What is a pig butchering scam?
A long-form investment fraud that opens as a relationship.
The name is a translation of the Chinese sha zhu pan, fattening the pig before slaughter, and it describes the method exactly. Contact arrives as a wrong number, a dating match or a friendly message, and for weeks there is no mention of money at all.
The investment appears later, casually, as something the other person does rather than something you should do. It runs on a trading platform they introduce, which looks professional, shows your balance growing, and is entirely under their control.
The patience is what makes it work. By the time money is discussed you have been talking to somebody for a month, and the advice to distrust strangers no longer feels like it applies.
How do you check the wallet address?
By reading its age and its shape before you send anything to it.
Paste the address into the box on this page and it goes to six block explorers. An address created weeks ago, presented as belonging to an established trading firm, has already contradicted the story, and that check takes seconds.
The pattern matters as much as the age. Money arriving from many different addresses and leaving immediately to one is a collection wallet. A real platform's deposit address does not behave like that, and the full wallet check covers how to read it.
A clean address proves nothing, because every scam address was clean once. It is a test that can fail, not one that can pass, and treating a clean result as reassurance is how people talk themselves into the transfer.
How old are their accounts?
Months, usually, and this is the fastest check available.
Whichever platform they contacted you on has a creation date, and several publish it outright. A Bluesky account gives an exact timestamp, a Discord ID carries one inside the number, and X shows a join date.
An account created two months ago belonging to somebody describing a decade in finance is the contradiction the whole check exists to find. Run their handle through a search across 71 platforms and the same pattern usually repeats: everything new, everything created around the same week.
A real person leaves a mess behind them: abandoned handles, dormant accounts, dates that do not line up neatly. A fabricated identity is tidier than a real one, and the tidiness is the tell.
The relationship is the product. The investment is the bill at the end of it.
Do their photographs appear anywhere else?
Frequently, and a reverse image search settles it in a minute.
The photographs are stolen, usually from a real person's public social media, and often from somebody with a moderate following rather than a celebrity. Google Lens, Yandex and TinEye each find different things, so run all three rather than one.
Absence is weak evidence. A photograph that appears nowhere may have been cropped, mirrored or generated, and the metadata is stripped by every platform on upload, so there is nothing inside the file to read either.
A hit, on the other hand, is close to conclusive. Somebody else's holiday photograph on a stranger's dating profile is not a coincidence, and it ends the question without any further checking or any conversation about it.
Why can't you check the trading platform?
Because it was built not to be checkable, and that is the part no lookup solves.
The site is real in the sense that it loads, shows a balance and processes a small withdrawal. It is not real in the sense that the balance is a number in their database. There is no exchange, no custody and no market.
What you can check is thinner and still useful: when the domain was registered, whether the company appears in any regulator's register, and whether the app came from outside an app store. A platform whose domain is four months old and which appears in no register is answered.
The successful first withdrawal is the hook. Letting you take out a small amount early costs them little and buys the credibility that the large deposit depends on. It is part of the script, not evidence against it.
What does the ending look like?
A fee, then another fee, then silence.
When you try to withdraw a meaningful amount, a tax appears. Then a compliance charge, an unlocking fee, a deposit to prove the account is active. Each one is framed as the last obstacle between you and a balance that does not exist.
There is no amount at which this resolves, because the fees are the product now. Any request to pay money in order to take money out is the end of the script, and the correct response is to stop rather than to solve it.
If you are here at this stage: stop sending, record every address and transaction hash, and report it to IC3 or your national equivalent. Then ignore anybody who contacts you offering recovery, because that list is sold.
What can you do with what you find?
Protect yourself, and report. The limits are the same ones that apply to any lookup.
Checking somebody who approached you is squarely what public profiles and public chains are readable for. In the EU and the UK, assembling what you find into a file on a person is processing personal data and needs a lawful basis, even when every piece was public.
Confronting them achieves nothing and warns the operation. These are run at scale from scripted playbooks, and the person typing is frequently coerced rather than in charge, which is worth knowing before you decide what to say.
Reporting reaches the operators through the money. Arguing reaches somebody who could not stop if they wanted to, and it costs you the element of them not knowing you worked it out.
Common questions
What is a pig butchering scam?
A long-form investment fraud that opens as a relationship. Contact arrives as a wrong number or a dating match, and for weeks there is no mention of money. The investment appears later on a trading platform the scammer controls, which shows a balance growing that exists only in their database.
How do I check if an investment platform is fake?
Check when the domain was registered, whether the company appears in any financial regulator's register, and whether the app arrived from outside an app store. A platform with a four-month-old domain and no regulatory record is answered. The balance it shows you cannot be verified at all, by design.
Why did my first withdrawal work?
Because letting you take out a small amount costs them very little and buys the credibility the large deposit depends on. It is a scripted step rather than evidence that the platform is real. The withdrawal stops working at exactly the point where the amount matters.
How do I check the wallet address they gave me?
Paste it into a lookup that queries several block explorers and read its age and its pattern. An address created weeks ago, presented as belonging to an established firm, has contradicted the story. Money arriving from many addresses and forwarding straight out is a collection wallet.
How can I tell if their photos are stolen?
Run a reverse image search on Google Lens, Yandex and TinEye, since each finds different things. A hit is close to conclusive. Absence proves little, because photos are routinely cropped, mirrored or generated, and every platform strips the metadata on upload.
They are asking for a fee to withdraw. What should I do?
Stop. A request to pay money in order to take money out is the end of the script, and there is no amount at which it resolves, because the fees are the product now. Record every address and transaction hash and report it rather than paying the next one.
Can I get my money back after a pig butchering scam?
Rarely, and not through anybody who contacts you. Confirmed crypto transactions are final. Funds reaching a regulated exchange are sometimes frozen, but that requires the exchange and law enforcement. Anybody approaching you offering recovery for an upfront fee is running the second scam.
Should I confront them?
No. It achieves nothing and warns the operation, which will simply move on with your information. These are run at scale from scripted playbooks, and the person typing is frequently coerced rather than in charge. Reporting reaches the operators; arguing reaches somebody who cannot stop.
