Of every category of crypto fraud tracked industry-wide, one now accounts for the largest share of losses by far: pig butchering, the pattern of building a relationship with a target before introducing a fake investment opportunity. The numbers from 2025's major industry reports, and a growing list of real law-enforcement seizures, both point to the same conclusion: this is not a marginal fraud type, it's the dominant one.
The scale, in one table
| Measure | Figure | Source |
|---|---|---|
| Share of 2025 crypto fraud inflows from investment fraud and Ponzi schemes | ~62% | TRM Labs 2026 report |
| Total crypto fraud inflows tracked by TRM Labs in 2025 | ~$35 billion | TRM Labs 2026 report |
| Chainalysis's separate fraud-loss estimate for 2025 | ~$17 billion | Chainalysis 2026 report |
| Share of fraud inflows paid in stablecoins | ~84%, up from ~70% the prior year | TRM Labs 2026 report (secondary summary) |
Figures drawn from reporting on the TRM Labs 2026 report and reporting on the Chainalysis 2026 report. The two totals differ because the firms define and measure fraud differently; neither should be read as a precise, agreed figure, but both point the same direction.
Pig butchering versus a Ponzi scheme
TRM Labs' 62% figure groups pig butchering together with Ponzi schemes, and it's worth being clear about how the two differ, because the distinction affects what a trace looks like. A Ponzi scheme pays early participants using money from later participants, often without any individual relationship-building at all; it can run as a public, advertised scheme with many strangers joining independently. Pig butchering, by contrast, depends on an individual relationship with each target, built specifically for them, before any money is discussed. In practice, a single operation sometimes blends both: individual relationship-building funnels targets into what is, underneath, a Ponzi-style structure paying "returns" from new deposits rather than any real investment activity. For tracing purposes, the relationship-based entry point is usually what a victim can describe first, while the Ponzi-style payout structure is usually what the on-chain pattern of incoming and outgoing transfers reveals.
Why the category keeps growing year over year
TRM Labs reported that stablecoin flows connected to fraud rose from roughly 70% to about 84% of fraud inflows between the two most recent years it measured, alongside the overall rise in investment-fraud inflows. Taken together, those two trends describe the same underlying shift: fraud operations that were already effective are becoming more efficient, not fundamentally different. The core mechanics, a patient relationship, a fake platform, a withdrawal-fee demand, haven't changed; what's changed is the scale at which organised networks can run that playbook simultaneously against many targets, helped by more consistent use of a single, liquid asset type across every stage.
How the pattern actually runs
Pig butchering typically starts with contact that doesn't look like fraud at all, a message, a dating app match, a new friend online, sustained over weeks or months before money ever comes up. Once trust is established, the target is introduced to a fake investment platform showing a convincing, steadily growing balance. When the target eventually tries to withdraw, a fee demand usually appears, the pattern covered in withdrawal-fee demands. TRM Labs described these operations in its 2026 report as increasingly organised, running with the specialisation and structure of a professional business rather than a single individual working alone.
It's now organised, not opportunistic
The TRM Labs finding worth sitting with is the structural one: these aren't isolated individuals running one scheme each. The firm describes specialisation, consistent operating patterns, and business-like efficiency across many of the networks it tracked in 2025. That matters for tracing, because an organised network tends to reuse infrastructure, the same fee-collection addresses, the same exchange deposit addresses, across many victims, which is exactly what lets an investigator link separate reports into one case.
Why the model scales so well
The reason pig butchering now dominates crypto fraud losses, rather than sitting alongside other fraud types as one option among many, comes down to what it costs an operator to run versus what it returns. A single relationship built over weeks or months can extract far more from one target than a one-off fee demand or a drive-by phishing link, and once a target has been "fattened," the fake platform, the fee structure, and the scripts used to keep the relationship going can all be reused against the next target with minimal changes. TRM Labs' description of these operations as increasingly organised, with specialisation and business-like structure, fits this logic: separate roles for initial contact, relationship maintenance, platform operation and fund laundering let an operation run many targets in parallel rather than one person managing a single relationship at a time.
Who gets targeted, and why it isn't about gullibility
Pig butchering doesn't succeed because targets are careless; it succeeds because it's built around patient, personalised trust-building that looks nothing like an obvious, rushed fraud attempt. By the time an investment opportunity or a withdrawal fee enters the conversation, the relationship itself, not the financial claim, is doing most of the persuasive work. This is also why red flags like urgency or secrecy, covered in the red flags checklist, tend to appear only once money is already involved, well after the initial contact that made the relationship feel genuine.
The role of geography
Several of the real seizures covered below involve operations based in or routed through Southeast Asia, a pattern that's been widely reported across industry and law-enforcement sources alongside the specific cases cited here. That geography matters for investigators mainly in one practical sense: it usually means the people originating the contact are physically distant from both the target and the funds' eventual destination, which is part of why documenting the full on-chain path to a regulated exchange matters more than any assumption about where the operator is personally located.
What real seizures show
The scale of this fraud type is reflected in a growing number of real, publicly reported law-enforcement actions. A 2025 US civil forfeiture complaint sought roughly $225 million in USDT tied to pig butchering operations, described as the largest cryptocurrency seizure in US Secret Service history, following a joint investigation with Tether and the exchange OKX (TRM Labs). A separate case involving Chainalysis, Tether, Binance and OKX working alongside Asia-Pacific authorities led to a freeze of roughly $47–50 million tied to one pig butchering network. A $225 million freeze that started with a pig butchering report and the APAC pig butchering freeze cover both cases in detail: how the networks were mapped, who was involved, and what it took.
Why stablecoins specifically
The 84% stablecoin share in TRM's fraud-inflow figure isn't a coincidence. Why USDT shows up in almost every fraud case we trace explains the mechanics, but the short version is that a steady, predictable value keeps a victim's displayed balance looking credible, and stablecoins move easily across exchanges, which suits an operation that needs to process deposits from many victims and move the proceeds quickly.
What this means for the people who work these cases
For individuals, the organised, reused nature of these networks is actually a practical advantage once a report is made: the same infrastructure that lets an operator run many targets efficiently is exactly what lets an investigator link your case to others and to any exchange deposit address the network has used before.
For law enforcement handling a report with no obvious local lead, the real seizure cases below show that even very large, cross-border pig butchering networks have been mapped and acted on, usually by combining a victim's transaction data with intelligence shared by exchanges and analytics firms rather than through traditional investigative methods alone. For law enforcement covers how a case-ready trace supports that.
For exchange compliance teams, the consistent appearance of fee-collection addresses and withdrawal-fee demands across pig butchering cases means that screening deposit addresses against known fraud intelligence, not just sanctions lists, is increasingly central to catching these networks before they grow further.
Key takeaways
- Investment fraud, including pig butchering, made up around 62% of crypto fraud inflows tracked industry-wide in 2025.
- The relationship-building model scales efficiently, which is part of why it now dominates fraud losses.
- These operations increasingly run as organised, specialised networks rather than individual opportunists.
- Reused infrastructure, like fee-collection addresses, is exactly what lets investigators link separate victims' reports into one case.
- Real, publicly reported seizures tied to pig butchering networks have reached into the hundreds of millions of dollars.
Further reading
- Pig butchering: the fraud type explained in full.
- Withdrawal-fee demands: the mechanism used to extract a final round of payments.
- Why USDT shows up in almost every fraud case we trace
- A $225 million freeze that started with a pig butchering report
- The APAC pig butchering freeze
- Start a free assessment if you believe you've been targeted.