Pig butchering is the most financially damaging fraud category the FBI tracks, and at its core is a brand impersonation problem: fake trading platforms designed to look indistinguishable from legitimate crypto exchanges, operated at industrial scale by criminal networks across Southeast Asia.
The term pig butchering originates from the Chinese phrase shā zhū pán, which describes the process of fattening a target before taking everything they have. In practice, it is a long-term fraud scheme in which scammers build trust through a fabricated relationship, typically romantic or professional, then direct the target to a fake trading platform that mimics a legitimate exchange. The target deposits funds, sees fabricated returns, and is blocked from withdrawing. INTERPOL has urged the industry to retire the label in favor of “romance baiting,” citing the additional harm it inflicts on victims who are already devastated.
The operations behind the scams warrant that gravity: many are run from fortified compounds across Myanmar, Cambodia, and Laos by organized criminal networks, and the workers staffing them are in many cases trafficked and coerced, victims of the same enterprise that defrauds the people on the other end of the screen.
The financial scale also matches the human cost. When the FBI’s Internet Crime Complaint Center released its 2025 report, cryptocurrency investment fraud, the category that encompasses pig butchering, accounted for $7.2 billion in reported losses in a single year. The Chainalysis 2026 Crypto Crime Report found that impersonation-driven scams were the fastest-rising category in the dataset, growing 1,400% year over year, with AI-enabled operations generating 4.5 times the revenue of traditional schemes.
How pig butchering works
The scheme follows a sequence that is consistent across operations, even as the specifics vary by region, platform, and target.
Initial contact typically arrives through social media, a messaging app, or a dating platform. The person on the other end presents as a potential romantic interest, a professional connection, or a fellow investor, and they are patient. The trust-building phase can last weeks or months, with daily messages, shared personal stories, and an emotional relationship that feels genuine to the target. The investment opportunity is introduced only after the relationship is established, framed as something the scammer is personally involved in and wants to share.
The target is then directed to what appears to be a legitimate trading platform. The interface is polished: real-time charts, account balances, transaction histories, and customer support channels that respond promptly. In some cases, early withdrawals are permitted to build confidence. MDF Law reported that these platforms are “designed to look legitimate, often mimicking real exchanges and displaying fabricated account balances to create the illusion of active trading and consistent profits.” The target sees returns, deposits more, and trusts the platform because it looks and behaves like the financial services interfaces they use every day.
The extraction begins when the target attempts a significant withdrawal. The platform demands fees for taxes, compliance verification, or account upgrades. Each payment unlocks nothing. The cycle continues until the target runs out of funds or recognizes the fraud, by which point the money has already moved through a network of wallets, mixers, and decentralized exchanges designed to make recovery nearly impossible.
What follows is often a second round of impersonation. The FBI warns that almost all victims are subsequently contacted by scammers impersonating law enforcement agencies, law firms, or recovery companies who claim they can retrieve the stolen funds for a fee. The recovery fraud is itself an impersonation operation, built on the same mechanism as the original scheme: borrowing the authority of a trusted institution to extract money from a target who has every reason to want to believe.
Why pig butchering is a brand impersonation problem
The standard framing of pig butchering is a consumer protection issue: educate investors, recognize warning signs, avoid sending money to unverified platforms. That framing addresses the demand side of the scheme. It does not address the supply side, which depends on the systematic impersonation of legitimate financial brands.
The fake trading platforms at the center of these operations are not generic. They are built to replicate specific exchanges and financial services, following the same counterfeit storefront logic that drives fake retail sites but applied to financial infrastructure. Webopedia’s catalogue of fake exchanges documents cases where attackers created spoofed Coinbase Pro login pages that outranked the real site on Google, resulting in $20 million in stolen funds. Platforms clone the branding, interface design, and even the regulatory disclaimers of legitimate exchanges, presenting an experience that is visually and functionally indistinguishable from the real service. The target is not simply being tricked into trusting a stranger. They are being tricked into trusting a platform that looks exactly like one they already know.
For the legitimate exchanges and financial brands being replicated in these operations, the exposure is both reputational and operational. Every fake platform that carries their visual identity and user interface patterns damages the trust that their real customers depend on. The California Department of Financial Protection and Innovation maintains a crypto scam tracker that catalogues hundreds of fraudulent platforms, many of which explicitly impersonate regulated exchanges or investment firms. The impersonated brands typically have no visibility into these operations until a victim reports the platform to law enforcement or a regulator, which may be weeks or months after the fraud began.
The phishing-as-a-service infrastructure that powers broader credential theft is increasingly converging with the pig butchering ecosystem. Chainalysis documented that scam operations now routinely incorporate stealer malware, approval phishing targeting crypto wallets, and social engineering techniques that mirror the playbooks used in business email compromise and account takeover across other industries. The same tooling that harvests banking credentials through brand-impersonating phishing pages is now being adapted to support the fake exchange platforms where pig butchering deposits are collected.
The Bottom Line
Pig butchering is the costliest fraud category in the FBI’s complaint data, and the Chainalysis numbers suggest the reported losses significantly understate the actual scale. The scheme is industrialized, AI-augmented, and built on a foundation of systematic brand impersonation: fake trading platforms that replicate legitimate exchanges, fake support teams that mimic real customer service, and fake recovery firms that impersonate the institutions meant to help. For the financial brands and crypto exchanges whose interfaces and trust signals are being cloned in these operations, the question is not whether their brand is being used in pig butchering campaigns. At the scale Chainalysis documents, the question is whether they have the visibility to know when it is happening and the operational capacity to respond.
Key Takeaways
A long-term fraud scheme in which scammers build trust through a relationship, typically romantic or professional, then direct the target to a fake trading platform that mimics a legitimate exchange. The target deposits funds, sees fabricated returns, and is blocked from withdrawing. The term originates from the Chinese phrase describing the process of fattening a target before taking everything.
The FBI attributed $7.2 billion in losses to cryptocurrency investment fraud in 2025 alone. Chainalysis estimated $17 billion in total crypto scam losses that year, with impersonation-driven scams growing 1,400% year over year. AI-enabled operations averaged $3.2 million in revenue per scheme, 4.5 times more than traditional scams.
The fake trading platforms at the center of these schemes are built to replicate specific legitimate exchanges and financial services. Attackers clone branding, interface design, and regulatory disclaimers to create experiences indistinguishable from the real service. Recovery fraud that follows the initial theft also depends on impersonating law enforcement, law firms, and financial institutions.
These operations are frequently run by organized criminal networks from fortified compounds across Southeast Asia, particularly in Myanmar, Cambodia, and Laos. Many workers in these compounds are themselves trafficked and coerced. INTERPOL has urged the industry to retire the “pig butchering” label in favor of “romance baiting” to reduce harm to victims.
Monitor for unauthorized use of your brand identity across fake trading platforms, phishing infrastructure, and recovery fraud operations. The California DFPI’s crypto scam tracker catalogues hundreds of fraudulent platforms, many explicitly impersonating regulated exchanges. Brands whose interfaces are being cloned need continuous monitoring and the ability to initiate takedowns across jurisdictions where these platforms operate.
