Table of Contents
  • Home
  • /
  • Blog
  • /
  • How to Avoid Being a Social Engineering Victim of Pig Butchering Cryptocurrency Fraud
November 3, 2022

How to Avoid Being a Social Engineering Victim of Pig Butchering Cryptocurrency Fraud

How To Avoid Being A Social Engineering Victim Of Pig Butchering Cryptocurrency Fraud

As Crypto market grows it encourages threat actors to commit cyber crime. This leads security firms to be more vigilant about the emerging threats to protect their clients and their own infrastructure. Proofpoint, a well know security company has been tracking multiple threats known as Sha Zhu Pan, or “Pig Butchering” for past few months. According to the Proofpoint, these threats are typically managed by a large industry of professional fraud actors to lure a victim into depositing cryptocurrency into a fake cryptocurrency exchange to steal the money. Threat actors usually carry out these attacks using attractive platforms like dating apps, social media platforms, or some times through text messages. We created this post to help you learn about Pig Butchering Cryptocurrency Fraud, a cryptocurrency-based social engineering scheme and how to avoid being a social engineering victim and finally, how to prevent social engineering attacks in general. Let’s begin the post.

What Is Social Engineering

Social engineering is the art of psychological manipulation to exploit human errors to accomplish malicious activities. Social engineering tactics makes people to trust blindly and break security policies and procedures, this is mainly done by gaining the trust of an individual and unknowingly stealing sensitive information from them.

In this post we will discuss on a major social engineering attack which is exploited widely and how to avoid being a social engineering victim.

Cryptocurrency Frauds High in Markets: Pig Butchering

Crypto currency is the virtual currency which are encrypted by cryptography. Crypto currencies are not issued by any central authority and doesn’t exist in any physical form, they are maintained in a decentralized platform. One of the wildly exploited social engineering attack is the Pig Butchering Cryptocurrency Fraud.

This cryptocurrency-based social engineering scheme have stolen millions of dollars from multiple users.

What is Pig Butchering:

A conversation that is started from a text from a wrong number will lead to months of friendly conversation which eventually moves on to many serious topics on emotional scenarios, financial advices, etc., over a period of time you started trusting your new friend, and one day they inform you about a highly successful investment they did in a newly emerging cryptocurrency platform which is the future of crypto investments and recommends you to invest in it

Initially, you are a bit hesitant, and you invest less, but the investments doubled. Wow! This currency is for real. Let me invest more. After investing a huge amount in crypto while waiting for it to get doubled you are realizing slowly no one responding and when you realized you have been scammed the threat actor deletes the website and moves on to their next victim.

You Have Been Scammed!!!!

Proofpoint has shared a detailed article on this cryptocurrency-based social engineering scheme, Pig Butchering AKA Sha Zhu Pan.

Now Let’s dig into the details of how the attacker lure their victims and gain their trust.

The name ‘Pig Butchering’ refers to how the scammers feed the victim(pig) with so many hopes and false promises and eventually make them ready for getting looted (Butchering).

Pig Butchering Cryptocurrency Fraud initially targeted the Chinese audience and then slowly moved to English-speaking countries.

Phase 1:Introducing the Treat Actor

The conversation mostly starts with an attractive polite stranger on the internet, they start with pleasantries and mind-capturing conversations while they complement, and empathize with the victim.

Slowly they start chatting for weeks and establish a strong emotional connection with the victim sharing their experiences and finer things in life. If the Victim is on social media apps like LinkedIn, Twitter, Instagram etc the threat actor will request the victim to connect over WhatsApp which is the more private and trustable platform. Most of the time they establish a romantic relationship with the victim and share racy “selfies” to make the victim reciprocate the same (which will be used in later stages for blackmailing).

As this conversation progresses and the attacker feels the trust with the victim is established, they will invite the victims to chat with their so-called ‘investment mentors’ on how to make more money and how the threat actor has created a lot of profit out of it.

Credits: Proofpoint

Phase 2: The Kind Uncle who helps you invest!

One the rapport is established the ‘investment mentor’ or the ‘kind uncle’ will send the victim cryptocurrency investing documents on how to set up coin base or crypto account. One of the integral parts of the scheme is to create a cryptocurrency wallet if the victim doesn’t have one. The scammers will work with the victim individually or ask them to join group chats mostly on WhatsApp, telegram and Discord where the victim meets so many people investing and making money as per the advice of the “Plan Analyst” the one who leads the group.

Ultimately after all the convincing, the victim will be led to fake crypto currency website or mobile applications and will be requested to purchase a small amount of crypto by the treat actors, this will be mainly on Tether (USDT) in or The threat actor will make sure that the victim purchased by requesting a screenshot, the actors will specifically request to invest less than $1000. If the victim complies to all the requirements set by the treat actor, they will be provided with 10% to 20% reward which will be reflected immediately in their wallet.

Once the reward is received the ‘plan analyst’ will congratulate you and also inform you on the urgency on investing in crypto as it is a volatile market. Hence slowly step by step after investing in small amounts and getting rewards the attacker will urge you to invest in a huge amount, here the treat actors are putting victims into a behavioural pattern known as “classic conditioning” where the victims mind is trained on receiving the rewards. In this case the victim believes in attacker as he was receiving rewards from previous investments.

An image of fake crypto website captured by Proofpoint

Phase 3: Fattening Up the Pig

Once the victim is convinced by the attacker and sees profits in their wallet, the trust also increases and they are ready to invest high, a.k.a Fattened up, the attackers will encourage in putting in large investments by taking a loan, sell stocks etc, and invest in the fake crypto.

Once the victim starts to worry, they will be asked to take out only small amounts and convince that the rest of the amount should not be taken out.

In the end when the victim realizes that they have been scammed, the attacker deletes the website and starts hunting for other victims.

On the Killing Floor

Pig butchering type of scam is most of the time highly successful due to the intimate conversations with the victim which makes it more trustable. The empathetic and emotional manipulations and friendly conversation exploit the genuine feelings of the victim. The attacker often shares fake sad and emotional stories in order to gain trust and empathy from the victim.

The threat actors are highly trained not to click any links. When Proofpoint researchers shared URLs to trace the treat actor they were blocked immediately.

Credits: Proofpoint

As per the statistics shared by FBI In 2021 more that 4300 cases were received on crypto-romance scams which lead to more than $429 million in losses.

How to Prevent Social Engineering Attacks

The U.S. Federal Bureau of Investigation (FBI) have shared a few steps on How to avoid being a social engineering victim

  • Your financial details should never be shared to any stranger you have met online

  • Do not take advice from strangers and invest accordingly   

  • Never provide your personally identifiable information such as social security number bank details or other identification proofs under any circumstances to people over the internet.

  • Never fall for unbelievable profits on any trading sites.

  • Be cautious of people, emails, and texts where they urge you to invest anywhere.

Indicators of Compromise

zvip[.]zonePig   Butchering Domain
xtfkskpk[.]buzzPig   Butchering Domain
meymytum[.]xyzPig   Butchering Domain
vwtryf[.]xyzPig   Butchering Domain
eumfpbva[.]xyzPig   Butchering Domain
nhealcoin[.]ccPig   Butchering Domain
zvip[.]zonePig   Butchering Domain
hitbicvip[.]comPig   Butchering Domain
hitbic[.]netPig   Butchering Domain
oslint[.]comPig   Butchering Domain
maskexc[.]comPig   Butchering Domain
coinss[.]proPig   Butchering Domain
qklyz[.]comPig   Butchering Domain
coinline[.]proPig   Butchering Domain
skgroup[.]vipPig   Butchering Domain
galaxycoin[.]vipPig   Butchering Domain
nhchain[.]vipPig   Butchering Domain
lanbing[.]clubPig   Butchering Domain
fwhtoken[.]comPig   Butchering Domain
s-coin[.]vipPig   Butchering Domain
walletput[.]comPig   Butchering Domain
okx-us[.]netPig   Butchering Domain
mitokenex[.]comPig   Butchering Domain
flyscoin[.]comPig Butchering   Domain
autoecofxmarkets[.]comPig   Butchering Domain
ensf[.]agencyPig   Butchering Domain
shopwse[.]comPig   Butchering Domain
beybit[.]comPig   Butchering Domain
bihuo[.]topPig   Butchering Domain
bn93[.]comPig   Butchering Domain
sklge[.]comPig   Butchering Domain
tgbone[.]comPig   Butchering Domain
rkez[.]xyzPig   Butchering Domain
bitget-tw[.]comPig   Butchering Domain
cme-cn[.]comPig   Butchering Domain
kucoinusa[.]comPig   Butchering Domain
266wrd[.]comPig   Butchering Domain
financeaka[.]ccPig   Butchering Domain
ettsmc[.]ltdPig   Butchering Domain
bilinkbitex[.]comPig   Butchering Domain
engiegpg[.]comPig   Butchering Domain
aax[.]newsPig   Butchering Domain
ftxcn99[.]comPig   Butchering Domain
pinduoyu[.]comPig Butchering   Domain
hkdbitexchange[.]comPig   Butchering Domain
acefinex[.]comPig   Butchering Domain
acefinex[.]netPig   Butchering Domain
acefinex[.}vipPig   Butchering Domain
eumfpbva[.]xyzPig   Butchering Domain
meymytum[.]xyzPig   Butchering Domain
okx-us[.]netPig   Butchering Domain
s-coin[.]vipPig   Butchering Domain
vwtryf[.]xyzPig   Butchering Domain
xtfkskpk[.]buzzPig   Butchering Domain
mitokenex[.]comPig   Butchering Domain


Every day we hear about multiple cyber-attacks happening all around the world, but as an individual, we will be least bothered as you may think how it will affect us.

The above post would have given a detailed idea of how threat actors can impact a common man, we also learned how to avoid being a social engineering victim. Everyone should be always alerted to their surroundings and very careful while sharing personal information on the internet.

Please share this post and help to secure the digital world. Visit our social media page on FacebookLinkedInTwitterTelegramTumblr,  Medium & Instagram, and subscribe to receive updates like this. 

Aroma Rose Reji

Aroma is a cybersecurity professional with more than four years of experience in the industry. She has a strong background in detecting and defending cyber-attacks and possesses multiple global certifications like eCTHPv2, CEH, and CTIA. She is a pet lover and, in her free time, enjoys spending time with her cat, cooking, and traveling. You can connect with her on LinkedIn.

Recently added

Application Security

View All

Learn More About Cyber Security Security & Technology

“Knowledge Arsenal: Empowering Your Security Journey through Continuous Learning”

Cybersecurity All-in-One For Dummies - 1st Edition

"Cybersecurity All-in-One For Dummies" offers a comprehensive guide to securing personal and business digital assets from cyber threats, with actionable insights from industry experts.



View All

Learn Something New with Free Email subscription