Pig butchering: FATF traces $100 million of victims' money into a single scam compound

Pig butchering is a crypto fraud in which scammers fake a friendship or romance over several weeks and then steer their victim onto a fake trading platform until all their savings have been paid in. The name comes from Chinese and translates as “pig butchering”: the victim is first “fattened”, then “slaughtered”. On November 5, 2026 the Financial Action Task Force published a report finding that a single wallet cluster linked to one scam compound had taken in more than $100 million of victims' money.

For investors in Germany this is no distant problem. Payment is almost always made in crypto, usually stablecoins or bitcoin, because transfers on the blockchain cannot be reversed. Anyone who knows how the scheme unfolds will spot it long before the first euro lands on a stranger's platform. This guide explains the phases, the warning signs and the steps open to victims under German law.

What is pig butchering? The term and the scam behind it

Pig butchering combines two well-known types of fraud: romance fraud and investment fraud. In a classic romance scam, the fraudsters invent an emergency, such as an illness or luggage held at customs, and ask for money. In pig butchering they fake no money troubles. Instead they present themselves as successful, wealthy and generous, and offer to share their supposed knowledge of crypto investing.

Investigators in Germany usually speak of “trading scams” or cyber trading fraud. The Bavarian Ministry of Justice described the method in March 2024 as follows: the scammers first build an emotional bond, then persuade their victims to invest in crypto on fake trading platforms or apps. In the end both the money and the relationship are gone.

A wallet cluster is a group of crypto addresses that analysts attribute to the same person or organisation on the basis of shared transactions. Clusters of this kind are what make the flow of money in pig butchering visible, even when the perpetrators themselves remain anonymous.

FATF report of November 5, 2026: $100 million in a single wallet cluster

The FATF is the international body that sets global standards against money laundering; Germany is a member. Its new report, “Combating End-to-End Illicit Financial Flows Linked to Scam Compounds”, follows the plenary meeting of October 28 to 30, 2026 and traces the money from the victim's account to the point where it reappears as apparently clean wealth.

The key findings, as published by the FATF and consistently reported by specialist media:

• Blockchain analysis traced more than $100 million in victims' deposits into a single wallet cluster connected to a scam compound.
• The FATF estimates the annual losses caused by such scam compounds in the tens of billions of US dollars, with victims in more than 100 countries.
• The report treats crypto as a central channel for money laundering. A new element is the role of in-house OTC desks inside the compounds, through which stolen coins are exchanged without a regulated exchange.
• The FATF calls for faster cross-border action, better information sharing between authorities and an approach that puts victims first. This explicitly includes people trafficked into the compounds.

An OTC desk (“over the counter”) is a trading venue outside an exchange where large sums change hands directly between two parties. It appeals to criminals because identity checks often do not take place there.

The four phases of pig butchering: contact, trust, fattening, slaughter

Phase 1: the chance contact

Almost every case begins with a message that looks like a mistake: a misdirected text, a “Hi, is this still Anna's number?” on WhatsApp or a match on a dating app. Social media platforms, business networks and groups about sport or travel also serve as entry points. The profile shows an attractive person with a good job, plenty of travel and expensive hobbies.

Phase 2: building trust

For days and weeks the scammers write every day, ask about daily life and send photos of meals and workouts. The conversation quickly moves to an encrypted messenger. Money plays no part in this phase. That is exactly what makes the trust-building so effective: someone who is not asked for money does not feel threatened.

Phase 3: fattening

At some point the contact casually mentions their crypto gains, often citing an uncle or mentor with “insider knowledge”. The victim is encouraged to try it, starting with small amounts. The platform shows profits straight away, and a first small withdrawal actually works. That payout is part of the game, because it removes the last doubts.

Phase 4: slaughter

After that the deposits grow. The scammers push a “limited-time offer” or a minimum amount for a VIP account. When the victim finally wants to withdraw, the platform demands taxes, fees or a deposit to “release” the funds. Whoever pays receives new demands. In the end the profile disappears and the platform can no longer be reached.

Fake trading platforms: why the balance in the app is just a number

The platforms look professional, with price charts, an order book and customer support in a chat window. Technically, though, they are only a front end. The money you deposit does not land in a trading account but goes straight to wallet addresses controlled by the scammers. The balance in the app is a number in a database that the operator can change at will.

The scammers often use names that resemble real exchanges, or copy their design. A listing in an app store proves nothing either. The only reliable test is whether a provider holds a licence from a supervisor. Since MiCA, the EU's Markets in Crypto-Assets regulation, crypto service providers in the EU need authorisation. Which exchanges have it is shown in our comparison of regulated crypto exchanges, and the obligations attached to a licence are set out in the MiCA rules themselves.

A particular favourite with the scammers is the stablecoin Tether (USDT), because it holds steady against the dollar and moves quickly across low-fee networks. For victims, that means a USDT transfer to a stranger's address is effectively final.

Scam compounds in Southeast Asia: fraud factories built on human trafficking

In most cases the chat partner is a front for an organised crime operation, rarely a single person. The FATF describes scam compounds as sealed-off sites where gangs run the fraud with a division of labour: some write the messages, others build the platforms, others again launder the money. The compounds are concentrated in Southeast Asia, but the report also finds them in Africa, Europe and the Americas.

Many of the people typing messages there are victims themselves. A large share were lured with fake job offers and are forced to work. As early as 2024 the Bavarian Ministry of Justice cited an analysis by the United Nations Office on Drugs and Crime, according to which syndicates using this scheme took between $7.5 billion and $12.5 billion in a single country of the Mekong region alone.

For the criminals the effort is small. A script for the conversations, stolen photos for the profile and a copied trading interface are enough. AI tools increasingly help with translation, images and even video calls; how this changes fraud patterns is described in our article on AI-assisted crypto crime.

Warning signs of crypto investment fraud in the chat and on the platform

None of these signs proves fraud on its own. If several come together, you should break off all further contact.

• The contact came out of nowhere: a stranger messages you, apparently by mistake, and keeps the conversation going anyway.
• No meeting, no spontaneous video call: there is always a reason why a meeting is not possible right now. Video calls are short, shaky or drop out.
• The conversation changes apps: from the dating app or social media it moves quickly to WhatsApp, Telegram or another messenger.
• Money comes up late, but it does come up: after weeks without any talk of money, success stories about crypto investments suddenly appear.
• An unknown platform: you are told to use a particular app or website you had never heard of and to send crypto there.
• Guaranteed profits: high returns without risk, “signals” from a mentor, a bonus for a larger deposit.
• Fees before a withdrawal: if you have to pay taxes or a deposit before you can access your own money, it is already lost. Reputable exchanges deduct fees from the balance.
• Pressure and secrecy: you are told not to tell anyone, because family or the bank “wouldn't understand”.

A simple cross-check almost always helps. Enter the platform's name in BaFin's company database and search for it in the MiCA register of the European Securities and Markets Authority, ESMA. If it does not appear there, it may not offer you crypto services in Germany.

Pig butchering in Germany: figures from the Bavarian cybercrime office and Operation Herakles

There are no nationwide figures for pig butchering alone, because the police record the cases as investment fraud or cyber trading fraud. Individual authorities have published data, however. According to the Bavarian Ministry of Justice in March 2024, the Central Office for Cybercrime Bavaria (ZCB) had received around 370 complaints since 2021, involving some 330 different platforms. The total reported loss was about €29 million, the average loss per case just under €80,000. The ministry noted that many victims do not file a complaint out of shame.

The heaviest blow against the infrastructure was struck by the authorities in Baden-Württemberg. According to a joint statement of September 25, 2026 by the Karlsruhe Public Prosecutor General's Office, the Baden-Württemberg State Criminal Police Office, BaFin and the Federal Network Agency, Operation Herakles switched off 9,304 German phone numbers used for cyber trading fraud within three months. Since the operation began, the total stands at 13,888 numbers, 13,397 of them German. As early as 2025 the investigators had taken more than 2,200 domains of fraudulent platforms offline.

In the same statement the authorities involved set out their advice: examine platforms closely before signing up, do not let yourself be pressured, never hand over login details or copies of your ID or bank cards, have offers checked by a consumer advice centre or an independent adviser, and report the crime if you have been defrauded. BaFin points out that providers of financial services in Germany generally need a licence.

Pig butchering victims: police report, evidence and the role of the crypto exchange

Anyone who realises they have been defrauded should act at once and not feel ashamed. The perpetrators are professionals working with tried and tested scripts. This order makes sense:

1. No further payments: not even for supposed withdrawal fees, taxes or lawyers recommended by the platform.
2. Secure the evidence: export the chat logs, take screenshots of the profile and the platform, note all transaction IDs and wallet addresses, and keep the bank's transfer receipts. Delete nothing, however painful it is.
3. Inform your bank and exchange: if you paid by bank transfer to a crypto exchange, report the case there and to your bank. Exchanges can freeze accounts if coins still arrive there.
4. File a criminal complaint: at any police station or through the online police services of the German states. The wallet addresses help investigators follow the money on the blockchain.
5. Secure your access: if you installed remote-access software or shared data, change your passwords and have your device checked. With your identity, scammers can open further accounts.

The chances of getting money back are slim, but not zero. If coins land at a regulated exchange, investigators can have them frozen there. The sooner the complaint is filed, the more likely it is to reach that point in time. Because a fraud loss can also have tax consequences, keep all the records at least until your next tax return.

Recovery scams after pig butchering: the second wave after the first loss

Many victims face a second attack shortly after their loss. Supposed lawyers, investigators or “recovery firms” get in touch and promise to retrieve the money, in return for an upfront payment. The contacts often come from the same organisation that committed the first fraud, which is why they know names, amounts and the platform.

Reputable law firms and authorities do not charge fees in crypto, do not guarantee repayment and do not get in touch unprompted. How the scheme works in practice and how to spot it is shown in our guide to crypto recovery scams.

Protection against pig butchering: three checks before the first deposit

Pig butchering works because trust grows faster than suspicion. Three fixed rules take away the scammers' most important lever, however convincing the story sounds:

1. Trade only with licensed providers: buy and sell crypto exclusively at exchanges with a MiCA licence or BaFin authorisation that you found yourself, never through a link from a chat. A selection is listed in our comparison of regulated crypto exchanges.
2. Hold your coins yourself, check addresses yourself: anyone who keeps their coins in their own wallet will not casually send them to a stranger's platform. Which devices are suitable is shown in our hardware wallet comparison.
3. Document every transaction: a portfolio tracker records deposits, withdrawals and wallet addresses. That helps with tax and, in the worst case, with the police report. Suitable tools are listed in our comparison of tax tools and portfolio trackers.

And the most important rule comes before all three: someone who gets to know you online and recommends an investment after a few weeks is, with very high probability, not a friend.

(As of November 10, 2026. This article is not investment advice. Prices and fee structures change; check the terms with the provider before you buy.)