"Pig butchering" is a translation of the Mandarin sha zhu pan, and the metaphor is operational rather than rhetorical: the victim is fattened before slaughter. What distinguishes it from ordinary investment fraud is the industrial structure behind it.
The pipeline
Contact. A wrong-number text, a dating app match, a professional networking message. Approaches are generated in volume and the opener is deliberately mundane. The goal of the first exchange is only to establish that a human is on the other end.
Relationship. Weeks of ordinary conversation with no mention of money. This phase is what makes the fraud durable. By the time an investment is discussed, the victim is not evaluating a cold pitch from a stranger.
Introduction. The subject is raised indirectly, usually as the operator's own success rather than a recommendation. A relative "works in the industry". Screenshots of gains appear casually.
The platform. The victim is directed to an app or site that looks like a real exchange. It has order books, candlestick charts, KYC flows and a support desk. None of it is connected to a market. The balance shown is a number in a database controlled by the operator.
The test withdrawal. A small early withdrawal is honored. This is the pivot: it converts scepticism into confidence and it is the cheapest money the operation ever spends.
The escalation. Deposits increase. Where a victim's liquid funds are exhausted, the script moves to home equity, retirement accounts and loans from family.
The wall. The withdrawal request fails. A "tax", "anti-money-laundering deposit", "account upgrade" or "regulatory fee" is required first. This phase extracts a substantial fraction of total losses and can continue long after the victim suspects fraud.
Why the money moves the way it does
Deposits are almost always requested in a stablecoin, most often USDT on Tron, because settlement is fast, fees are negligible, and value does not fluctuate between deposit and consolidation.
From the deposit address, funds typically move through a recognisable sequence: consolidation into a collection wallet, a layering stage that fans out across intermediate addresses, then conversion or off-ramping. On-chain this is highly visible. The difficulty is never seeing the flow. It is that the endpoint is frequently an over-the-counter desk or a venue with no meaningful compliance obligations.
What this means for an investigation
The structure has consequences that shape what an investigator can honestly offer:
- The operator you spoke to is rarely the beneficiary. Front-line staff are often themselves trafficked and working under coercion. Identifying them advances very little.
- Infrastructure is more attributable than people. Domain registration, TLS certificate history, app signing certificates, payment processors and hosting reuse are where attribution actually comes from. Compounds run many platforms from shared infrastructure, and that reuse is the seam.
- Speed determines everything. Once funds reach an uncooperative off-ramp, the investigation shifts from recovery to documentation.
The signals that hold up
No single indicator is conclusive. The combination is:
- The relationship began with an unsolicited message and moved to a private channel quickly.
- The trading platform cannot be found in an official app store, or exists there under a name unrelated to its branding.
- Deposits go to a wallet address rather than through a regulated payment rail.
- The domain is young. Registration date is public and takes thirty seconds to check.
- Returns are consistent. Real markets are not.
- A withdrawal requires an inbound payment first. This one is dispositive.