• Home
  • |
  • Blog
  • |
  • How to Avoid Being a Social Engineering Victim of Pig Butchering Cryptocurrency Fraud
How to Avoid Being a Social Engineering Victim of Pig Butchering Cryptocurrency Fraud

As Crypto market grows it encourages threat actors to commit cyber crime. This leads security firms to be more vigilant about the emerging threats to protect their clients and their own infrastructure. Proofpoint, a well know security company has been tracking multiple threats known as Sha Zhu Pan, or “Pig Butchering” for past few months. According to the Proofpoint, these threats are typically managed by a large industry of professional fraud actors to lure a victim into depositing cryptocurrency into a fake cryptocurrency exchange to steal the money. Threat actors usually carry out these attacks using attractive platforms like dating apps, social media platforms, or some times through text messages. We created this post to help you learn about Pig Butchering Cryptocurrency Fraud, a cryptocurrency-based social engineering scheme and how to avoid being a social engineering victim and finally, how to prevent social engineering attacks in general. Let’s begin the post.

What Is Social Engineering

Social engineering is the art of psychological manipulation to exploit human errors to accomplish malicious activities. Social engineering tactics makes people to trust blindly and break security policies and procedures, this is mainly done by gaining the trust of an individual and unknowingly stealing sensitive information from them.

In this post we will discuss on a major social engineering attack which is exploited widely and how to avoid being a social engineering victim.

Cryptocurrency Frauds High in Markets: Pig Butchering

Crypto currency is the virtual currency which are encrypted by cryptography. Crypto currencies are not issued by any central authority and doesn’t exist in any physical form, they are maintained in a decentralized platform. One of the wildly exploited social engineering attack is the Pig Butchering Cryptocurrency Fraud.

This cryptocurrency-based social engineering scheme have stolen millions of dollars from multiple users.

What is Pig Butchering:

A conversation which is started from a text from a wrong number will lead to months of friendly conversation which eventually moves on to much serious topics on emotional scenarios, financial advices etc., over a period of time you started trusting your new friend and one day they inform you about a highly successful investment they did in a newly emerging crypto currency platform which is the future of crypto investments and recommend you to invest in it

Initially you are bit hesitant, and you invest less, but the investments doubled. Wow! This currency is for real. Let me invest more. After investing a huge amount in crypto while waiting for it to get doubled you are realising slowly no one responding and when you realised you have been scammed the threat actor deletes the website and move on to their next victim. 

You Have Been Scammed!!!! 

Proofpoint have shared a detailed article on this cryptocurrency-based social engineering scheme, Pig Butchering AKA Sha Zhu Pan.

Now Let’s dig into details of how the attacker lure their victims and gaining the trust.

The name ‘Pig Butchering’ refers on how the scammers feed the victim(pig) with so many hopes and false promises and eventually making them ready for getting looted (Butchering).

Pig Butchering Cryptocurrency Fraud initially targeted the Chinese audience and then slowly moved to English speaking countries.

Phase 1:Introducing the Treat Actor

The conversation mostly starts from an attractive polite stranger on the internet, they start with pleasantries and mind capturing conversations while they complement, empathise with the victim. 

Slowly they start chatting for weeks and establish a strong emotional connection with the victim sharing their experiences and finer things in life. If the Victim is in social media apps like LinkedIn, twitter, Instagram etc the treat actor will request the victim to connect over WhatsApp which is more private and trustable platform. Most of the times they establish a romantic relationship with the victim and share racy “selfies” to make the victim reciprocate the same (which will be used in later stages for blackmailing).

As these conversation progresses and the attacker feels the trust with victim is established, they will invite the victims to chat with their so called ‘investment mentors’ on how to make more money and how the threat actor have created a lot of profit out of it.

Credits: Proofpoint

Phase 2: The Kind Uncle who helps you invest!

One the rapport is established the ‘investment mentor’ or the ‘kind uncle’ will send the victim cryptocurrency investing documents on how to set up coin base or crypto account. One of the integral parts of the scheme is to create a cryptocurrency wallet if the victim doesn’t have one. The scammers will work with the victim individually or ask them to join group chats mostly on WhatsApp, telegram and Discord where the victim meets so many people investing and making money as per the advice of the “Plan Analyst” the one who leads the group.

Ultimately after all the convincing, the victim will be led to fake crypto currency website or mobile applications and will be requested to purchase a small amount of crypto by the treat actors, this will be mainly on Tether (USDT) in crypto.com or coinbase.com. The threat actor will make sure that the victim purchased by requesting a screenshot, the actors will specifically request to invest less than $1000. If the victim complies to all the requirements set by the treat actor, they will be provided with 10% to 20% reward which will be reflected immediately in their wallet.

Once the reward is received the ‘plan analyst’ will congratulate you and also inform you on the urgency on investing in crypto as it is a volatile market. Hence slowly step by step after investing in small amounts and getting rewards the attacker will urge you to invest in a huge amount, here the treat actors are putting victims into a behavioural pattern known as  “classic conditioning” where the victims mind is trained on receiving the rewards. In this case the victim believes in attacker as he was receiving rewards from previous investments.

An image of fake crypto website captured by Proofpoint

Phase 3: Fattening Up the Pig

Once the victim is convinced by the attacker and see profits in their wallet, the trust also increases and they are ready to invest high, a.k.a Fattened up, the attackers will encourage in putting large investments by taking loan, sell stocks etc and invest in the fake crypto.

Once the victim starts to worry, they will be asked to take out only small amounts and convince that the rest of the amount should not be taken out.

In the end when the victim realises that they have been scammed the attacker deletes the website and starts hunt for other victims.

On the Killing Floor

Pig butchering type of scams are most of the times highly successful due to the intimate conversations with the victim which makes it more trustable. The empathetic and emotional manipulations, friendly conversation exploits the genuine feelings of the victim. The attacker often shares fake sad and emotional stories in order to gain trust and empathy from the victim.

The threat actors are highly trained on not to click any links. When Proofpoint researchers shared URL to trace the treat actor they were blocked immediately.

Credits: Proofpoint

As per the statistics shared by FBI In 2021 more that 4300 cases were received on crypto-romance scams which lead to more than $429 million in losses.

How to Prevent Social Engineering Attacks

The U.S. Federal Bureau of Investigation (FBI) have shared few steps on How to avoid being a social engineering victim

  • Your financial details should never be shared to any stranger you have met online
  • Do not take advice from strangers and invest accordingly   
  • Never provide your personally identifiable information such as social security number bank details or other identification proofs under any circumstances to people over internet.
  • Never fall for unbelievable profits on any trading sites.
  • Be cautious on people, mails, text where they urge you to invest anywhere.

Indicators of Compromise

zvip[.]zonePig   Butchering Domain
xtfkskpk[.]buzzPig   Butchering Domain
meymytum[.]xyzPig   Butchering Domain
vwtryf[.]xyzPig   Butchering Domain
eumfpbva[.]xyzPig   Butchering Domain
nhealcoin[.]ccPig   Butchering Domain
zvip[.]zonePig   Butchering Domain
hitbicvip[.]comPig   Butchering Domain
hitbic[.]netPig   Butchering Domain
oslint[.]comPig   Butchering Domain
maskexc[.]comPig   Butchering Domain
coinss[.]proPig   Butchering Domain
qklyz[.]comPig   Butchering Domain
coinline[.]proPig   Butchering Domain
skgroup[.]vipPig   Butchering Domain
galaxycoin[.]vipPig   Butchering Domain
nhchain[.]vipPig   Butchering Domain
lanbing[.]clubPig   Butchering Domain
fwhtoken[.]comPig   Butchering Domain
s-coin[.]vipPig   Butchering Domain
walletput[.]comPig   Butchering Domain
okx-us[.]netPig   Butchering Domain
mitokenex[.]comPig   Butchering Domain
flyscoin[.]comPig Butchering   Domain
autoecofxmarkets[.]comPig   Butchering Domain
ensf[.]agencyPig   Butchering Domain
shopwse[.]comPig   Butchering Domain
beybit[.]comPig   Butchering Domain
bihuo[.]topPig   Butchering Domain
bn93[.]comPig   Butchering Domain
sklge[.]comPig   Butchering Domain
tgbone[.]comPig   Butchering Domain
rkez[.]xyzPig   Butchering Domain
bitget-tw[.]comPig   Butchering Domain
cme-cn[.]comPig   Butchering Domain
kucoinusa[.]comPig   Butchering Domain
266wrd[.]comPig   Butchering Domain
financeaka[.]ccPig   Butchering Domain
ettsmc[.]ltdPig   Butchering Domain
bilinkbitex[.]comPig   Butchering Domain
engiegpg[.]comPig   Butchering Domain
aax[.]newsPig   Butchering Domain
ftxcn99[.]comPig   Butchering Domain
pinduoyu[.]comPig Butchering   Domain
hkdbitexchange[.]comPig   Butchering Domain
acefinex[.]comPig   Butchering Domain
acefinex[.]netPig   Butchering Domain
acefinex[.}vipPig   Butchering Domain
eumfpbva[.]xyzPig   Butchering Domain
meymytum[.]xyzPig   Butchering Domain
okx-us[.]netPig   Butchering Domain
s-coin[.]vipPig   Butchering Domain
vwtryf[.]xyzPig   Butchering Domain
xtfkskpk[.]buzzPig   Butchering Domain
mitokenex[.]comPig   Butchering Domain


Every day we hear about multiple cyber-attacks happening all around the world, but as an individual we will be least bothered as you may think how it will affect you.

The above post would have given a detailed idea on how threat actors can impact a common man, we also learned how to avoid being a social engineering victim. Everyone should be always alerted on their surroundings and very careful while sharing personal information on internet.

Please share this post and help to secure the digital world. Visit our social media page on FacebookLinkedInTwitterTelegramTumblr, & Medium and subscribe to receive updates like this. 

About the author

Aroma Rose Reji

Aroma is a cybersecurity professional with more than four years of experience in the industry. She has a strong background in detecting and defending cyber-attacks and possesses multiple global certifications like eCTHPv2, CEH, and CTIA. She is a pet lover and, in her free time, enjoys spending time with her cat, cooking, and traveling. You can connect with her on LinkedIn.

Leave a Reply

Your email address will not be published. Required fields are marked

{"email":"Email address invalid","url":"Website address invalid","required":"Required field missing"}

Learn Something New with Free Email subscription

Email is also one of the ways to be in touch with us. Our free subscription plan offers you to receive post updates straight to your inbox.