Pig butchering and romance-investment scams: what victims should do

The pattern is consistent across languages and apps. Contact starts on a dating site, social network, or messaging app. The other person builds rapport over days or weeks — photos, daily check-ins, shared “goals.” Eventually they introduce a “mentor,” a private trading group, or a slick website that looks like a broker or crypto exchange.

Deposits go to addresses the platform controls (or to wallets the “partner” provides). The dashboard shows rising balances and easy early withdrawals of small amounts — bait that builds belief. Larger deposits follow. When the victim tries to withdraw meaningfully, the site invents a tax, unlock fee, AML hold, or account verification step that requires sending more crypto. That fee never unlocks anything.

• Romance or friendship first; investment second.
• Pressure to keep the opportunity secret from family and banks.
• Screenshots of profits that never appear in a real exchange you control.
• Withdrawal blocked until you pay an invented fee (see our withdrawal-fee guide).
• Handlers who vanish or become abusive once money stops.

• Unsolicited contact that quickly turns to trading or “guaranteed” returns.
• Apps or sites you cannot find in reputable app stores, or clones of real brands with wrong domains.
• You never withdraw to a wallet or exchange account you opened yourself through official channels.
• Support only exists inside the app chat or via the romantic contact.
• Requests to move conversations off-platform and delete evidence.
• Any demand for seed phrases, remote desktop, or bank login “to verify.”

If you are already mid-scam: stop depositing. Do not pay an unlock fee. Do not give anyone your seed phrase. Preserve evidence first; recovery pitches can wait — and most of them are hostile.

Your deposits are real blockchain transfers. The fake platform’s “balance” is usually a database entry, not an asset held for you. On-chain, value typically moves through collector wallets, intermediate hops, bridges, OTC desks, or exchange deposit clusters. Some paths reach KYC services; some end in mixers, cash-out networks, or unlabeled wallets.

Tracing does not reverse those transfers. It maps hops and, where defensible, labels cash-out candidates for police, counsel, or exchange compliance contact. An honest path may also conclude that no useful custodial door is visible. That finding still matters: it stops you from emailing random brands or paying someone who claims they already “froze” the account.

MBTrace’s sample report at /sample-report.pdf shows the tone of a letter-ready path: cited hashes, confidence language, and no recovery promise.

1. Stop sending crypto or fiat to the platform, “partner,” or any unlock/tax address.
2. Do not delete chats. Export or screenshot conversations, usernames, phone numbers, and profile URLs.
3. Copy every deposit transaction hash, network, amount, destination address, and approximate UTC time.
4. Save the fake site URL, app name, and any QR codes or wallet addresses they gave you.
5. Secure remaining wallets and exchange accounts (new device if needed; never reuse a compromised seed).
6. File a police report when you can do so safely — bring hashes and a timeline (see our police guide).
7. Ignore unsolicited recovery DMs; read our recovery-scams guide before paying anyone.

Day-one priorities mirror any crypto loss: stop further transfer, preserve proof, avoid second scams. Our first-24-hours checklist covers securing remaining funds and communication hygiene.

Police and financial-crime units work from documents: txids, chat exports, platform URLs, and a coherent timeline. Romance context is relevant because it explains social engineering; it does not replace on-chain identifiers.

If tracing shows deposits into a labeled exchange or custodial cluster, a factual compliance contact may be appropriate. Exchanges may freeze only what they control, and only under their policies and law — nobody can honestly guarantee a freeze. See our exchange-freeze guide for how to write that contact without overclaiming.

• Tracing helps when you need a defensible path for authorities or counsel.
• Tracing helps when you do not know which service (if any) received the funds.
• Tracing does not recover coins, unlock fake dashboards, or identify account holders from public data alone.

MBTrace sells an on-chain investigation PDF (quoted per case, from $50+, typically 24–48h after payment). An analyst reviews and accepts before payment. We never ask for seeds or keys. Soft CTA only: if you need a path document, report a case — we do not promise recovery.

After these scams, a second wave often arrives: Telegram “agents,” ads for guaranteed recovery, or people posing as law enforcement who need a fee to release funds. Scripts recycle the same advance-fee logic as the original unlock tax. Guarantees, seed requests, and urgency deadlines are walk-away signals.

Honest help sells a deliverable you can evaluate — a path PDF with limits — not a percentage of coins returned. Compare any pitch to our recovery-scams guide. If someone claims they already spoke to the fake platform’s “compliance” and only need your gas fee, treat it as fiction.

Handlers exploit isolation and shame. Slowing down is a defense. Tell a trusted person the factual outline (amounts, platform name, that you stopped sending). Do not grant remote access “so they can help.” Move follow-up to official police and exchange channels you open yourself.

This article is general information, not legal advice. Local reporting rules differ. Outcomes of police reports and exchange tickets vary; no honest vendor can promise refunds or freezes.

1. Stop deposits and fee payments immediately.
2. Export chats, URLs, usernames, and deposit hashes.
3. Secure remaining assets; never reuse a leaked seed.
4. Report to police with a timeline and primary sources.
5. Decide whether a letter-ready on-chain path PDF helps your packet.
6. Refuse recovery guarantees and any request for keys.