The FBI's Internet Crime Complaint Center reported $4.4 billion in pig butchering losses for 2025, and the 2026 projection running through Q2 is on pace to match or exceed it. Pig butchering — the term for long-running romance + investment scams that target individual victims over weeks or months — has become the single largest category of crypto fraud by dollar volume. The losses per victim are larger than any other scam type, often running into six figures.
The pattern is consistent. The fix is also consistent, and it runs through one specific behavioral habit that, applied early, makes the scam impossible to land.
This piece walks through how pig butchering works in 2026, why the losses are so large compared to other scams, the single habit that disrupts the attack, and the structural ways self-custody users can protect against it.
The attack has four phases. The whole cycle takes weeks, sometimes months, which is what makes it different from other crypto scams.
Phase 1: Contact. The victim is approached on a dating app, social media, or messaging platform. The opener is often a wrong number ("Sorry, I think I have the wrong contact — are you Mark?") that turns into a friendly conversation. Alternatively: a match on Tinder, Hinge, or LinkedIn that proceeds normally for days or weeks.
Phase 2: Trust building. The attacker (almost always a team operating dozens of conversations in parallel from facilities in Southeast Asia) builds a relationship. Long daily conversations, photos, voice notes, sometimes video calls (often deepfaked). The victim believes they're in a developing romantic or close friendship.
Phase 3: Investment pitch. The attacker mentions a crypto investment opportunity — a "private trading platform," an "insider tip on a new token," a "guaranteed returns" arrangement. The victim is invited to invest a small amount first. The fake platform shows fake returns. The victim is encouraged to invest more.
Phase 4: The drain. When the victim's investment reaches a meaningful size — or when the victim tries to withdraw — the fake platform either disappears, demands additional fees (which the victim pays), or simply blocks the account. The funds are gone.
The total cycle is weeks to months. The cumulative losses are large because the victim believes the relationship and the platform are real for the entire duration.
Three structural reasons that distinguish pig butchering from other crypto scams.
The relationship makes refusal hard. A one-off phishing text is easy to ignore. A weeks-long relationship with someone who feels like a real connection is much harder to walk away from, especially when that person is asking for help with a financial decision.
The fake returns are designed to anchor expectations. When a victim invests $500 and the fake platform shows the position growing to $750, they believe the returns are real. Re-investing larger amounts at that point feels rational.
The withdrawal phase is engineered for sunk-cost escalation. When the victim tries to withdraw and the platform demands a "tax payment" or "verification fee," paying that fee feels like the path to recovering the funds. So the victim pays more. Sometimes multiple times.
The 2025 IC3 data showed an average pig butchering loss per victim of approximately $200,000, with the largest individual cases exceeding $5 million.
The attack relies on the victim never independently verifying the investment platform or the person they're talking to. Every part of the scam works if the victim trusts what they're being told and doesn't check.
The habit: when anyone you've met online asks you to send money or invest in crypto, treat the request as a phishing attempt. Not "be skeptical." Not "ask questions." Treat the request as already-confirmed fraud until you can verify the person and the platform through a separate, independent channel.
What that looks like in practice:
The single habit isn't "don't trust online relationships." It's "verify any financial request through a separate channel before sending any money."
Pig butchering doesn't target your hardware wallet directly. It targets the off-ramp — the moment when funds leave self-custody and go to a fake platform.
A holder with $500K on a hardware wallet is in self-custody. The hardware wallet is safe. The vulnerability is in the decision to move funds from the hardware wallet to a fake platform's deposit address. Once that on-chain transaction is signed and broadcast, the funds are gone. Self-custody doesn't reverse on-chain transactions.
The protection runs through:
The 2025 IC3 report and the 2026 mid-year update both indicate growing law enforcement focus on pig butchering. Multiple high-profile prosecutions occurred in 2025 and 2026, with assets seized in Cambodia, Myanmar, and the Philippines (the operational bases for many of the rings).
Recovery rates remain low. The 2025 IC3 data showed roughly 4% of pig butchering losses recovered through legal channels. Prevention is structurally more cost-effective than recovery.
Ryder One doesn't prevent pig butchering directly — no hardware wallet can prevent the holder from voluntarily sending funds to a destination they trust. What Ryder One does is enforce friction at the moment of action: every transaction requires the device, the app, the destination address shown on the 1.6-inch AMOLED touchscreen, and a physical button press. That friction creates space to verify before sending.
TapSafe Recovery handles the backup so a single failure doesn't take the wallet down — which matters because pig butchering victims often try to withdraw funds from their hardware wallet under emotional pressure, and a fragile backup creates additional risk.
Pig butchering accounted for $4.4 billion in US losses in 2025, and the 2026 numbers are tracking similarly. The attack works because it builds a real-feeling relationship over weeks before introducing the financial ask, which makes refusal psychologically difficult. The single habit that disrupts the attack is treating any online-introduced financial request as fraud until verified through a separate channel. For self-custody users, the protection runs through verifying destination addresses on the device and compartmentalizing long-term wallets away from anything a pig butchering target might be encouraged to send.
Self-custody, with the friction that gives you time to verify. Ryder One shows every destination address on a 1.6-inch AMOLED touchscreen, requires a physical button press, and pauses you at the moment that matters. See how it works.
SEO
The only crypto wallet you can install on a crowded subway.
Set it up in less than 60 seconds and just tap your phone to send, swap, and recover.
Share: