Pig-butchering scams net more than $75 Billion – study finds. „Funds exit the crypto network in large quantities, mostly in Tether, through less transparent but large exchanges – Binance, Huobi, and OKX.”

University of Texas professor tracked 4,000 crypto addresses. Criminals converted most of proceeds into stablecoin Tether.

Over four years, from January 2020 to February 2024, Pig-butchering scammers have likely stolen more than $75 billion from victims around the world, far more than previously estimated, according to a new study called „How Do Crypto Flows Finance Slavery? The Economics of Pig Butchering.”

Pig butchering — a scam named after the practice of farmers fattening hogs before slaughter — often starts with what appears to be a wrong-number text message. People who respond are lured into crypto investments. But the investments are fake, and once victims send enough funds, the scammers disappear. As far-fetched as it sounds, victims routinely lose hundreds of thousands or even millions of dollars. One Kansas banker was charged this month with embezzling $47.1 million from his bank as part of a pig-butchering scam.

The authors of the report, John Griffin – a finance professor at the University of Texas at Austin, and graduate student Kevin Mei, gathered crypto addresses from more than 4,000 victims of the fraud, which has exploded in popularity since the pandemic. With blockchain tracing tools, they tracked the flow of funds from victims to scammers, who are largely based in Southeast Asia.

Griffin and Mei found that $15 billion had come from five exchanges, including Coinbase, typically used by victims in Western countries. The study said that once the scammers collected funds, they most often converted them into Tether, a popular stablecoin. Of the addresses touched by the criminals, 84% of the transaction volume was in Tether.

Paolo Ardoino, the chief executive officer of Tether, called the report false and misleading. “With Tether, every action is online, every action is traceable, every asset can be seized and every criminal can be caught,” Ardoino said in a statement. “We work with law enforcement to do exactly that.”

Abstract from the report

Through blockchain addresses used by ‘‘pig butchering’’ victims, we trace crypto flows and uncover methods commonly used by scammers to obfuscate their activities, including multiple transactions, swapping between cryptocurrencies through DeFi smart contracts, and bridging across blockchains.

The perpetrators interact freely with major crypto exchanges, sending over 104,000 small potential inducement payments to build trust with victims. Funds exit the crypto network in large quantities, mostly in Tether, through less transparent but large exchanges—Binance, Huobi, and OKX.

These criminal enterprises pay approximately 87 basis points in transaction fees and appear to have recently moved at least $75.3 billion into suspicious exchange deposit accounts, including $15.2 billion from exchanges commonly used by U.S. investors.

Our findings highlight how the ‘‘reputable’’ crypto industry provides the common gateways and exit points for massive amounts of criminal capital flows.

Figure 1. Network graph of reported addresses and traced funds
This figure shows the flow of funds following the movement from a subset of reported scammer addresses. Edges that are concave up represent flows moving from left to right (e.g., the curve moves as if going from 9 o’clock to 3 o’clock). Similarly, edges that are concave down represent flows moving from right to left (e.g., from 3 o’clock to 9 o’clock).

Nodes are colored by identity, as described in the legend below, and their size is proportional to the total amount transacted. Edges are colored by transaction size and identity. Green edges are transactions from exchanges, while blue and purple are transactions to exchanges. Edges entering or exiting exchanges with darker colors represent larger transactions. With the exception of exchanges, any given node is positioned closest to any other nodes it transacts with the most.

For the sake of simplicity, the number of nodes depicted here accounts for just 3% of the total number of traced nodes. This sample was gathered by randomly selecting a set of seed nodes and then randomly selecting paths connecting these seed nodes from previous exchanges to deposit addresses.