A financial crime industry built around manufactured trust
The fraud often called “pig butchering” is more precisely understood as relationship investment fraud: sustained personal manipulation directs real money into an investment environment controlled by criminals. The relationship can be romantic, friendly, professional or apparently educational. The asset displayed on the screen may be cryptocurrency, foreign exchange or another investment. What unites the schemes is the substitution of a manufactured relationship and fabricated financial evidence for independent verification. FinCEN explicitly describes both virtual-currency and over-the-counter foreign-exchange variants. [1]
The perpetrators’ term dehumanizes the people whose savings they steal. It also obscures the second population harmed by this industry: people recruited for apparently legitimate work and compelled to conduct fraud. This article uses the familiar label to identify the subject, while treating both financial victims and trafficking survivors as people rather than stereotypes. No nationality, age or occupation is a reliable substitute for examining conduct and evidence.
The central analytical distinction is between an unsuccessful investment and an invented investment. A genuine asset can lose market value; in these schemes the displayed position may never have existed. The user’s payment is real, but the supposed account balance, trading history and withdrawal conditions may be fiction. That difference explains why sending additional money to rescue the balance can deepen the loss without purchasing anything recoverable.
The measured scale, and the boundaries of the numbers
The FBI’s 2025 Internet Crime Report records 61,559 cryptocurrency-investment-fraud complaints. Its trend summary on page 53 gives $7.228 billion in losses and increases of 48% in complaints and 25% in losses from 2024; its page 55 investment-with-cryptocurrency-nexus table instead lists $7,277,868,919. The report does not explain that discrepancy, so these figures should not be presented as reconciled. The broader cryptocurrency-related category contains 181,565 complaints and approximately $11.37 billion in losses, including crimes beyond investment fraud. These are complaints reported to IC3, not a census of relationship-based scams. [2]
A July 28, 2026 UN Geneva briefing described estimated combined 2025 losses from scam offences across East Asia, Southeast Asia, Australia and New Zealand of $88.3 billion–$114.1 billion. That is a regional, broader-scam estimate, not an IC3 cryptocurrency-investment total, an audited revenue figure for compounds, or money proved stolen in court. It cannot sensibly be added to the FBI total to produce a global number. [3]
Complaint statistics reflect recognition, willingness to report, classification and access to authorities. They are not a complete census of victimization. Treasury’s Funnull announcement explicitly says reported losses likely understate the harm because many victims do not report. Conversely, an estimate built from blockchain flows can include transfers between intermediaries rather than distinct consumer losses. Counting each movement as a new theft would exaggerate scale. The defensible conclusion is enormous measured harm with substantial measurement uncertainty, rather than a single authoritative worldwide pig-butchering loss figure. [4]
How the relationship becomes the investment channel
Initial contact may arrive through a text, social network, dating service or professional network. An apparently accidental conversation can become repeated attention. In other versions the entry point is a discussion group that seems to offer investment expertise. The fraud therefore does not require romance, an explicit plea for financial help or an obviously implausible stranger asking for a wire. FinCEN’s public alert describes contact followed by relationship-building and a later investment proposition. [5]
The important transition is a change in what the relationship is being asked to validate. Someone who appears attentive or professionally successful begins recommending a platform, introducing an adviser or explaining a financial opportunity. Personal familiarity is implicitly offered as evidence of custody, regulation or investment competence. Those are different propositions. A real conversation, including a video call, can establish that someone is communicating; it cannot establish who controls the receiving account or whether a displayed investment exists.
In the SEC’s September 2024 NanoBit complaint announcement, participants allegedly impersonated financial professionals in WhatsApp groups and directed investors to a fake crypto platform, including a false claim about an SEC-registered affiliate. The separate CoinW6 allegations described romantic approaches through LinkedIn, Instagram and WhatsApp, fabricated investment balances, and withdrawal demands for taxes or fees. These are civil allegations in the cited announcement, not findings this article independently treats as adjudicated. They illustrate two different relationship channels into the same custody deception. [6]
The platform is evidence theatre, not proof of custody
A trading interface can contain prices, charts, order histories, support messages and a balance without holding the assets those displays imply. A legitimate exchange used to buy cryptocurrency can appear earlier in the payment chain, but that does not authenticate the destination to which the cryptocurrency is subsequently sent. The victim may accurately remember using a well-known provider while misunderstanding which entity actually received the investment.
The FBI describes fake investment platforms that show invented profits to encourage continued payments. FinCEN also documents situations in which an initial small withdrawal is permitted. That successful test is powerful psychologically, but proves only that a limited payment was made at that moment. It does not establish that the remaining account is fully funded, that trading occurred, or that the apparent operator owes an enforceable obligation supported by assets. [7][5]
This creates an asymmetry between the two ledgers. The victim sees a growing fictional claim; the criminal network receives spendable value. The apparent profit can expand without the operator earning a market return. Consequently, a screenshot showing a large gain is not evidence of the amount recoverable in an investigation. The economically meaningful starting point is usually the actual transfer history and any genuine money returned, not the platform’s highest displayed balance.
Treasury’s May 2025 designation of Funnull Technology described a shared infrastructure provider supporting large numbers of scam websites and helping sites reappear after takedowns. Treasury linked the infrastructure to more than $200 million in U.S. victim-reported losses. This matters because apparently different brands can sit on common services; shutting one visible storefront does not necessarily remove the network behind it. A sanctions designation is an administrative action, not a criminal conviction of every person associated with the infrastructure. [4]
A related variant does not depend solely on a deposit account at a fake exchange. The FBI’s July 2022 -mining alert describes deceptive applications that induce wallet permissions and enable theft of wallet assets. The public-facing claim is passive investment income; the underlying exposure is control over transfers. This is analytically distinct from a dashboard that merely lies about a balance, although both can be promoted through a manufactured relationship. An apparently self-controlled wallet does not establish safety if another party has obtained authority over its assets. [26]
Escalating deposits and the fictitious withdrawal barrier
The final demand may be framed as the opposite of another investment: a payment supposedly needed to recover money already earned. The FBI documents accounts being frozen behind asserted taxes or fees. This reframes the decision from pursuing a speculative return to saving what the victim now believes is an existing asset. The platform’s displayed balance supplies the emotional reference point, even when that balance has no corresponding funds. [8]
The escalation can migrate beyond liquid savings. FinCEN documents liquidation of tax-advantaged holdings, home-equity borrowing and second mortgages used to finance further deposits. Those are separate financial consequences: investment loss, tax or withdrawal consequences, and debt obligations do not disappear together merely because the underlying investment was fraudulent. Whether any relief is available depends on the facts and applicable rules; the existence of a police report alone does not erase a loan. [5]
A fee is not fraudulent simply because a financial product has one. The concerning pattern is an unverified relationship directing transfers to an opaque platform, followed by expanding payments as a condition of retrieving an alleged balance. Legitimate fees and taxes have identifiable contractual or legal bases and independent channels for verification. In the FBI-described scam, additional payment does not unlock the money. The demand is another extraction event, not evidence of a normal settlement problem. [8]
Why intelligent people can remain inside the story
The mechanism exploits ordinary capacities: trust, reciprocity, hope, commitment and the desire to repair a frightening mistake. A person may understand market risk but still be deceived about the counterparty. Recognizing fraud can mean simultaneously accepting a financial loss, a relationship betrayal and an identity-threatening realization that apparent evidence was manufactured. That is a much larger psychological transition than spotting a spelling error in a phishing message.
A 2025 qualitative study by Rajvardhan Oak and Zubair Shafiq interviewed 26 victims and described emotional manipulation, repeated pressure, shame, difficulty obtaining help and vulnerability to secondary scams. Its small, qualitative sample illuminates experiences and mechanisms; it does not estimate how often each tactic occurs across the population or prove a single victim profile. The study also argues for less stigmatizing terminology. [9]
Our interpretation is that ridicule can strengthen the barriers to disclosure. Someone anticipating blame may delay showing messages or transaction records to another person. A clear separation between responsibility for the crime and analysis of the decision process is therefore important: explaining manipulated trust is not excusing the perpetrators, and describing a preventable transfer is not assigning moral fault to the person deceived. Financial literacy and fraud literacy overlap, but neither makes a person immune to a sustained relationship attack.
The other recruitment pipeline: people forced to commit fraud
The labour side begins with an apparently attractive employment opportunity rather than an investment. The UN’s July 2026 briefing describes workers arriving at scam centres, losing control of their passports, suffering abuse and being prevented from leaving. The boundary between recruiter, travel arranger, employer, compound manager and armed enforcer can conceal responsibility across multiple participants. Fraud victims on the receiving end of messages may have no way to know whether the sender is coerced. [3]
OHCHR’s February 2026 report places trafficking survivors’ experiences at the centre of the analysis and stresses a human-rights response, including the non-punishment principle. That principle addresses unlawful conduct people were compelled to commit because they were trafficked; it does not mean every worker, manager or recruiter is automatically immune. Individual circumstances and roles matter. Treating everyone found in a compound as a willing fraud operator can punish survivors while obscuring those who controlled the enterprise. [10]
The report’s indexed text cites credible estimates of at least 300,000 people from 66 countries involved in the scam workforce. That is not a headcount taken on October 4, 2026 or a finding that every person in the workforce was trafficked. It is a scale estimate in a difficult-to-observe environment. The report describes deception about work or conditions affecting the majority of the workforce, alongside managers and personnel from criminal networks. [11]
The two victim populations are connected but their needs differ. Financial victims need credible reporting, evidence preservation and a realistic account of recovery. Trafficking survivors may additionally need physical safety, identification, legal status and protection from punishment for compelled activity. An operation measured only by arrests or deportations can miss these distinctions. Equally, attention to forced labour cannot erase the financial harm caused by the messages sent from a compound.
The criminal supply chain extends beyond the compound
A useful analytical map separates recruitment and coercion, interpersonal deception, digital infrastructure, payment collection and monetization. One organization may perform several functions; another may buy services from outside specialists. Shared service providers make the industry more resilient because a damaged component can sometimes be replaced while the wider relationships and financial access persist.
On September 9, 2026, DOJ announced action against Xinbi, describing allegations in a seizure warrant concerning a marketplace offering services to scam operators. The announcement said a court authorized seizure of the relevant Telegram channels and that approximately $52 million in cryptocurrency was restrained in one day, taking the Strike Force’s restrained total to approximately $938 million. DOJ also described assistance with action against 13 scam compounds in Madagascar. The marketplace allegations are not a blanket adjudication of everyone using the messaging service. [12]
These developments make a purely geographic account incomplete. Southeast Asia is central to the documented cases, but the payment accounts, internet services, victims and enforcement jurisdictions extend much further. The nationality of a defendant can be relevant identification in a case; it is not a useful explanation of criminal propensity. The analytical unit is a documented network and its functions, not an ethnic community.
Following money across bank accounts, exchanges and blockchains
A simplified observed payment path can start with an ordinary bank transfer, pass through a collecting account, become a digital asset and reach another wallet. Other cases begin with a customer buying cryptocurrency and sending it directly to a criminal-controlled address. Neither path makes all cryptocurrency activity suspicious. The risk arises from deception, account control and purpose, not from the asset label alone.
The January 27, 2026 sentencing of Jingliang Su supplies a concrete adjudicated example. DOJ reported a 46-month prison sentence after his guilty plea to conspiracy to operate an illegal money-transmitting business, and a restitution order of $26,867,242.44. The release describes more than $36.9 million in victim funds moving from U.S. accounts to an account at Deltec Bank in the Bahamas, conversion to USDT, and transfer to a wallet controlled in Cambodia. Authorities identified 174 U.S. victims. Naming a bank in a transaction route does not by itself establish that the bank was convicted of misconduct. [13]
Public blockchains can preserve transaction paths while leaving the human controller uncertain. An address is not automatically a named person, and a visible balance is not an asset that an investigator can necessarily seize. Identity records, account records, legal process, cooperation and control over the relevant asset all matter. Traceability is an evidentiary advantage; recoverability is a different question involving jurisdiction, timing and legal rights.
In June 2025 DOJ filed a civil forfeiture complaint against more than $225.3 million in cryptocurrency connected, according to the complaint, to a confidence-scam laundering network. The announcement described blockchain analysis, other investigative work and more than 400 suspected victims globally. It illustrates that extensive transaction movement can still yield investigative evidence. The complaint and seizure did not establish that every claimant had been paid or that the entire amount represented a single victim’s loss. [14]
Prince Group: the difference between accusation, custody and final recovery
DOJ’s October 14, 2025 announcement charged Prince Group chairman Chen Zhi with wire-fraud and money-laundering conspiracies, alleging operation of forced-labour scam compounds in Cambodia. It also announced a civil forfeiture action covering approximately 127,271 bitcoin already in U.S. government custody, valued at approximately $15 billion at that time. That dollar valuation is historical, not a current price or an amount distributed to victims. The allegations remain allegations for purposes of this article; an indictment does not establish guilt. [15]
The same 2025 announcement described Chen as at large, but that description cannot be carried forward unqualified. An April 23, 2026 U.S. bankruptcy-court opinion concerning related debtor entities records his January 6 arrest in Cambodia and extradition to China, and says he remained in Chinese custody at the time of the opinion. That is a dated court-record update, not independent verification of his location today or a U.S. criminal judgment. This review did not establish a final U.S. merits disposition or a completed distribution of the bitcoin to financial victims. [16]
The case demonstrates why enforcement headlines require several verbs. A charge identifies alleged conduct. A seizure or restraint removes or limits control over assets. Forfeiture determines the government’s entitlement under the relevant process. Restitution imposes an obligation to compensate specified victims. Collection and distribution establish whether money actually arrives. These stages can proceed on different timelines, and a very large custodial balance is not the same thing as a very large completed recovery for households.
How a scam reached the balance sheet of a community bank
The Heartland Tri-State Bank case shows the potential spillover beyond the person communicating with scammers. Shan Hanes pleaded guilty to embezzlement by a bank officer after transferring $47.1 million of bank funds in a cryptocurrency scheme. DOJ’s plea announcement describes transfers from May through July 2023. Being deceived did not absolve him of taking the bank’s money; he occupied a separate position of trust with separate obligations. [17]
A November 4, 2024 DOJ release, preserved by FHFA’s inspector general, states that Hanes received a 293-month prison sentence and that the fraud caused the bank to fail. It reports approximately $9 million of investor losses, recovery of $8 million associated with the fraud and a court order dividing seized money among harmed investors. Those reported investor losses and recovered funds are not interchangeable with the $47.1 million taken from the bank. [18]
The broader implication is an authority problem as well as a consumer-fraud problem. A manipulated individual who controls an institution’s funds can transmit the harm to shareholders, colleagues and counterparties. Authentication may accurately show that an authorized officer initiated a payment while failing to resolve whether that officer had a legitimate purpose. Customer persuasion and internal abuse of authority can therefore intersect without being the same control failure.
Institutional controls: several views of one developing crime
A bank sees funding and transaction behaviour; an exchange sees asset acquisition and destinations; a communications platform sees accounts and contact patterns; infrastructure providers see domains and hosting; law enforcement can combine records under legal authority. No single participant necessarily observes the entire relationship. The gap between individually plausible transactions and an implausible overall story is one reason these cases are hard to interrupt.
FinCEN’s February 2025 reminder emphasizes suspicious-activity reporting and effective Bank Secrecy Act compliance. Its cited materials also describe relationship victims being used to move funds in other frauds. That creates an important distinction between a customer sending their own savings and a person receiving and forwarding money belonging to somebody else. A suspicious activity report is an investigative input, not proof of a customer’s guilt or a guarantee that a payment will be recovered. [1]
FinCEN’s October 2025 final rule, effective November 17, 2025, prohibited covered U.S. institutions from maintaining correspondent accounts for Huione Group and required reasonable steps against indirect access through foreign-bank correspondent accounts. This was a targeted financial-system measure. FinCEN’s underlying May finding attributed at least $4 billion of illicit proceeds to the group over August 2021–January 2025, including multiple crime types. That aggregate is not exclusively pig-butchering losses. [19][20][28]
On June 23, 2026, FinCEN proposed expanding the Huione definition to H-Pay Service PLC and successor entities; it subsequently extended the comment period. The proposal illustrates the problem of continuity behind changing corporate names. FinCEN’s Special Measures table still lists H-Pay under proposed rulemaking, with no final rule linked, at the October 4 review. The existing 2025 final rule and the proposed 2026 expansion have different procedural status. [21][22][27]
DOJ’s June 2026 Disruption Week announcement described voluntary private-sector action against millions of communications and internet-access accounts and freezing of more than $3.8 million in cryptocurrency. Those are disruption outputs, not a measured reduction in total victim losses. Durable effectiveness would require evidence that replacement infrastructure, recruitment and payment routes also weakened, rather than simply counting removed accounts. [23]
Warnings, reporting and the limits of recovery
The recurring warning pattern is a relationship that turns into investment direction, an unverifiable platform, returns supported mainly by on-screen claims, and escalating conditions on withdrawals. A successful small withdrawal, a professional-looking interface, a live person or an impressive claimed credential does not independently resolve who controls the money. The value of these observations is their combination; unusual behaviour alone is not proof of crime.
For people who suspect a loss, the FBI’s U.S. reporting guidance identifies IC3.gov and local FBI field offices as reporting channels. It emphasizes transaction details: receiving addresses, asset type and amount, dates and times, and transaction hashes, alongside contact and platform information. These records connect a personal account of deception with an identifiable payment trail. Official reporting does not require purchasing a private recovery service, and a report does not promise an individual investigation or reimbursement. [24]
In July 2026, the FBI warned of recovery fraud impersonating IC3 personnel, including AI-generated videos and spoofed complaint websites. The alert says IC3 does not recover funds through social-media messaging and does not request payment for recovery; genuine follow-up may come from local FBI employees or other law enforcement. The distinction matters because impersonators can use the language of an actual investigation to make a second demand seem credible. [25]
An honest recovery account distinguishes money prevented from leaving, assets frozen, assets seized, judicial awards and money paid back. The FBI’s 2025 report describes Operation Level Up notifying 3,780 victims during the year, 78% of whom had not realized they were being scammed, and estimating $225.9 million in avoided losses. Those are intervention estimates, not seized funds or cash refunds. They illustrate that interrupting the next transfer can be economically important even when earlier transfers are difficult to recover. [2]
The enduring lesson is not that every investment conversation is fraudulent or that digital assets are inherently untraceable. It is that trust, apparent expertise, account displays and actual control of money are separate things. These networks succeed by collapsing those distinctions. Public evidence through October 4, 2026 shows an industrial system connecting financial deception, coercive labour and cross-border services, while the record of convictions and recoveries shows both meaningful enforcement capability and the distance still separating a promising headline from a household made whole.
Sources
- FinCEN relationship-investment-scam reminder, February 26, 2025Official releaseBack to text: ↑1↑2
- FBI 2025 Internet Crime Report, pp. 20, 52–55 and Appendix C; inconsistent investment-loss figures on pp. 53 and 55Official source · PDFBack to text: ↑1↑2
- UN Geneva briefing, July 28, 2026: trafficking and regional scam-loss estimateSourceBack to text: ↑1↑2
- U.S. Treasury Funnull designation, May 29, 2025Official releaseBack to text: ↑1↑2
- FinCEN Alert FIN-2023-Alert005, September 8, 2023Official source · PDFBack to text: ↑1↑2↑3
- SEC NanoBit and CoinW6 complaint announcement, September 17, 2024Filing / reportBack to text: ↑
- FBI Operation Level Up explanation, 2025Official sourceBack to text: ↑
- FBI cryptocurrency investment fraud guide, reviewed October 4, 2026Official sourceBack to text: ↑1↑2
- Oak and Shafiq, qualitative interviews with 26 victims, March 2025Technical reportBack to text: ↑
- OHCHR A Wicked Problem report overview, February 20, 2026SourceBack to text: ↑
- OHCHR A Wicked Problem report, 2026; official indexed text of UN library copy (full PDF unavailable for this review)Source · PDFBack to text: ↑
- DOJ Xinbi seizure and $52 million restraint announcement, September 9, 2026Official sourceBack to text: ↑
- DOJ Jingliang Su sentencing, January 27, 2026Official sourceBack to text: ↑
- DOJ $225.3 million civil forfeiture complaint, June 18, 2025Official sourceBack to text: ↑
- DOJ Prince Group indictment and forfeiture action, October 14, 2025Official sourceBack to text: ↑
- U.S. Bankruptcy Court SDNY opinion, April 23, 2026, case 26-10769, document 38Official source · PDFBack to text: ↑
- DOJ Shan Hanes guilty plea, May 2024Official sourceBack to text: ↑
- DOJ restitution release, November 4, 2024; FHFA OIG copyOfficial source · PDFBack to text: ↑
- FinCEN Huione final rule announcement, October 14, 2025Official releaseBack to text: ↑
- FinCEN Huione finding and proposed rule, May 1, 2025Official releaseBack to text: ↑
- FinCEN H-Pay successor-entity proposed rule, June 23, 2026Official releaseBack to text: ↑
- FinCEN H-Pay proposal comment extension, July 22, 2026Official releaseBack to text: ↑
- DOJ Disruption Week results, June 3, 2026Official sourceBack to text: ↑
- FBI guidance for cryptocurrency scam victims, August 24, 2023Official sourceBack to text: ↑
- FBI warning on IC3 impersonation and recovery fraud, July 20, 2026Official sourceBack to text: ↑
- FBI liquidity-mining fraud alert, July 21, 2022Official sourceBack to text: ↑
- FinCEN Special Measures status table, reviewed October 4, 2026Official sourceBack to text: ↑
- Huione final rule, Federal Register, October 16, 2025; effective November 17, 2025Official sourceBack to text: ↑