Pig Butchering Scam: From WhatsApp to Crypto Wallet to Real Identity

Background

A retiree received a WhatsApp message from an unknown number that led to a months-long grooming process. The victim was gradually convinced to "invest" in a fake crypto trading platform, ultimately losing $320,000.

Investigation Methodology

1. WhatsApp Number Intelligence: The initiating phone numbers (3 were used) were traced through carrier databases and VoIP provider records.
2. Fake Platform Forensics: The fraudulent trading website was analyzed for hosting records, domain registration details, and code similarities to known scam platforms.
3. Crypto Trail Analysis: All victim transactions were traced through the blockchain to their final destination.

Key Findings

• The fake trading platform was a clone of a template used in at least 40 other pig butchering operations, identifiable by unique code signatures.
• The WhatsApp numbers were registered to SIM cards issued in a country known for scam compound operations.
• Crypto funds were consolidated into a single wallet that had received over $4.2M from dozens of other victims.

Outcome

Intelligence was shared with Interpol's Financial Crime division and the FBI's IC3. The hosting provider took down the fraudulent website within 24 hours of notification. Total investigation time: 4 weeks.