Pig Butchering in 2026: Crypto Phishing’s Forced-Labor Factory

On 14 October 2025, the United States announced the largest forfeiture in the history of its Justice Department: roughly 127,000 bitcoin, worth about $15 billion, pulled out of wallets tied to a Cambodian conglomerate called the Prince Group. The headline number was staggering, but the detail that mattered for anyone who holds crypto was buried in the indictment. The money did not come from a smart-contract exploit, a bridge hack, or a leaked private key. It came from thousands of ordinary people who were talked, over weeks and months, into sending their savings to a stranger they had learned to trust.

This is pig butchering, and in 2026 it is the most profitable phishing campaign in crypto. It does not look like the wallet-drainer phishing HOGE Wire has tracked all year, the malicious signatures and approval prompts that empty a wallet in one click. It is slower, more patient, and far more lucrative, and it is run less like a software operation than a factory. The lures are written by hand, the fake trading apps are maintained by teams, and the people typing the messages are often themselves victims, trafficked into walled compounds in Myanmar, Cambodia, and Laos and forced to scam under threat of violence.

The $15 Billion Phish

The Prince Group case is the clearest window yet into how big this has become. Prosecutors in the Eastern District of New York charged Chen Zhi, the 38-year-old founder and chairman of the Phnom Penh-based Prince Holding Group, with wire-fraud conspiracy and money-laundering conspiracy, accusing him of running forced-labor compounds in Cambodia where trafficked workers ran fake crypto investment scams against victims in the United States and around the world. Chen, who also uses the name Vincent, remains at large. According to CNBC, the government seized about $15 billion in bitcoin in connection with the scheme, the single largest forfeiture action it has ever brought.

The language from Washington was unusually blunt. Attorney General Pamela Bondi and Deputy Attorney General Todd Blanche said in a joint statement that “by dismantling a criminal empire built on forced labor and deception, we are sending a clear message that the United States will use every tool at its disposal to defend victims, recover stolen assets and bring to justice those who exploit the vulnerable for profit,” as reported by CBS News. FBI Director Kash Patel described a defendant who allegedly “operated a vast criminal network across multiple continents involving forced labor, money laundering, investment schemes, and stolen assets.” Court filings described the compounds as violent, forced-labor camps built around vast dormitories ringed by high walls and barbed wire.

The same day, the US Treasury’s Office of Foreign Assets Control sanctioned scores of people and companies linked to the Prince Group, and the United Kingdom imposed its own sanctions and froze luxury property in London. It was the kind of takedown usually reserved for cartels, and the framing is deliberate: US officials now treat the scam-compound economy as organized crime on a national-security scale rather than as isolated fraud.

What Pig Butchering Really Means

The term is a translation of the Chinese phrase sha zhu pan, literally “pig-butchering plate.” The metaphor is cold and precise: the victim is the pig, and the scammer’s job is to fatten it before the slaughter. Fattening means building a relationship, often romantic, sometimes just a warm friendship, and seeding it with the idea that the victim can get rich through crypto trading on a platform the scammer happens to know. The slaughter is the moment the victim has put in as much as they possibly can, at which point the money and the person both vanish.

The phrase began in Chinese fraud circles and spread as the scam industrialized across Southeast Asia, and the cruelty of the name is part of the point. To the operators, the victim is livestock: not a person to be robbed once, but an asset to be raised, measured, and harvested for everything it is worth. That mindset explains why these cons feel so personal to the people caught in them. The scammer is not improvising; they are following a documented playbook, sometimes from a printed manual, with shift managers reviewing their quotas and numbers.

What separates pig butchering from the classic drainer phishing is time. A wallet drainer needs a single careless signature. A pig-butchering operation invests weeks or months in one target, which is exactly why the average loss is so high and why the operators are willing to pay for staff, scripts, and infrastructure to run it at scale. It is a confidence trick with the patience of a salesman and the backing of organized crime.

It is also why the category keeps growing while narrow wallet-drainer losses fall. On-chain wallet-drainer phishing, the one-click kind, fell sharply in 2025, even as the broader scam economy surged the other way. Chainalysis estimated that crypto scams brought in roughly $17 billion in 2025, with impersonation scams up about 1,400 percent year over year and the average payment jumping from $782 to $2,764, according to its 2026 Crypto Crime Report. Pig butchering sits at the center of that shift: fewer, better-targeted cons extracting far more per victim.

The Script: From Wrong Number to Slaughter

The first message almost never mentions money. It is a wrong number, a friendly hello on a dating app, a networking request, or a reply to a post. According to the FBI, scammers typically open with a text that looks misdialed or a cold introduction on social media, then invest real effort in a relationship before any investment is ever raised. The conversation moves quickly off the original platform and onto an encrypted messenger, where there is no moderation and no record.

Only once trust is built does the opportunity appear. The scammer mentions how well they are doing in crypto, shows screenshots, and offers to help. The victim is steered to a slick trading site or app that looks like a real exchange and displays live charts, a personal dashboard, and a balance that climbs with every deposit. Crucially, early withdrawals often work. A victim who deposits a small amount and successfully pulls out a profit becomes convinced the platform is legitimate, and then deposits far more. When they try to cash out the larger balance, the withdrawal is blocked and a new obstacle appears: a tax, a fee, a minimum balance, a verification deposit. Each one is designed to extract a little more before the victim realizes there was never any money to withdraw at all.

Why a Romance Scam Is a Phishing Campaign

It is tempting to file pig butchering under romance fraud and move on. That misses what it has become. The fake platform is a phishing site in the most literal sense: a counterfeit front end that harvests money and, increasingly, wallet access. Some operations simply collect deposits to an address they control. Others push the victim to connect a self-custody wallet and sign a transaction, at which point the con merges with the approval-phishing and wallet-drainer techniques that empty self-custody wallets elsewhere in the phishing economy. A victim who thinks they are enabling trading is often granting a token allowance or signing a transfer.

The fake platforms are not crude. Many are polished web apps and even native mobile apps that have slipped briefly into the Apple and Google stores before being pulled. They quote live prices, generate fake profit-and-loss statements, and let the victim log in day after day to watch a balance that exists only in a database. The experience is engineered to defeat the instinct that would stop a one-click drainer phish, because nothing feels stolen until the very end. If you have ever wondered why so many crypto bets quietly lose money, the pig-butchering platform is the weaponized extreme: a market rigged down to the last candle.

This is also why the defensive tools that work against drainers only go so far. Transaction simulation and clear signing can flag a malicious approval, but they cannot flag a bank wire to a real exchange that the victim then forwards to a scammer. The weak point is not the wallet; it is the human on the other end of a three-month conversation. That makes pig butchering a cousin of the infostealer epidemic, where the theft also happens off to the side of the blockchain rather than through it.

The Factory Floor: Compounds, Barbed Wire, and Forced Labor

The reason pig butchering scaled from a cottage fraud into a multibillion-dollar industry is the compound. These are not scattered individuals working from laptops. They are purpose-built office parks, often converted casinos or half-finished real-estate projects, in lawless border zones such as KK Park and Shwe Kokko in Myanmar and the casino districts of Sihanoukville and Poipet in Cambodia. Inside, thousands of workers sit in shifts at rows of phones, each managing several fake personas and several victims at once.

Many of those workers did not choose to be there. The United Nations human-rights office warned as early as 2023 that at least 120,000 people in Myanmar and around 100,000 in Cambodia may be held in conditions where they are forced to run online scams. They are recruited with fake job ads for tech or customer-service roles, flown in, then stripped of their passports, confined, and in many cases beaten or tortured if they fail to hit targets. A 2026 UN report documented torture and sexual violence inside these centers and described a humanitarian crisis, not merely a crime wave.

Enforcement on the ground is sporadic and politically fraught. A February 2025 operation along the Thailand-Myanmar border freed roughly 7,000 people from compounds, yet the industry’s labor force is replenished almost as fast as raids empty it, drawn from more than 66 countries. For the people typing the scripts, in other words, this is not a get-rich scheme; it is modern slavery, and the crypto losses on one end of the wire are inseparable from the human cost on the other. That is the detail that makes this unlike any other phishing story in crypto.

Follow the Money: $75 Billion and a Stablecoin

How much has pig butchering actually taken? The most cited academic attempt comes from John Griffin, a finance professor at the University of Texas at Austin, and the doctoral researcher Kevin Mei. By tracing funds from more than 4,000 victims across the blockchain, their study estimated that more than $75 billion flowed to crypto exchanges from pig-butchering-linked wallets between January 2020 and February 2024. Much of the money, the authors found, originated on mainstream US venues before heading offshore.

Their paper, pointedly titled “How Do Crypto Flows Finance Slavery? The Economics of Pig Butchering,” traced the vast majority of transaction volume, about 84 percent, into Tether, the dollar stablecoin that has become the default settlement rail of the scam economy. Griffin did not mince words about the intermediaries. “These are large criminal organized networks, and they’re operating largely unscathed,” he told crypto.news. Tether and the exchanges named in such research have historically disputed blockchain-tracing estimates of this kind, and the $75 billion figure is a modeled approximation rather than a hard ledger, but even conservative readings put the annual take in the tens of billions.

The structure matters as much as the size. Dollars enter through regulated on-ramps where a victim buys crypto, then exit through a maze of wallets, over-the-counter brokers, and less-scrupulous exchanges before being cashed out or recycled. Stablecoins are attractive because they hold their value during laundering, move instantly across borders, and settle on chains the compounds can automate. The same cross-chain plumbing that keeps DeFi liquid also helps scam proceeds disappear, a reminder that the industry’s weakest links are often off-chain and between chains, not inside any single contract.

The Huione Highway

If stablecoins are the vehicle, the laundering marketplaces are the highway. The clearest example is Huione, a Cambodian financial-services group whose Huione Guarantee platform operated as an enormous online bazaar for the scam economy, offering money laundering, stolen data, and even the physical hardware to build a compound. In May 2025, the US Treasury’s Financial Crimes Enforcement Network moved to designate Huione Group a financial institution of primary money-laundering concern under Section 311 of the USA PATRIOT Act, finding it had laundered at least $4 billion in illicit proceeds between August 2021 and January 2025, including the proceeds of North Korean cyber heists and pig-butchering fraud. The rule was finalized in October 2025, cutting Huione off from the US financial system.

The pressure worked, briefly. On 13 May 2025, Telegram removed the channels tied to Huione Guarantee and a second marketplace, Xinbi Guarantee, shutting down networks that CoinDesk reported had handled tens of billions of dollars in crypto before the ban. But the shutdown did not end the business. New guarantee marketplaces sprang up within weeks and the trade largely rebounded, a pattern that defines this entire fight: break one node and the traffic reroutes.

The Scale of the Slaughter

No single number captures pig butchering, because the measurements use different lenses: victim reports, blockchain tracing, and criminal profits each tell part of the story. Taken together, they describe a problem measured in tens of billions of dollars a year.

The ranges look inconsistent only until you line up what each counts. Victim-reported losses, like the FBI’s, capture a fraction of real harm because most victims never file. Blockchain estimates, like Griffin’s, capture flows that include money moving between criminal wallets, not just fresh victim deposits. Profit estimates from the UN measure what the industry keeps after costs. The honest summary is that pig butchering is now one of the largest cyber-enabled fraud categories on earth, and crypto is its preferred medium of exchange.

Who Gets Hit, and How Hard

The United States is the single largest source of victim money, and the damage is concentrated in ways that make it especially cruel. In its 2024 Internet Crime Report, the FBI’s Internet Crime Complaint Center logged $9.3 billion in crypto-related losses, of which $5.8 billion came from crypto investment fraud across 41,557 complaints, a 47 percent jump in losses from the prior year. Investment fraud was the costliest crime category the FBI tracks, and victims over 60 bore the heaviest burden, reporting the largest share of the losses.

Behind each complaint is usually someone who lost not a trading stake but a life savings. Pig-butchering victims routinely drain retirement accounts, take out loans, and remortgage homes, because the scam is engineered to escalate until there is nothing left. The FBI and US Secret Service launched Operation Level Up in January 2024 to find victims mid-scam and warn them; by April 2025 it had notified 5,831 people, more than three-quarters of whom had no idea they were being defrauded, and helped head off over $359 million in further losses. The program’s sober footnote, that some victims had to be referred for suicide-intervention support, says everything about the stakes.

The victims are not naive by any simple measure. The cons are long, professionally scripted, and now increasingly augmented by AI translation and chatbots that let a single operator run many conversations in fluent, idiomatic English. That is the throughline with the rest of this year’s phishing coverage: the same generative tools that let a drainer gang clone a website now let a compound worker sustain a flawless months-long relationship with a stranger thousands of miles away.

The 2026 Crackdown

The Prince Group seizure was the loudest moment in a coordinated enforcement push that defined 2026. In November 2025, the US Attorney’s Office for the District of Columbia stood up a Scam Center Strike Force, pulling together the DOJ Criminal Division, the FBI, the Secret Service, the IRS, and others to go after the Southeast Asian networks that, by the government’s estimate, defraud Americans of nearly $10 billion a year. By 2026 the task force reported it had restrained more than $938 million in cryptocurrency.

The tempo kept up into the spring. In April 2026, as detailed by Chainalysis, a wave of actions restrained roughly $701.9 million more, seized 503 fake crypto investment websites, took down a Telegram recruitment channel with more than 6,000 followers, and added 29 entities to the OFAC sanctions list, alongside a $10 million reward for information on one compound’s proceeds. The same report noted that US victims alone had reported $7.2 billion in pig-butchering-style losses in 2025. Enforcement, at last, was starting to match the scale of the crime.

Why the Factories Keep Running

For all the seizures, the compounds are still open. The reasons are structural. The operations sit in jurisdictions where local authorities are weak, complicit, or both; several of the individuals named in US actions have held political or business standing in their home countries. Shutting a laundering marketplace or sanctioning a network removes one node, but the labor, the victims, and the crypto rails remain, and the traffic simply reroutes, exactly as it did within weeks of the Huione takedown.

Jurisdiction is the deeper problem. A US indictment can seize bitcoin sitting in reachable wallets and name a defendant, but it cannot easily arrest a man who stays in a country that will not extradite him, and it cannot free workers held behind another government’s border. Chen Zhi remains at large despite a $15 billion case bearing his name. Enforcement capacity is stretched thin at home as well; the agencies that chase this money compete for resources, and the thin-staffed, politically buffeted state of US market policing, from a short-handed SEC to overextended task forces, means the referees are outnumbered by the players.

There is also the awkward fact that the foot soldiers are victims too. A raid that frees trafficked workers does nothing to the bosses who ordered the fraud and who rarely set foot in the compound; a prosecution that names a kingpin does nothing for the thousands still held behind the wire. Treating the people at the keyboards as criminals, rather than as the coerced labor the UN says many of them are, risks punishing the exploited while the architects stay offshore and untouched. It is a genuinely hard problem, not a failure of will.

Economics finish the explanation. A compound can net millions of dollars a month against cheap, coerced labor and a near-zero marginal cost per victim. As long as the payoff dwarfs the risk, capital flows in. AI only sharpens the math, cutting the cost of translation, persona management, and lure generation to almost nothing. It is the same brutal logic driving the rest of the scam economy: fewer, bigger, and better-automated cons.

How Not to Become the Pig

Because the exploit targets trust rather than code, the defenses are behavioral. The single most protective rule, repeated by the FBI and every fraud unit that handles these cases, is simple: do not send money, trade, or invest on the advice of someone you have only ever met online. Everything else follows from that.

• Treat any unsolicited message from a stranger who turns warm fast, whether a wrong number, a dating match, or a networking ping, as a potential opening move.
• Be deeply suspicious of anyone who cannot or will not video-call or meet in person yet steers every conversation toward their investing success.
• Never let a new contact choose the platform. A specific app or site you are told to use, especially one promising steep or guaranteed returns, is the heart of the con.
• Remember the withdrawal rule: a legitimate exchange never charges a tax or fee that you must deposit from outside to unlock your own balance. That demand is proof the money is not real.
• Keep your crypto in self-custody you actually control, verify any platform independently, and never share your seed phrase, ID, or banking details with an online acquaintance.

If you or someone you know is already in one of these conversations, stop sending money immediately and contact your bank, which may be able to trace or halt recent transfers. Report the scam to the FBI’s Internet Crime Complaint Center at ic3.gov and to the Federal Trade Commission at reportfraud.ftc.gov. There is no shame in being targeted by a professional operation; the shame belongs to the people running it.

What It Means for Crypto

Pig butchering is a reputational problem for the whole industry, not only a tragedy for its victims. When mainstream headlines tie crypto to forced-labor camps and $15 billion seizures, the association sticks, and it hands ammunition to every regulator inclined to treat the asset class as inherently criminal. The uncomfortable truth is that the scam economy runs on the same features the industry celebrates: permissionless transfers, instant settlement, and stablecoins that move dollars anywhere without a bank.

That is also where the real defense lies. The compounds cannot be raided from a keyboard, but the money has to touch a regulated on-ramp or off-ramp eventually, and that chokepoint is where exchanges, stablecoin issuers, and analytics firms can do the most good. Freezing scam-linked stablecoin balances, flagging the wallet clusters that researchers have mapped, and cooperating quickly with task forces turns the industry’s transparency into a weapon rather than a liability. The $15 billion seizure happened precisely because bitcoin, unlike cash, leaves a permanent trail.

The campaign against pig butchering will not be won by a single indictment, however large. It will be a grind of seizures, sanctions, and victim warnings on one side against trafficking, corruption, and automation on the other. But 2026 was the first year the response began to look serious. The people who built a $15 billion machine out of lonely strangers and stolen bitcoin finally learned that the trail runs both ways.

Frequently Asked Questions

What is a pig butchering scam?

Pig butchering, from the Chinese sha zhu pan, is a long-con fraud that combines romance or friendship-style grooming with a fake crypto investment platform. The scammer spends weeks building trust, then steers the victim to a counterfeit trading site that shows fake profits, encourages ever-larger deposits, and blocks withdrawals until the money is gone.

How big is the pig butchering problem in 2026?

Estimates vary by method, but all point to tens of billions of dollars a year. The FBI logged $5.8 billion in US crypto investment-fraud losses for 2024, the US government estimates Southeast Asian networks take nearly $10 billion a year from Americans, and a University of Texas study traced more than $75 billion in scam-linked crypto flows between 2020 and early 2024.

Why was $15 billion in bitcoin seized in the Prince Group case?

In October 2025, US prosecutors charged Chen Zhi, chairman of Cambodia’s Prince Holding Group, with running forced-labor compounds that carried out pig-butchering scams, and seized about 127,000 bitcoin, worth roughly $15 billion, the largest forfeiture in Justice Department history. Chen remains at large, and the US and UK also imposed sanctions on the network.

Who runs pig butchering scams?

The operations are run by organized criminal networks from industrial compounds in Myanmar, Cambodia, and Laos. Many of the people sending the messages are themselves trafficking victims; the UN estimates well over 200,000 people have been lured with fake job offers and forced to scam under threat of violence.

How can I protect myself from a pig butchering scam?

Never invest on the advice of someone you met only online, and never use a trading platform a new contact tells you to use. Treat guaranteed returns and any fee or tax demanded to unlock a withdrawal as proof of fraud. If you are caught up in one, stop sending money, contact your bank, and report it to the FBI at ic3.gov and the FTC at reportfraud.ftc.gov.

By Anneke de Vries, security and exploits desk, HOGE Wire.