Loading story…
Pig butchering scams, a form of crypto romance and investment fraud, are increasingly targeting victims through unconventional platforms such as matrimonial websites. Scammers exploit the high-trust environment of these platforms, engaging in prolonged, convincing conversations before introducing cryptocurrency investment opportunities. The approach is highly personalized, often involving real-time voice communication and cultural familiarity, making detection difficult for both users and platform operators. These scams are not limited to dating apps but are now leveraging the unique trust models of matrimonial services, broadening their reach and impact.
Simultaneously, Chinese-speaking darknet markets hosted on Telegram, such as Tudou Guarantee and Xinbi Guarantee, have become central hubs for facilitating pig butchering operations. These markets enable billions of dollars in money laundering and provide scam-related services, including stolen data, fake investment websites, and AI deepfake tools. The scale of these operations is immense, with the FBI estimating that pig butchering scams generate around $10 billion annually from US victims alone. The convergence of social engineering tactics and robust darknet infrastructure has made pig butchering the most lucrative form of cybercrime globally.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 events from the most recent confirmed update back to the earliest known activity.
Infoblox released threat intelligence research on the scaling of the fraud economy through 'pig butchering as a service.' The publication indicates growing formalization and service-based support for these scam operations.
A Cyb3r Hawk analysis described a crypto scam run through a South Asian matrimonial platform, where an attacker using the persona 'Elena' built trust through native-language chats and calls before steering the victim into a fraudulent cryptocurrency transfer. The report said the operation used AI-generated or stolen images, browser-fingerprinting evasion, and infrastructure on legitimate services such as Fastly and Firebase, and appeared to be reused across multiple dating and matrimonial platforms.
A new Elliptic analysis reported that Telegram was hosting the world's largest darknet markets tied to Chinese-speaking crypto scammers. The report said these markets sold services including money laundering, stolen data, scam tools, fake investment sites, AI deepfake tools, and other illicit offerings that support pig-butchering operations.
After the earlier bans, Tudou Guarantee and Xinbi Guarantee became the leading Telegram-based darknet markets serving Chinese-speaking crypto scammers. Elliptic said the two markets were collectively facilitating nearly $2 billion per month in illicit transactions.
Elliptic said Telegram banned two major Chinese-language darknet markets in early 2025. Their removal preceded the rise of replacement markets on the platform.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
infoblox.com
Open sourcemedium.com
Open sourceschneier.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Authorities and researchers warned that **pig-butchering** operations have grown into a global criminal enterprise that combines online relationship and investment fraud with human trafficking. INTERPOL said victims from 66 countries had been trafficked into scam centres by March 2025, with most taken to Southeast Asia and additional activity emerging in the Middle East, West Africa, and Central America. The centres reportedly recruit workers through fake job ads, then detain and coerce them into running social-engineering scams under debt bondage and severe abuse, while criminals increasingly use AI-generated job postings, deepfake profiles, and other synthetic content to scale the fraud. The scams typically target victims on social media and messaging platforms, steering them into fraudulent cryptocurrency investments and draining funds over time. California regulators have urged consumers to recognize and report the schemes, while legal analysis in the United States found at least 81 federal civil forfeiture actions tied to pig-butchering by March 2026. Those seizures have disrupted some networks and recovered stolen crypto, but often only a small share of losses, and victim repayment remains difficult because cases depend heavily on foreign exchanges, stablecoin issuers, and complex claims processes; one exceptional case involving **Chen Zhi** and the **Prince Group** reportedly led to the seizure of about **$15 billion** in cryptocurrency.
Aug 12, 2026
Cybersecurity researchers have uncovered the role of specialized service providers in enabling large-scale pig butchering scams, also known as romance baiting or investment fraud, particularly in Southeast Asia. These providers, such as the Penguin Account Store (also known as Heavenly Alliance and Overseas Alliance), operate under a crimeware-as-a-service (CaaS) model, supplying turnkey scam platforms, fraud kits, stolen identities, and infrastructure that dramatically lower the barrier to entry for criminal groups. The scam operations are often run from compounds in special economic zones, where victims of human trafficking are forced to conduct fraudulent activities under threat of violence, and the infrastructure is designed to facilitate rapid laundering of stolen funds and cryptocurrencies beyond the reach of law enforcement. The industrialization of pig butchering-as-a-service (PBaaS) has transformed the landscape of online fraud, with ready-made applications and templates now available for purchase, enabling scalable and efficient scam operations. The Penguin group exemplifies this trend, providing comprehensive packages that allow even non-technical actors to launch sophisticated social engineering campaigns. This development has contributed to the proliferation of global fraud, with law enforcement agencies and organizations like INTERPOL highlighting the intersection of cybercrime and human trafficking in these operations.
Jun 29, 2026
Sophos reported on a Cambodia-based **pig-butchering** operation that used fraudulent online relationships and investment lures to steal money from victims. The campaign relied on scam infrastructure designed to build trust over time, then direct targets into fake cryptocurrency or investment platforms where deposits were ultimately controlled by the operators. The report highlights how the operation functioned as an organized criminal enterprise, with infrastructure, social-engineering workflows, and financial fraud mechanisms supporting the scheme. The activity underscores the continued threat from transnational scam networks that blend romance fraud, fake trading services, and cryptocurrency payment channels to extract large sums from victims while obscuring the actors behind the operation.
Jun 29, 2026