Laundering pig butchering scam proceeds

As of October 2026: Figures and enforcement actions are stated as checked on the dates of the sources above. The June 2025 forfeiture is a civil complaint, and the December 2023 Los Angeles indictment is an allegation; the final outcome of neither was confirmed for this page. The Prince Group indictment and forfeiture complaint are allegations and civil claims that remain contested. The proposed Huione successor-entity measure is not final. The Strike Force total of about $938 million is as reported on September 9, 2026 and will have changed. The IC3 report is the FBI's tally of complaints, not a measure of total losses.

Also called: investment scam laundering · romance-investment fraud proceeds · crypto confidence scam laundering.

What is pig butchering proceeds laundering?

Pig butchering is a fraud first and a laundering problem second. Scammers earn a victim’s trust over weeks or months, then guide them to a fake investment website that shows made-up profits. By the time the victim realizes the platform is not real, the money has already moved. Laundering is the part of the operation that turns those deposits into money the criminals can spend, and it is where law enforcement now concentrates much of its effort.

The scale explains why. The FBI’s 2025 Internet Crime Report counted 61,559 cryptocurrency investment fraud complaints with $7.228 billion in reported losses, an increase of 48% in complaints and 25% in losses from the year before. The UN Office on Drugs and Crime estimates that scam centres in Southeast Asia make just under $40 billion a year in profit. Many people working inside those compounds are not willing participants: FinCEN’s 2023 alert notes that a significant number of the people who contact victims are likely victims of human and labor trafficking themselves.

This page covers what investigators call the back end of the scam: how the stolen money is hidden and converted. It uses only what authorities have made public, and it reads the evidence from the investigator’s side of the table. For the front end of the fraud, see the case study on Huione and Prince Group.

How are the proceeds moved?

Public enforcement records describe a broadly consistent chain.

1. Collection. The victim buys cryptocurrency, sometimes at an exchange and sometimes at a kiosk, and sends it to an address supplied by the scammer. FinCEN’s alert notes that victims may also be told to wire money overseas or buy prepaid cards. The deposit address belongs to the scammers, even though the fake website makes it look like an investment account.
2. Splitting and swapping. The scammers do not leave the funds where they land. In a case FinCEN describes, victim deposits were moved at once through numerous private wallets and swapping services. DOJ’s June 2025 complaint describes a network that spread proceeds across many addresses and accounts through hundreds of thousands of transactions, and its October 2025 Prince Group filing describes funds being repeatedly broken up across scores of addresses and then re-consolidated into fewer ones. The aim is to break the visible link between each victim and the final destination, much like chain-hopping.
3. Conversion to a stable asset. Stolen coins are commonly swapped into stablecoins so that their dollar value is steady while they move. The technique and its risks are covered in stablecoins and OTC desks.
4. Buying laundering services. Many operations do not clean the money themselves. They pay specialist vendors, who advertise on guarantee marketplaces: online platforms where a third party holds the buyer’s payment in escrow until the service is delivered. Treasury and DOJ described Xinbi Guarantee this way in September 2026. FinCEN said Haowang Guarantee (formerly Huione Guarantee) deals in illicit goods and services like a darknet market, but on the open internet.
5. Off-chain conversion. The vendor turns crypto into bank balances or cash. This often uses money mules, shell companies and accounts opened for the purpose. In a December 2023 Los Angeles indictment, prosecutors alleged four people opened shell companies and bank accounts to receive more than $20 million in victim funds from a syndicate whose scheme involved at least 284 transactions and over $80 million in losses.
6. Re-entering the legitimate economy. DOJ’s October 2025 indictment of Prince Group’s chairman alleges that proceeds were laundered through professional money laundering operations and through the group’s own ostensibly legal businesses, including online gambling and cryptocurrency mining. Treasury separately designated 117 Prince-linked businesses, the vast majority of them offshore shell companies that engage in no apparent real commercial activity.

Why does it work?

Three things make this laundering model hard to stop.

Speed and volume. Crypto moves across borders in minutes, so funds can be through dozens of hops before a victim files a report. The June 2025 case alone involved hundreds of thousands of transactions. The sheer number of hops creates noise for investigators and for the analytics tools that trace them.

A service economy. The scam operators and the launderers are separate businesses. A vendor on an escrow marketplace does not need to know or care how the money was stolen to be paid for moving it, and the marketplace takes a cut. UNODC’s April 2025 release describes the region as an interconnected ecosystem in which scam groups are supported by adjacent money laundering networks and illicit online markets. When a vendor is shut down, another fills its place, which is why FinCEN proposed in June 2026 to extend its Huione measure to a named affiliate and to any successor entity. That proposal is not final.

Cash-out through ordinary-looking accounts. The weakest point for any laundering chain is where crypto meets a regulated bank or exchange. Criminals use mule accounts, shell companies and cooperative businesses to make those steps look routine. Where authorities are slow to act or compounds sit in weakly governed zones, the chain can hold together for years.

None of these strengths is permanent. A public blockchain is a permanent record, and the stablecoin issuers, exchanges and banks that touch the funds can be asked to freeze them.

A real case: the $225 million network and the marketplaces behind it

In June 2025, DOJ filed a civil forfeiture complaint in the District of Columbia against more than $225.3 million in cryptocurrency. Prosecutors said blockchain analysis and other investigative techniques tied the funds to the theft and laundering of money from victims of cryptocurrency confidence scams. The complaint alleges the addresses holding the funds were part of a blockchain-based laundering network that carried out hundreds of thousands of transactions to disperse proceeds and conceal where they came from. More than 400 suspected victims were believed to have lost money. DOJ called it the largest cryptocurrency seizure in US Secret Service history and thanked Tether for its proactive assistance.

The same approach has since moved up the chain, from individual wallets to the businesses that serve scammers. In October 2025, FinCEN finalized a rule cutting Huione Group off from US correspondent banking, OFAC sanctioned 146 targets in the Prince Group network, and the UK imposed its own sanctions the same day. On September 9, 2026, Treasury designated Xinbi Guarantee as a transnational criminal organization, along with two technology companies that supported it. DOJ’s Scam Center Strike Force restrained about $52 million in cryptocurrency the same day. Authorities said the marketplace had vendors advertising laundering services and posting wallet addresses for payment, which allowed investigators to trace victim funds to those vendors.

How does it get caught?

Investigators have several overlapping ways in.

• Following the ledger. Because transactions on public blockchains are recorded permanently, analysts can cluster wallets that behave like a single collection point and follow the funds forward. DOJ’s 2025 complaint rests on this kind of blockchain analysis.
• Freezes by issuers and exchanges. Stablecoin issuers and exchanges can freeze tokens or accounts when asked. DOJ thanked Tether for proactive assistance in the $225 million case, and the Strike Force thanked Tether again in September 2026.
• Victim reports and bank signals. FinCEN’s alert asks banks to watch for customers with no crypto history who suddenly send large sums to exchanges, who liquidate savings early, or who take out home equity loans to fund purchases. These are victim-side signals that point to the laundering wallets. Banks are asked to reference the alert in suspicious activity reports, which gives investigators a searchable set of leads. The FBI’s Operation Level Up notifies victims of crypto investment fraud, and the 2025 report says 78% of the 3,780 victims notified in 2025 did not know they were being scammed.
• Targeting the infrastructure. Section 311 rules, sanctions, domain seizures and marketplace takedowns remove services that scam operators rely on. They also put every bank and exchange on notice that dealing with the named entity creates legal risk.
• Cash-out accounts. Shell companies and mule accounts have real owners, real addresses and bank records, so money laundering charges are often easier to prove than the original fraud, which was run from abroad.

The pattern across these cases is that laundering success depends on the weakest regulated step, and that step is also where investigators have the best chance to see who is behind the money. For the broader picture of how tips and analytics turn into cases, see the detection overview.

First published October 4, 2026 · Last updated October 4, 2026 · Legal statuses current as of October 2026