Most coverage of pig butchering stops at the chat. A stranger texts the wrong number, apologizes, and slowly becomes a friend. We understood that part. What we could not understand was why careful people with real savings kept sending six figures to trading platforms nobody had heard of.
So our team spent about two weeks on the other half of the scam. We read the FBI's 2025 Internet Crime Report, went through Justice Department seizure announcements and the Treasury sanctions action against a hosting company called Funnull, and worked through FinCEN's scam center alert published at the start of this month. We also looked up registration dates on the seized domains to see how new they were when victims started paying.
The pattern was hard to miss. The conversation builds trust, but the website converts that trust into deposits. It shows the balance climbing. It lets you pull out a little so you relax. Then it locks the door. This guide is about that door.
The short version
|
Why the website is the real engine
Investigators describe pig butchering in two stages. The first is grooming: a wrong number text, a dating match, a friendly professional contact who is patient for weeks. The second is the money, and that stage depends almost entirely on a website or app.
The Justice Department's own description of the scheme is revealing. Scammers typically convince victims to buy real cryptocurrency first, then talk them into moving it onto fake investment websites and applications. That handoff is where the money leaves the victim's control, and from the victim's side it looks like an ordinary transfer.
According to the FBI, these platforms are built to look like legitimate trading sites. After the first deposit they display impressive gains, and some let victims withdraw small amounts early on. It is only after a large deposit that withdrawals stop working.
| Why this matters: A person saying "trust me" raises suspicion. A dashboard with a green number that grows every morning does not. The website does the persuading that a chat message never could. |
The numbers behind it
$7.2B Reported US losses to crypto investment fraud in 2025 FBI IC3 2025 | $62,604 Average reported loss when cryptocurrency was involved FBI IC3 2025 | $12.7B Suspected scam activity flagged in 33,904 bank reports, Sep 2023 to Dec 2025 FINCEN, SEP 2026 |
503 Fake investment domains seized in one DOJ action DOJ, APR 2026 | $1.4B Lost to fake "fund recovery" services in 2025 FBI IC3 2025 | $7.7B Cybercrime losses reported by Americans aged 60 and over FBI IC3 2025 |
Anatomy of a fake investment platform
Below is a composite of what victims describe in FBI and DOJ filings. Every element has a job.
Illustration only. Fictional platform recreated from features described in federal case filings.
| WHAT YOU SEE | ITS PURPOSE | WHAT IS REALLY HAPPENING |
|---|---|---|
| Rising balance and profit chart | Proof your money is growing | The numbers are invented. DOJ says every dollar victims deposit goes straight to the scammers. |
| A small early withdrawal that works | Removes doubt | The FBI says this is deliberate, to build confidence before a large deposit. |
| 24/7 live chat support | Feels like a real exchange | Run by the same operation. This is where the fee demands arrive. |
| "Licensed" or "registered" badges | Borrowed authority | FinCEN warns that MSB registration numbers get misused on scam sites and apps. Registration is not approval or a license. |
| A polished mobile app | Looks vetted | The Shunda compound in Burma used both websites and apps dressed up as real investment platforms, per DOJ. |
| A name close to a known institution | Brand confusion | In 2022, federal prosecutors seized seven domains spoofing the Singapore International Monetary Exchange. |
| "Tax" or "security deposit" to unlock funds | The final squeeze | IC3 says victims often pay more to unlock funds than they ever deposited. |
The life of a deposit
| The introduction Your new contact mentions a mentor, an "uncle," or a trading signal group, then shares a link or an app name. | |
| The on-ramp You buy crypto on a real, well known exchange. It feels safe because that part is real. | |
| The transfer You send coins to a deposit address shown on the platform or pasted into chat. At this point the funds sit in scammer controlled wallets. | |
| The show The dashboard climbs. A small withdrawal goes through. You deposit more, sometimes from a 401(k), a loan, or home equity. | |
| The lock A larger withdrawal is frozen for "verification," "taxes," or a "risk deposit." Each payment unlocks a new fee. | |
| The second harvest A "recovery firm" or "lawyer" reaches out claiming ties to the FBI or CFPB and offering to get your money back, for an upfront fee. IC3 warns this is often the same fraud continuing. |
Who builds these sites
The person chatting with you is rarely the person running the website. Behind the platforms sits a supply chain of hosting, domains, templates, and payment rails.
🏗 Funnull Technology On May 29, 2025, Treasury sanctioned this Philippines based company and its administrator, Liu Lizhi. OFAC said Funnull supported hundreds of thousands of scam websites and was linked to most of the crypto investment scam sites reported to the FBI. It bought IP addresses in bulk from mainstream cloud providers, resold them to criminals, and handed out domain names designed to mimic trusted brands. It was tied to more than $200 million in US losses, averaging over $150,000 per victim. | 🔄 Seize one, launch the next The Tai Chang compound in Burma used tickmilleas.com. It was registered in early November 2025 and the FBI found victims using it within a month. After agents seized it in December 2025, the compound launched fortuneprimeglobalirts.com, which DOJ said looked and worked like its predecessor. That one was seized in April 2026. |
🤖 AI makes it cheaper Chainalysis found that scam operations with on chain links to AI tool vendors took in about $3.2 million each, roughly 4.5 times more than those without. The average scam payment jumped from $782 in 2024 to $2,764 in 2025. | ⛓ Forced labor behind the screen DOJ says many operators are trafficking victims held in compounds in Burma and Cambodia. In the Shunda case, one worker using a fake investment platform took more than $3 million from a single American. |
Case files: real domains taken down
| DOMAIN OR ACTION | DATE | WHAT THE RECORD SHOWS |
|---|---|---|
| 7 spoofed SIMEX domains | Nov 2022 | Seized by the Eastern District of Virginia. Imitated the Singapore International Monetary Exchange to lure US victims. |
| OKEX-NFT.net | May 2024 | Seized by the Secret Service as part of a fake crypto investment operation. |
| NFT-UNI.com | Nov 2023 to Mar 2024 | One New York victim lost $172,405.61. Other victims of the same site lost over $4.5 million combined. |
| tickmilleas.com | Dec 2025 | Tai Chang compound, Burma. Registered in early November, victims within a month. Meta removed around 2,000 related accounts. |
| fortuneprimeglobalirts.com | Apr 2026 | Replacement for the seized Tai Chang domain, built on the same model. |
| 503 dot-com domains | Apr 2026 | Each one was identified by a victim contacted through FBI Operation Level Up and was used to launder that victim's crypto. |
Notice the naming. Words like "global," "prime," "NFT," and fragments of real brand names show up again and again. None of it is proof on its own, but it is a pattern worth recognizing.
Red flags of a pig butchering website
Someone else found it for you You did not discover the platform through your own research. A contact you met online introduced it. | The domain is newer than the friendship A site registered weeks ago handling "institutional" trading should end the conversation. |
Deposits only in crypto, to an address from chat No bank transfer option and a wallet address supplied by "support" or your contact. | Returns that never dip Real markets fall. A balance that only climbs is being typed in by someone. |
Pay to withdraw A fresh deposit required to release your own money. The FBI calls this a trap, full stop. | Credentials you cannot verify License claims that do not appear on the regulator's own website. |
Deadlines and "VIP pools" Limited time events that push you to deposit more today. | Contact that avoids video Your contact or "account manager" always has a reason they cannot show their face live. |
Quick self check
|
Already sent money? Do this now
1. Stop all payments Do not pay any fee, tax, or penalty to unlock funds. More money will not release the balance. | 2. Save the evidence Website address, wallet addresses, transaction hashes, amounts, dates, usernames, phone numbers, and screenshots of chats. |
3. Report to IC3 File at ic3.gov. Every seized domain in the April 2026 action traced back to victim reports. | 4. Call your bank and exchange Tell them it is a suspected investment scam. Exchanges can sometimes flag or freeze related activity. |
| Ignore anyone offering recovery for a fee. The FBI will never ask you for money, move the conversation to private messaging apps, or request your bank details. If you are 60 or older, the National Elder Fraud Hotline (833-372-8311) can help you file. And if the loss has left you in a dark place, call or text 988 in the US. These scams are run by professionals, and being targeted says nothing about your intelligence. |
One more note. Through Operation Level Up, the FBI proactively contacts people it believes are being scammed. As of March 2026 it had reached 8,935 victims, and 77% of them did not yet know they were being defrauded. If the FBI calls, it may leave a voicemail with instructions for verifying who they are.
How the crackdown has moved
| SEP 2023 | FinCEN issues its first pig butchering alert to banks. |
| JAN 2024 | FBI and Secret Service start Operation Level Up. |
| MAY 2025 | Treasury sanctions Funnull Technology for hosting scam sites. |
| NOV 2025 | DOJ launches the Scam Center Strike Force. |
| APR 2026 | 503 domains seized and more than $701 million in crypto restrained. |
| SEP 2026 | FinCEN's new scam center alert (FIN-2026-Alert005) ties roughly $12.7 billion in suspected activity to these schemes. |
Final VerdictThe website is their strength and their weak spotAfter two weeks inside court filings and agency reports, our view of this scam changed. We went in thinking pig butchering was mainly a story about loneliness and manipulation. It is that, but the part that actually empties accounts is a piece of software: a login page, a fake balance, a support chat reading from a script. That is also where these operations are most exposed. A website has a registration date anyone can look up. It needs hosting that can be sanctioned and a domain that can be seized. Every one of those 503 domains came down because victims reported what they saw. The chat is private. The website leaves a trail. What stayed with our team most was how ordinary the fake platforms looked. There was nothing obviously wrong with them. That is exactly why the checks in this guide matter more than instinct.
|