Pig Butchering Investigations: Tracing the Operators Behind the Scam
Pig butchering is the largest category of cryptocurrency fraud reported to US federal agencies. The FBI's Internet Crime Complaint Center logged $5.8 billion in losses to these schemes in 2024, part of more than $9.3 billion in crypto fraud that year, up 66 per cent on 2023. Nearly a third of the losses came from victims over 60. Research at the University of Texas puts the true global figure above $75 billion, because most victims never report.
In October 2025 the scale became impossible to ignore. The US Department of Justice seized about 127,000 bitcoin, roughly $15 billion, from Chen Zhi, chairman of Cambodia's Prince Group. It was the largest forfeiture in US history, and the funds traced back to forced-labour scam compounds running pig butchering operations. Chen Zhi remains at large.
A note on language. Interpol now urges investigators to retire the term pig butchering in favour of romance baiting or crypto grooming, on the grounds that the older term shames the victim rather than the offender. The label matters less to the investigator than the pattern. And the pattern is consistent.
Every active case shares an ending. The funds get traced. They route through layered intermediary wallets, across chains, into networks of mule accounts. The on-chain investigation reaches within a few hops of the operator's control wallet. Then the trail stops.
That is not a weakness in current forensics. The operator has structured the laundering layer specifically to defeat on-chain attribution. Closing the gap needs a different source of data.
What is pig butchering, and why does the investigation pattern repeat?
The scheme is long-form social engineering. The operator builds trust with the victim over weeks or months through messaging apps, social platforms, and a fabricated relationship. The victim is introduced to what looks like a legitimate cryptocurrency trading platform. Deposits are accepted. Apparent returns are displayed inside the platform interface. Withdrawals are refused.
The infrastructure behind these schemes is industrial. Operators run multi-country call centres, increasingly staffed by trafficked and forced-labour workers held in compounds across Southeast Asia. The laundering network routes victim funds through dozens of intermediary wallets, swap protocols, and chain bridges, and finally into operator-controlled wallets built to leave no on-chain trace back to a real-world entity.
For the investigator, the attribution problem is the same in every case. The fund flow is recoverable. The operator at the top of the laundering tree is not, at least not from on-chain data alone.
What does the on-chain side of the investigation produce?
A great deal, and quickly. Starting from the victim's first deposit, blockchain analytics can map the immediate next-hop wallet, follow the layering pattern across consolidation wallets, and surface cluster signatures that suggest coordinated control across dozens or hundreds of wallets. Gas-fee patterns, contract-interaction sequences, and timing correlations all expose the operational consistency that ties the laundering network together.
The result is usually a clean map of the operator's laundering infrastructure across Ethereum, Tron, Bitcoin, and adjacent chains. That map is often enough to generate freeze orders against mule accounts at major exchanges before the funds reach the operator. For the recoverable portion of the case, this is real progress, and it is the work the established on-chain forensics platforms are built to handle.
The limit is at the top of the tree. The operator's wallet has been built to never touch a regulated exchange and never carry an on-chain link to a known entity. Tracing reaches it. Attribution stops there.
What is the structural limit of on-chain pig butchering investigation?
The operator's wallet was funded from a fresh wallet, which was funded from a mixer withdrawal, which traces back through a sequence that loops to itself. From a blockchain-analytics perspective, the operator wallet is a closed system. The clustering signature ties it to the laundering network, but the network is internally self-contained.
This is the moment the investigation changes shape. It stops being a fund-recovery exercise and becomes an operator-attribution problem. The two have very different success conditions. The first ends with funds frozen at exchanges. The second ends with a charging document and, ideally, an arrest in the jurisdiction where the operator lives. The Prince Group indictment is what the second outcome looks like when it is reached.
How does off-chain attribution continue the case?
A separate attribution layer does not depend on on-chain links between wallets. What matters for the investigator is that it persists even as actors change wallets, and it remains effective even when users attempt to mask their activity through commercial VPN infrastructure or other masking techniques.
So what is this data? It is not the blockchain, and it is not transaction data. It is a separate, off-chain class of attribution signal. We do not publish the specific signals, and that is deliberate. The people running these schemes read the same material investigators do, and a published method is a method they can work around. What we will describe is what the data does. It links wallets a single actor controls even when the chain shows no connection between them, it holds up when that actor routes through commercial VPN infrastructure, and it resolves to region-level attribution.
Pig butchering operators run their wallets the way they run the rest of the operation. Mule accounts, intermediary wallets, consolidation wallets, and operator wallets are handled by the same set of actors working from the same set of jurisdictions. That consistency is invisible on-chain once the operator breaks the transaction trail. Above the protocol, it is still there.
For pig butchering specifically, operator wallets that appear isolated on-chain can often be attributed through Spectra, Addressable Investigations’ off-chain attribution layer.
It connects wallets to real-world entities and produces leads and digital evidence: investigative starting points when the on-chain trail goes cold, and time-stamped records that hold up in legal proceedings. The region-level attribution that follows is what determines which jurisdiction the case moves into.
Freezing funds is an on-chain outcome. Reaching the point where a freeze is even possible, when the wallets involved show no on-chain connection to each other, is not. That is the part the off-chain layer supplied.
What does this look like in practice for an active case?
The workflow stays sequential and complementary to the tools already in the stack.
Blockchain analytics maps the laundering tree. The investigator identifies candidate operator wallets at the top of the network. Those wallets, and a sample of wallets one or two hops below them, are run through the off-chain attribution layer. A consistent attribution signal across operator-tier wallets establishes coordinated control. Region-level attribution narrows the jurisdiction. Together, those two outputs are what criminal investigation teams, token recovery firms, and asset-recovery counsel have used to move pig butchering cases from fund recovery toward operator attribution.
The two tracks run in parallel. Fund recovery happens through the on-chain analytics workflow. Operator attribution happens through the off-chain layer. Neither replaces the other.
How do operator-level cases close in 2026?
The cases that reach an operator share a pattern. Fund tracing handled by blockchain analytics. Entity attribution handled by exchange records where available, and by off-chain attribution where the on-chain trail does not reach. Region-level attribution used to narrow jurisdiction and route the legal process to the right agency.
An investigator working with one attribution layer has a partial picture. They can prove movement of funds. They cannot always prove who moved them. For prosecution, that gap is often the difference between a charge and a closed file. An investigator with both layers has a complete picture across the cases that matter most, the ones where the operator deliberately broke the on-chain trail.
Tracing victim funds is the part of pig butchering investigation that current tooling solves well. Identifying the operator running the network is the part that requires a second layer above the blockchain. That is the difference between recovering some money and closing the case.
