” only means you marked the lesson as done. It is not a test of your understanding. Progress and notes are saved only in this browser on this device — not in an account.