"Pig butchering" is the inside name for one of the largest crypto scam categories in the world. Attackers spend weeks or months building a romantic, friendly, or professional relationship with a victim, then walk them through what looks like a smart crypto investment, then drain the funds when the victim has been "fattened" enough for slaughter. The FBI logged 11.36 billion USD in crypto scam losses across 2025, with investment fraud (mostly pig butchering) accounting for 7.2 billion. The number went up 22% year-over-year. The first four months of 2026 brought the largest enforcement action in the scam's history. DOJ-led operations arrested 275-plus suspects and seized 701 million USD across compound takedowns. The scams kept growing anyway. This piece walks through how pig butchering scams operate, what the patterns look like, and what self-custody holders can do to make themselves harder targets.
The scam runs on a four-phase script. Phase 1: Contact. The attacker reaches out via dating app, social media DM, "wrong number" text message, or LinkedIn connection. The opening is harmless: a hello, a wrong-number apology, a compliment that turns into a conversation. The contact channel is usually one where unsolicited messages are normal enough to slip past the victim's filters. Phase 2: Trust building. Over weeks or months, the attacker builds what looks like a real relationship. They share photos (usually stolen or AI-generated), discuss daily life, send voice notes, occasionally talk on video calls. The pattern reads as a close friendship or romance, and victims often describe the attacker as one of the closest people in their life by the time the scam pivots. Phase 3: The introduction. The attacker mentions, casually, that they make money trading crypto on a platform that's been good to them. The platform looks legitimate: clean UI, professional branding, fake trading dashboards showing the attacker's gains. The victim is invited to try it with a small deposit. The platform shows the victim's deposit appreciating quickly, with the attacker congratulating them and suggesting larger deposits. Phase 4: The slaughter. When the victim has deposited enough (sometimes their entire savings, sometimes loans they took out to invest more), the platform either refuses withdrawals, "freezes" the account, or demands additional taxes and fees to release the funds. Each additional payment goes to the attacker. The funds the victim "deposited" never existed as live crypto positions; the platform was a front, and the crypto was moved out to attacker wallets the moment it arrived.
The mistake people make about pig butchering is assuming the victims are gullible. They aren't. The victim base skews professional, often financially sophisticated, and includes engineers, doctors, executives, and crypto-experienced traders. The scam works because of three structural features. The contact looks normal. A wrong-number text or a casual dating app match doesn't trigger anyone's scam alarm. The relationship feels authentic to the victim. Months of conversation produces emotional investment, even when the attacker is a script-following call-center worker. The victim doesn't experience the relationship as transactional. The platform looks like crypto. The fake trading dashboards are sophisticated enough to fool people who know what established crypto platforms look like. The fake balance updates use accurate market data, the UI mimics well-known venues, and the withdrawal flow works for small amounts to build trust before the scam pivots.
AI tools made the scam scale faster and lowered the cost per victim. Generative dating profiles. Attackers spin up convincing dating-app profiles with AI-generated photos and bios. The cost dropped enough that running thousands of profiles simultaneously is feasible. LLM-driven conversation. Earlier pig butchering operations needed a human at the keyboard for the weeks-long trust-building phase, with each operator handling maybe 5-10 victims at once. LLMs handle the routine conversation, freeing operators to focus on the closing. Each operator can now handle 30-50 victims in parallel. Voice cloning. When the relationship escalates to phone or video, voice cloning lets the operator sound like the photo they've been sending. The escalation step used to be where many scams broke down. With cloning, it doesn't anymore. Chainalysis reported impersonation scams growing more than 1,400% year over year, with AI tools driving most of the growth.
A few patterns recur across nearly every pig butchering case. The platform isn't one you've heard of. Established crypto platforms have years of history, public coverage, and reputational track records. The fake ones don't appear on Google before late 2025. The "advisor" never appeared in your life before the relationship started. Anyone you met on a dating app, through a wrong-number text, or via cold LinkedIn DM who then suggests a crypto investment is running the script. Returns are improbable. A platform showing 5-10% daily returns isn't trading crypto; it's running a Ponzi-shaped front for the scam. Withdrawals get harder as deposits grow. Small early withdrawals work. Larger ones get blocked, taxed, or "frozen pending verification." That's the slaughter. Pressure to move faster. As the victim grows skeptical, the script applies social pressure: the deal closes soon, the bonus tier ends Friday, the attacker's account got bigger this week. Legitimate opportunities don't run on this kind of urgency.
Self-custody doesn't directly prevent pig butchering, because the victim authorizes every transaction with their own keys. The scam works against custodial users and self-custody users alike. What self-custody does change is the recovery picture. When the scam lands and the funds are gone, custodial users sometimes have a path through the exchange's fraud team. Self-custody users don't. The funds left to an attacker address aren't coming back through any vendor process. The structural defense is operational. Verify any crypto investment opportunity against multiple known-good sources before committing funds. Treat any new platform with skepticism that scales with the deposit size. Run any potential trading platform through a check with a trusted friend or family member who isn't part of the conversation. For larger holders, an extra layer helps: a hardware wallet sets up enough friction that fraudulent withdrawals require deliberate action. Drainer scripts that automatically pull funds from a software wallet don't work against a hardware wallet that requires a button press to sign.
Older holders are disproportionately affected. The FBI's 2025 data showed people aged 60 and above lost 7.7 billion USD to investment scams, with pig butchering accounting for most of that. The scam exploits social isolation, retirement-age financial anxiety, and unfamiliarity with how crypto platforms operate. For families with elderly relatives holding crypto, the conversation worth having is about what kinds of investment opportunities are realistic and what scripts to watch for. The scams are loud once you know the patterns.
The first four months of 2026 produced more pig butchering enforcement than the entire previous decade. Operation Level Up, a proactive notification program run by the FBI and Secret Service, notified 8,935 victims and saved an estimated 562 million USD before the funds left the country. The April 2026 international operation arrested 275-plus suspects across nine compounds, mostly in Southeast Asia where the scam operations are physically based. Recovery rates after the funds leave a compound are still low. Prevention remains the strongest defense.
Ryder One doesn't prevent the social-engineering side of pig butchering scams, though it does change the texture of any single transaction the holder is asked to make. Every transaction verifies on the device's 1.6-inch AMOLED touchscreen, with the physical button wired directly to the EAL6+ secure element. The friction of "tap the device, read the address, press the button to sign" is the friction that breaks the script-driven momentum of a pig butchering close. TapSafe Recovery handles the backup question independently: 50% on the Recovery Tag, 50% in your phone's iCloud or Google Drive backup, optional 25% per Recovery Contact for the people you trust.
Add friction the scam script can't bypass. Ryder One requires a physical button press on the device for every transaction, on a screen the host machine can't draw to. The pig butchering close depends on momentum, which the device interrupts at the moment of signing. See how it works.
The only crypto wallet you can install on a crowded subway.
Set it up in less than 60 seconds and just tap your phone to send, swap, and recover.
Share: