Pig Butchering: The Scam That Starts With a Friendly Message

The costliest crypto scam of all does not open with a wallet or a link. It opens with “good morning.” This is a deep dive into the pig butchering scam, also called romance baiting, the fraud that grooms victims for months before a single coin moves, told through its three stages and three real cases, with the checks that break it at every step. Part of Know the Scam by SimpleSwap.

Almost every warning about crypto fraud tells you to watch your wallet. This one asks you to watch your inbox, because the most expensive scam in the category never starts with crypto. It starts with a stranger who is kind to you.

That is the entire reason this page exists. A scam you can name is a scam you can spot, and this particular one runs for weeks in plain sight before anyone calls it by its name.

It has an ugly one, “pig butchering,” from the Chinese slang sha zhu pan: the victim is “fattened” with affection and attention, then “slaughtered” when the accounts are drained. Investigators increasingly prefer “romance baiting,” partly because the older name reads as contempt for people who were, in fact, targeted by industrial-scale manipulation.

Whatever you call it, it is the same machine, and it is enormous. Investment fraud of this kind is the single largest category of reported crypto losses, and the operations behind it run out of forced-labor compounds in Southeast Asia that, by one estimate, move tens of millions of dollars a day.

SimpleSwap publishes this as part of our security series for a practical reason: victims are often told to buy crypto through a legitimate exchange before sending it to the fake platform, which means an ordinary swap can end up as one step in someone else’s fraud chain. It is also the step where the loss becomes permanent. We would rather explain the whole machine than the last lever of it.

Where it comes from, and why the name

The scheme took shape in China in the late 2010s and scaled worldwide during the pandemic, when isolation and screen time did the recruiting. The structure has barely changed since then because it works: it does not attack your software; it attacks your loneliness, your optimism, and your ordinary wish to trust someone who seems to trust you.

That is the reframe worth holding onto for the rest of this piece. The people who lose to this are not careless. The scheme is engineered so that the warm, human, correct-looking response, answering someone nice to you, is the first step of the trap. A professional banker fell for it. So could most people having a hard month.

The three stages

Romance baiting runs on a timeline. Knowing its shape is most of the defence, because each stage has a tell.

Stage 1. The approach

Contact arrives from nowhere: a match on a dating app, a friendly Facebook message, or a text that seems misdirected (“Hi, is this Jenny?”). The “wrong number” that turns into a conversation is not a mistake. It is the opening move.

The profile is flawless by design. An attractive photo, a successful career, a life lived across a few glamorous cities. It is polished because it is bait, and often because the photo belongs to someone else entirely.

The tell: unsolicited contact that quickly wants to keep talking. A stranger who texted the wrong number and then stayed is running a script.

Stage 2. The fattening

This is the patient part, and the reason the scam is so devastating. For weeks, sometimes months, there are daily messages, real interest, steady affection. A “good morning” every day. Genuine-feeling intimacy, built deliberately.

One thing never happens: a meeting. There is always a reason: a business trip, a visa problem, a project overseas, and always a plausible excuse to avoid a live video call. Then, casually, the money enters the conversation, never as a pitch, always as a confidence shared between people who care about each other: “My uncle in Hong Kong showed me this platform. I do quite well on it.”

The tell: someone who finds a reason, for weeks, never to meet you and never to appear live on camera. Affection with no presence behind it is a costume.

Stage 3. The slaughter

Now the victim is guided to a fake exchange or investment app. The first small deposit shows a fantastic return. The numbers on the screen climb, because the operators simply type whatever numbers they like. Encouraged, the victim invests more, and often far more: retirement accounts drained, second mortgages taken out on paid-off homes.

At the peak, the trap closes. The account is “frozen,” and unlocking it requires yet another payment, a tax, a fee, a deposit to release the funds. Then the platform vanishes. The partner vanishes. The money, which was never invested, is already gone.

The tell: profits that exist only inside an app nobody else can verify, and any demand for a new payment to withdraw money that is supposedly already yours.

Why it is the most expensive scam there is

Two forces make the pig butchering scam uniquely costly. The first is industrial scale: these are not lone con artists but staffed operations, run from compounds where trafficked workers follow scripts, which is why the same story reaches thousands of targets at once. The second is that the emotional groundwork is laid so far in advance of any money that the victim’s defenses were disarmed on an entirely different axis than the one being attacked.

And there is a technical reason the money never comes back, which is where our side of the industry has to be honest about its limits.

That is the crux. By the time value moves, there is nothing left to detect. The defense has to happen in the conversation, long before it ever becomes a transfer.

What it looks like in real life

Three cases, chosen because together they show the whole range: the operators, the damage, and the human cost.

The industry. On February 9, 2026, a California federal court sentenced Daren Li, a 42-year-old dual national, to 20 years in prison in absentia for helping launder more than $73 million stolen from Americans through a romance-baiting network run out of Cambodia. He had already fled, cutting off his ankle monitor in December. The detail that matters most for scale: investigators found more than $341 million in a single wallet tied to the laundering ring. This is a business, not a series of accidents.

The reach. Shan Hanes was the CEO of Heartland Tri-State Bank in Kansas, a financial professional by trade. Caught in a pig-butchering scheme in 2023, he began wiring money to “unlock” his supposed returns, and over roughly eight weeks he moved $47 million of the bank’s funds to the scammers. The bank collapsed. He was sentenced to more than 24 years, one of the longest white-collar sentences in the state’s history. If a bank CEO can be walked step by step into destroying his own institution, “I would never fall for that” is not the protection people think it is.

The cost. Margaret Loke, a 71-year-old widow in San Jose, was introduced to a man calling himself “Ed” on Facebook in May 2025. Months of daily affection followed, then the investment. She lost close to $1 million, including her entire IRA and a $300,000 second mortgage on a home she had already paid off. What finally broke the spell was mundane and a little haunting: she described the situation to an AI chatbot, which told her plainly that it was a scam and that she should go to the police. She did. But the money had already reached a bank account in Malaysia, and confirmed transfers do not come back. The tool that saw through it in seconds arrived after the one step that could not be undone.

Where this meets your swap

Here is the uncomfortable intersection, and the reason a swap service has any standing to write about romance. Victims are frequently coached to buy real cryptocurrency through legitimate services and then move it to the fake platform. That places honest infrastructure in the middle of a dishonest route, at the exact moment the loss becomes permanent.

We cannot see the eight weeks’ worth of messages, and, as Rick’s point makes clear, the transfer itself looks ordinary to us. What we can do is be the opposite of the fake platform: a service that tells you plainly a confirmed transfer cannot be reversed by anyone, that never promises guaranteed returns, and that would rather you recognize the pattern here than send a coin you can’t call back.

If you take one thing from this page, let it be that recognition must happen before the send button, because nothing after it can help.

How to protect yourself and the people you love

Six checks, each aimed at a specific stage of the timeline.

A “wrong number” text is not a wrong number. If a stranger messages you supposedly by mistake and then tries to keep the conversation going, block and move on. That is the opening move, not a coincidence.

Love without a meeting is not love if someone spends weeks finding reasons never to meet and never to appear on a live video call, not a pre-recorded clip. Treat it as a red flag regardless of how real the feelings seem.

Investment advice from someone you met online is always a no. Legitimate brokers do not find clients through dating apps. The moment a new romantic interest introduces a “unique platform,” the romance was the setup.

Reverse-search the photos. Drop the person’s profile picture into Google Images or TinEye. Most scam profiles reuse stolen photos, and the search will often show you who they really belong to.

Never send crypto to someone you have not met. Treat this as absolute. A crypto transaction is irreversible. Once the money is gone, it is gone, and no service, ours included, can bring it back.

Share these with the people in your life who are most exposed, especially older relatives who are more likely to be targeted and less likely to hear about the scheme any other way. This is one of the rare scams in which a single forwarded message can prevent a life-altering loss.

The takeaway

Romance baiting is the most expensive scam in crypto precisely because it does not look like a crypto scam. It looks like companionship.

The crypto only appears at the end as the mechanism that makes the theft permanent, which is why every check that matters happens in the weeks before the first transfer, not after. The blockchain cannot see the manipulation. The people around a target usually can, if they know what to look for.

What comes next

Each entry above will get its own breakdown in “Know the Scam by SimpleSwap” over the coming months. Follow #KnowTheScam to catch every new one as it drops – phishing kits, fake support DMs, drainer contracts, the whole map: new scam, same hashtag, one place to check.