Investment scams are now most of crypto fraud: following the pig-butchering money out

Investment scams were 62% of crypto fraud in 2025

TRM Labs reports that investment-related schemes made up 62% of crypto fraud inflows in 2025. Within that category, it names pig butchering and Ponzi schemes among the most prominent types.1

Pig butchering is a long-con investment scam. The scammer builds trust over time, often through a romance or a friendship, then steers the victim into a fake investment platform. The "butchering" is the moment the scammer takes everything and disappears.3

TRM also reports that the types are converging. One case can start as a romance, turn into a fake investment, and end with demands for "taxes" or "fees" to release the funds.1

Stablecoins carried about 84% of verified fraud inflows in 2025, up from about 70% in 2024.1 Chainalysis observed at least $14 billion in crypto scam and fraud receipts in 2025 and projects that the full figure will exceed $17 billion. It also found that the average scam payment rose from $782 to $2,764.2

The two firms count differently, so their totals don't match. Neither publishes a separate share for pig butchering.

The rules: FinCEN's red flags, the Huione ban and Australian SMRs

The Financial Crimes Enforcement Network (FinCEN) issued alert FIN-2023-Alert005 on 8 September 2023. It describes the scam and lists behavioural, financial and technical red flags. It names bitcoin, ether, tether (USDT) and TRX among the assets used.3

The alert asks US filers to tag their reports:

"FinCEN requests that financial institutions include the key term 'FIN-2023-PIGBUTCHERING' in SAR field 2 (Filing Institution Note to FinCEN) and the narrative."3

Filers should also select "Fraud-Other" in SAR field 34(z), with the description "Pig Butchering".3

The second rule targets the laundering layer. On 14 October 2025 FinCEN finalised a rule under section 311 of the USA PATRIOT Act against Cambodia-based Huione Group. FinCEN described Huione as "a critical node for laundering proceeds" of North Korean cyber heists and of Southeast Asian pig-butchering scams.4 US covered financial institutions can no longer hold correspondent accounts for Huione Group. They must also take reasonable steps to stop it reaching the US system indirectly.4

Both actions have moved on since. On 23 June 2026 FinCEN proposed amending the Huione rule to cover H-Pay Service PLC and any successor entity, and OFAC sanctioned nine more individuals and 26 entities linked to Prince Group.11

In Australia, the reporting route is the suspicious matter report (SMR) under the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (AML/CTF Act).

Who has to act: exchanges, banks and payment firms

The section 311 rule binds US institutions only. For firms outside the US, exposure to Huione Group is a strong risk indicator.

Timeline

1. 8 September 2023

   FinCEN issues FIN-2023-Alert005 on pig butchering.3

2. May 2025

   FinCEN identifies Huione Group as a primary money laundering concern and proposes the rule.4

3. 14 October 2025

   FinCEN finalises the Huione rule. OFAC sanctions 146 targets in the Prince Group network. DOJ unseals an indictment against Prince Group chairman Chen Zhi and files to forfeit about 127,271 bitcoin, then worth about $15 billion. The UK sanctions the same network.4, 5, 6, 7

4. 13 January 2026

   Chainalysis projects that 2025 scam and fraud losses will exceed $17 billion.2

5. 26 February 2026

   US authorities say the Scam Center Strike Force has frozen or seized more than $580 million in crypto.8

6. 4 June 2026

   AUSTRAC cancels the registration of BA Digital Ventures, trading as GetCoins. AUSTRAC said the exchange was "allegedly exploited by organised cryptocurrency investment scams".9, 13

7. 23 June 2026

   OFAC sanctions nine individuals and 26 entities linked to Prince Group. FinCEN proposes extending the Huione rule to H-Pay Service PLC and any successor entity.11

Where the money goes after the victim pays

DOJ's release in the Prince Group case describes the exit route in detail.6 TRM's research adds the settlement layer.1

In. The victim buys crypto, usually through an exchange or a bank transfer, and sends it to an address the scammer controls. By TRM's count, most of that money now moves as stablecoins.1

Layered. DOJ says Prince Group used "spraying" and "funneling". Large volumes were "repeatedly disaggregated across scores of virtual currency addresses and then re-consolidated into fewer addresses".6

Settled. TRM describes Chinese-language "guarantee" marketplaces as a central settlement layer for laundering across Asia-Pacific. It puts volume at about $73.0 billion for Huione Pay, $7.3 billion for Haowang, $5.9 billion for Xinbi and $3.0 billion for Tudou.1 When enforcement hit the largest hubs, flows moved to Tudou, which TRM says took in about $70 million a week from May to November 2025.1

Out. DOJ says some proceeds "were ultimately held in wallets at cryptocurrency exchanges or exchanged for traditional currency and stored in traditional bank accounts".6 Prince Group also laundered through its own online gambling and crypto mining businesses.6 In the UK, the sanctioned network had bought a £12 million mansion and a £100 million office building in London.7

Chainalysis finds that impersonation scams launder through decentralised finance, while other scams, pig butchering among them, still rely heavily on centralised exchanges. Pig-butchering use of exchanges has declined as Chinese money laundering networks have grown.2

A regulated exchange sits at two of the four stages, the deposit and the exit, and a compliance team can act at both.

What to check in your customers and transfers

KYC and customer risk

• Look for customers with no crypto history whose first activity is a large purchase or a high-value transfer to a VASP. FinCEN lists this as a behavioural red flag.3
• Ask about the source of funds when a customer breaks a term deposit or draws on home equity to buy crypto.3

KYT and screening

• Screen deposits and withdrawals for exposure to Huione Group, H-Pay Service, Prince Group and their designated affiliates.4, 5, 11
• Alert on many-in, few-out consolidation patterns in the hops before a withdrawal to fiat.
• Treat guarantee-marketplace exposure as high risk, including successor platforms. TRM's data shows flows move when a hub is shut.1

Investigations

• When you confirm one victim, trace the funds forward to the consolidation address. Then check which other customers sent funds there.
• Check login records for new devices, IP addresses or locations. FinCEN lists these as technical red flags.3

Reporting

• In the US, use the key term FIN-2023-PIGBUTCHERING in SAR field 2 and the narrative.3
• In Australia, file an SMR. Name the typology and the consolidation addresses in the narrative.

Not yet public: pig butchering's share, the Prince Group outcomes and Australian crypto losses

What Cogentic handles, and what your team keeps

Cogentic's agents turn alerts into investigations, trace the transfers behind them and draft suspicious matter reports. An investigation records the counterparties, the exposure found and the evidence behind each step. An analyst who traces one victim to a consolidation address has that trace, and its evidence, in the case file.