The chat side of pig butchering is well documented: the wrong-number text, the weeks of friendly conversation, the “look at my uncle’s trading group”, the platform that shows your balance going up. We have covered the scripts ourselves, both the social media playbook and a real Telegram pitch script we let run to completion. This piece is about the other half that almost nobody sees: where the money physically goes after you click “deposit”, and why that path determines whether anyone can ever freeze a cent of it.

Everything below is anchored on public records, mostly the DOJ’s own arrest announcement and sentencing release, because the $73 million Daren Li case is one of the few pig butchering laundering pipelines ever mapped end to end in public.

The four-stage pipeline

Strip away the branding and every pig butchering operation moves money through the same four stages. The details differ per gang, the sequence does not.

Stage 1: collection rails. Victim money lands in accounts controlled by the syndicate. Two forms dominate. If you paid by bank wire, your money went to a bank account opened under a business name that looks boring and real. In the DOJ’s case, victims were “fraudulently induced into transferring millions of dollars to U.S. bank accounts opened in the names of dozens of shell companies whose sole apparent purpose was to facilitate the laundering of fraud proceeds.” If you paid in crypto, your money went to deposit addresses shown inside the fake platform, addresses whose only job is to accept victim funds and forward them.

Stage 2: layering. The network of launderers moves the money between accounts, banks and jurisdictions “in a manner designed to conceal the source, nature, ownership, and control of the funds”, as the indictment language puts it. In the Li/Zhang operation, lower-level conspirators transferred proceeds overseas to accounts at Deltec Bank in The Bahamas, and the leaders monitored them. Layering is also where commissions get paid: the DOJ found chats discussing the network’s commission structure, the shell companies in use, and victim information.

Stage 3: conversion to stablecoins. This is where the money becomes crypto. In the Li/Zhang pipeline, funds in The Bahamas were converted to USDT and sent to virtual-asset wallets, including at least one controlled by Li himself. This matches the wider pattern found by University of Texas finance professor John Griffin and graduate student Kevin Mei, who traced flows from more than 4,000 victim addresses: networks moved more than $75 billion to crypto exchanges between January 2020 and February 2024, and 84% of the transaction volume across addresses the criminals touched was in Tether. USDT is not chosen for ideological reasons. It is the most liquid dollar rail with the deepest over-the-counter market, so a syndicate can hold, split and spend it without ever touching a bank again until cash-out.

Stage 4: cash-out and payroll. The consolidated wallets pay the operation: the compound in Southeast Asia, the recruiters, the money mules, the next round of infrastructure. One wallet involved in the Li/Zhang scheme received more than $341 million in virtual assets, which tells you a single pipeline of this shape was moving serious volume. At the end, funds re-enter the financial system through exchanges, OTC desks or connected businesses, now wearing a clean story.

Notice what is missing: at no stage does the victim’s “balance” on the platform correspond to a real account holding real money. The number on your dashboard is a rendering. The money left the moment you sent it.

Anatomy of the $73 million case

The timeline, from the DOJ’s releases:

  • April 12, 2024: Daren Li, 41, a dual citizen of China and St. Kitts and Nevis with residences in China, Cambodia and the UAE, is arrested at Hartsfield-Jackson Atlanta International Airport.
  • May 16, 2024: Yicheng Zhang, 38, a Chinese national living in Temple City, California, is arrested in Los Angeles. An indictment unsealed in the Central District of California charges both with conspiracy to commit money laundering and six counts of international money laundering.
  • November 2024: Li pleads guilty.
  • Before sentencing: Li flees, becoming a fugitive.
  • February 9, 2026: Li is sentenced in absentia to 20 years in federal prison for his role in the $73 million global cryptocurrency investment scam.

The mechanics matter more than the headlines. Victims sent money to US shell company bank accounts. Lower-level conspirators, monitored by Li and Zhang, moved the proceeds to Deltec Bank in The Bahamas, where one account was operated with Li’s financial assistance. The money was converted to USDT and pushed to wallets, at least one controlled by Li. Zhang also directly received victim funds. Among the evidence: communications coordinating the laundering network, chats about commissions and shell companies, victim information, and at least one video of a conspirator calling a US financial institution.

Read that last item again. A money launderer, on a video call with a US bank, talking his way around a compliance question. The scam’s weakest link was never the blockchain. It was every moment a human had to interface with a regulated institution.

What the numbers say about the machine’s direction

Individual cases understate the industrial scale:

  • The FBI’s Internet Crime Complaint Center logged $16.6 billion in reported losses across 859,532 complaints in 2024, up 33% year over year, and investment fraud involving cryptocurrency was the largest loss category at more than $6.5 billion. The 2025 report crossed $20 billion.
  • Chainalysis measured pig butchering revenue growing nearly 40% in 2024, while the number of deposits to pig butchering scams grew nearly 210% and the average deposit fell 55%. Read together: more victims, smaller takes, less time spent priming each target. The romance is becoming a funnel, not a craft.
  • The Griffin/Mei study put four years of network flows at more than $75 billion to exchanges, with $15 billion arriving from just five exchanges commonly used by Western victims.

If a stranger’s patience feels cheaper than it used to, that is not your imagination. It is measurable on-chain.

What you can trace yourself, and where it dies

Say you paid the platform in crypto from your own wallet. You hold the one artifact investigators actually need from you: the transaction hashes and destination addresses. Here is the realistic self-trace:

  1. Collect every deposit address the platform showed you, and every transaction hash from your wallet or exchange history.
  2. Follow each address on a block explorer. Watch for the first hop: consolidation into larger wallets, sometimes after passing through a mixer.
  3. When funds land at a labeled exchange deposit address, note the exchange and the timestamp. Public wallet labels take you this far without any special tooling. Our deeper walkthrough of this process, including how attribution works, is in how to track stolen crypto.
  4. Stop and write down the timestamp when the trail enters an exchange. That is usually the end of the public trail, because from there the money lives inside a KYC boundary that only law enforcement with a request can open.

Now the honest limits. If you paid by bank wire, there is nothing on any blockchain, because your money was never on one. Your trace is your wire confirmation and the receiving account details, which is bank-domain evidence. And even a perfect on-chain trace does not freeze anything by itself. Tracing tells you where the money is. Freezing requires either an exchange willing to act on a law enforcement request or a bank responding to one. That is a legal process, not an explorer search.

This is why the recovery narratives that matter are the legal ones: how stolen crypto is actually recovered through freezes, seizures and forfeiture, and the first 24 hours runbook for building the evidence file while the trail is warm.

The evidence chain that survives

The DOJ’s own victim guidance for this exact crime type is specific. When you file at IC3.gov, reference “Pig Butchering PSA” and include: names of investment platforms, cryptocurrency addresses and transaction hashes, bank account information, and names and contact information of suspected scammers. Maintain copies of all communications and records of financial transactions.

That list is the answer to “what do I actually hand the police”. We walk the full reporting path, including what happens after you file and how to write exchange freeze-request emails, in how to report a crypto scam. Two points deserve repeating here:

  • Bank transfer records are not second-class evidence in these cases. The Li/Zhang prosecution was built on the banking leg. Wire confirmations with the shell company account names are precisely what lets a report join an existing investigation.
  • Chat logs with timestamps are the map of intent. Screenshots lose metadata; export where possible.

And the part nobody wants to hear: the moment your loss becomes public or semi-public, recovery predators arrive. The DM saying “we specialize in fund recovery” comes from the same industrial ecosystem. The tells and the fee structures are documented in crypto recovery scams explained. No one legitimate finds you first.

Stopping the money before it moves

Every stage above only exists because a payment was made. The pre-payment tells are consistent: you cannot withdraw during a “special earning period”, withdrawals require a tax or unlock fee, the platform appeared after weeks of private coaching, and the deposit instructions come from a person, not an institution. If the “platform” ever asks you to connect a wallet and approve token spending, that is a separate and worse trap: an infinite approval hands over future access to everything in that wallet, no further chat required.

Two adjacent patterns worth knowing while you are here: fake trading volume is how these platforms look “alive”, and our guide to detecting NFT wash trading covers the same volume-faking mechanics from the collectibles side; and “free money” lures like airdrop claims are the low-trust entry point into the same deposit-address world, covered in the airdrop safety checklist.

The scam starts with someone being nice to you and ends with a shell company in a bank ledger. The defense is unglamorous: verify the institution, refuse fee-to-withdraw logic, never approve unlimited token access, and if it is already done, preserve the evidence and file fast. The system did put a 20-year sentence on one of the people running this pipeline. It started with paperwork, not magic.

Frequently Asked Questions

Can stolen pig butchering money be traced on the blockchain?

The crypto leg, yes, partially. Once you have the deposit addresses the fake platform gave you, you can follow transfers on a block explorer and see where funds consolidate or hit exchange deposit addresses. The trail routinely dies at two points: when funds enter an exchange account (attribution requires the exchange and usually law enforcement) and when the original payment was a bank wire, which never touches a blockchain at all. That is why the FBI asks pig butchering victims for bank account information alongside crypto addresses and transaction hashes.

Why do pig butchering gangs convert proceeds to USDT?

USDT combines liquidity, around-the-clock transferability, and a huge over-the-counter market where large amounts can be exchanged with minimal questioning. In the University of Texas tracing study that estimated over $75 billion moved by these networks from 2020 to early 2024, 84% of transaction volume across touched addresses was in Tether. In the DOJ's $73 million case, funds went through US bank accounts to Deltec Bank in The Bahamas and were converted to USDT before reaching wallets controlled by the syndicate.

What evidence should a pig butchering victim preserve for a report?

Exactly what the DOJ lists for IC3 reports: the platform name and any app or website URLs, every wallet address you were told to send to, transaction hashes for each transfer, bank account details if you wired money, and complete chat logs with the scammer, plus records of every payment. Keep timestamps in their original timezone. File at IC3.gov and reference 'Pig Butchering PSA' so the complaint routes to the right pipeline. Report within the first 24 hours if possible; the money chain is still warm.

The fake platform still shows my balance. Can I withdraw if I pay a 'tax' or 'fee' first?

No. The balance is a number in a database you do not control. Requests for tax payments, unlocking fees, or margin top-ups to 'release' a withdrawal are the final extraction round; paying them adds a new loss and a new payment trail. This pattern is consistent across pig butchering cases. Stop paying, preserve the evidence, and report. Anyone who then contacts you promising recovery for an upfront fee is running the second scam that follows the first.

Was anyone actually sentenced for pig butchering laundering?

Yes. Daren Li, described by the DOJ as a leader of a syndicate that laundered more than $73 million from cryptocurrency investment scams, pleaded guilty in November 2024, fled before sentencing, and was sentenced in absentia to 20 years in federal prison on February 9, 2026. Co-defendant Yicheng Zhang was arrested in Los Angeles in May 2024. The investigation was built on the banking leg, bank records and shell company accounts, not on chain analytics alone.