Case study: four companies, one pig butchering network

From public reporting. This is a real case, not Chainsentra's own work. It's included to show how blockchain intelligence — the same kind of tracing Chainsentra does — supports real investigations. Outcomes vary by case.

Pig butchering networks rarely operate through a single wallet. They spread victim deposits across many addresses, consolidate them in stages, and route the proceeds through exchanges in different jurisdictions. That's exactly the pattern investigators found in a case that brought together four separate companies — Chainalysis, Tether, Binance and OKX — working alongside authorities in the Asia-Pacific region, resulting in a freeze reported at close to $47 million in USDT.

How do you trace a network that's deliberately spread out?

According to reporting on the case, analysts used Chainalysis's Crypto Investigations Solution to follow transfers that, taken individually, looked unconnected. One account summary describes the tracing as covering dozens of addresses and transfers between November 2022 and July 2023; another describes the investigation eventually narrowing the operation down to around five wallets holding the consolidated funds. The two descriptions likely capture different stages of the same work — a wide initial sweep across many addresses, followed by clustering the activity down to the handful of wallets that mattered most.

That narrowing process is the core of any trace: starting from scattered activity and using attribution — timing, amounts, shared counterparties — to work out which addresses are actually controlled by the same operation.

Tracing a dispersed network means following many small transfers until they converge on the wallets that matter.

Why did it take four companies, not one?

Each company involved held a different piece of the picture:

Company	What it contributed
Chainalysis	Blockchain analysis tooling to trace and cluster wallet activity
Tether	The ability to freeze USDT it had issued, once the relevant wallets were identified
Binance	Exchange account and KYC data for wallets touching its platform
OKX	Exchange account and KYC data for wallets touching its platform

No one company can see the whole chain of custody on its own. An analytics firm can see on-chain movement but not who controls an exchange account; an exchange can see its own account holders but not what happens once funds leave its platform. It's only when analytics findings, issuer cooperation and exchange account data are combined that a trace turns into an actual freeze.

What this means for someone tracing their own loss

This case is a useful illustration of a point that applies just as much to an individual's case as to a multi-million-dollar network: a trace rarely stops at the first exchange or deposit address it reaches. Funds keep moving, and following them usually means working with more than one organisation's data.

That's also why documentation matters so much. An evidence report that sets out every hop, address and the source behind each attribution is what lets a police force, a lawyer or an exchange's compliance team pick up where a trace leaves off — the same way Chainalysis's findings here were shared with exchanges and regional authorities to turn tracing into action.

What this case doesn't tell us

Public reporting on this case centres on the freeze itself, not on individual prosecutions or on whether victims have since received any funds back. That's typical: a freeze is often the most visible, reportable moment in a much longer process, and what happens afterwards — court proceedings, asset distribution — can take years and doesn't always make headlines. It's a reason to treat a freeze as a meaningful step, not a finished outcome.

If you believe you've lost funds to a similar network

Chainsentra's role looks like the Chainalysis side of this case — tracing and documentation — but on behalf of one person rather than as part of an industry-wide effort. A free assessment reviews what you've lost and tells you honestly whether it's traceable, and an investigation documents the path your funds took so the evidence can be handed to the people who can actually act: police, lawyers or an exchange's compliance team. Chainsentra doesn't freeze funds and doesn't promise an outcome like the one in this case — what happens next depends on the authorities and exchanges involved.

Key takeaways

A pig butchering network's funds were traced across dozens of addresses down to a small cluster of wallets, resulting in a freeze of close to $47 million in USDT.
The case required four separate companies — an analytics firm, a stablecoin issuer and two exchanges — each contributing a different piece of the picture.
A freeze is a meaningful step but not a finished outcome; what happens to the funds afterwards depends on the legal process.
The same clustering and attribution techniques used here apply to tracing an individual's loss, just at a smaller scale.