Fake investment platforms and "pig butchering": how the money actually moves

The scale of the problem

Chainalysis estimates that roughly $17 billion was stolen in crypto scams and fraud during 2025, with impersonation-based approaches growing sharply year on year. Reported losses are always a fraction of real losses, because most people never report the loss at all.

The dominant pattern behind those numbers is the long-con investment scam, often called "pig butchering": weeks of relationship building, a plausible trading interface, small successful withdrawals, then escalating deposits that can never be withdrawn.

What the on-chain pattern looks like

Deposits almost never go straight to an exchange. In the cases we see, funds follow a recognisable shape:

• A freshly created deposit address is given to each victim, so the address itself looks clean.
• Within hours, balances are swept into a consolidation wallet that also collects from dozens of other victims — this is the single most useful moment in the whole trace.
• Value is converted to USDT (frequently on TRON) and layered through chains of intermediary wallets or cross-chain bridges.
• Cash-out happens at exchanges, OTC desks or payment processors that hold KYC records on the receiving account.

Why the consolidation wallet matters

A single victim's deposit is one data point. A consolidation wallet turns it into a network: it links your loss to other victims, establishes that an organised operation exists rather than a private dispute, and gives law enforcement and exchange compliance teams an identifier they can act on. That distinction changes how seriously a report is treated.

Evidence worth preserving now

Whatever you decide about an investigation, preserve this material immediately — platforms disappear and chat accounts get deleted.

• Every deposit transaction hash, plus the wallet or exchange account the funds left from.
• The deposit addresses the platform gave you, including ones you were told to stop using.
• Full chat exports (not screenshots of screenshots), phone numbers and profile names.
• The platform's URL, any app you were asked to install, and screenshots of your "balance".
• Any bank transfers or card payments used to buy the crypto in the first place.

What tracing can and cannot do

Tracing can establish where funds went, identify the services that received them, and produce a sourced report a solicitor, insurer or police force can act on. It can support a freeze request when funds are still sitting at a regulated exchange.

It cannot reverse a on-chain transaction, and no legitimate firm can promise recovery. Anyone guaranteeing your money back for an upfront fee is running a second fraud on top of the first.