Pig-Butchering Scams: 7 Variants and the Script Behind Them

A conventionally attractive match on Hinge wants to move to WhatsApp by message three. Conversation stays normal for 2–6 weeks; then her "uncle" who works in finance starts sharing trading "signals." A small test deposit shows fake profits. The full deposit cycle ends at $15K–$500K with no money returned.

A 28-year-old in tech matches with "Linda" on Hinge: Stanford grad, lives in LA, currently traveling. Within three messages she suggests they move to WhatsApp because "I don't check Hinge much." For five weeks they exchange daily life updates and cooking photos. Then she casually mentions her uncle who works at a hedge fund and runs a private "signals group." She made $3,000 last month, she says, and is happy to share entries. She sends a screenshot of her exchange dashboard. He puts in $500 as a test. The platform shows $740 by morning. He withdraws $200 successfully and the platform looks real.

Over the next two months he deposits $15,000 in tranches. The platform shows $42,000. When he tries to withdraw the full balance, the support chat tells him he must pay a 10% "withdrawal tax" to the IRS first: a $4,200 deposit, refundable on completion. He pays it. Then it's a 20% "liquidity verification fee." He pays that. Then his "account is flagged for compliance review" and requires another deposit to unlock. At $32,000 in total he stops, googles the platform name, and finds the r/CryptoScams thread describing his exact scenario.

The r/CryptoScams thread "Just realized I'm in a 'Pig Butchering' scam. $15k gone" (153 upvotes as of Apr 2026) describes the script almost verbatim: Hinge match, WhatsApp pivot, "uncle's signals," small successful withdrawal, escalating deposits, withdrawal-tax wall. The top reply: "The second I saw side hustle crypto trading, first flag." A separate r/Scams thread, "[US] I think I nearly got pig butchered" (469 upvotes), captures the same arc with a near-miss ending. The single decision rule that breaks the funnel: no one you have not met in person should ever be giving you crypto trading advice. Linda is not Linda. She is a workforce in a guarded compound.

The dating-app pivot is the most-documented entry, but it is no longer the most common. The dominant 2025–2026 entry vector arrives in your text messages.

A text arrives from an unknown number: "Hi Sarah, still on for dinner Thursday?" You reply that they have the wrong number. They apologize warmly, compliment your reply, and start a conversation. Six weeks later they introduce you to a crypto trading group. The arc is identical to the dating-app variant — the entry channel is the only difference.

The "wrong number" opening is now the dominant pig-butchering entry point in 2025–2026 because the dating apps have started flagging the WhatsApp pivot. The text ("Hi Sarah, still on for dinner Thursday?" or "Dr. Chen, confirming our 2 p.m. appointment") is sent in batches to phone numbers harvested from data-breach lists, real-estate transactions, and political-donor records. The script is built around the moment of correction: when you reply "wrong number, sorry," the scammer seizes the polite tone to start a real conversation. They pivot to "what a nice response, you seem cool, want to chat?"

Over four to eight weeks the relationship deepens: daily check-ins, photos, life updates, sometimes voice messages (often AI-generated to bypass the "send me a video" test). The scammer is patient because the operation runs at scale. USIP and other investigators describe compound operators running multiple parallel targets, paid by conversion rather than by hour. The crypto pivot is the same as the dating-app variant: an "uncle" or "trading mentor" with signals, a small test deposit on a fabricated exchange, mounting profits, and a withdrawal-tax wall.

Carriers' SMS spam filters miss the wrong-number text because the message is short, polite, and contains no obvious scam keywords. r/Scams threads show the same wrong-number text arriving simultaneously to dozens of users from different spoofed numbers; the giveaway is that the "Sarah" or "Dr. Chen" name in the text is generic enough to be a mass mailer. If a wrong-number text from an unknown sender keeps replying after your correction, it is not a misdial. It is the opening of a pig-butchering script. Block the number and delete the thread.

The wrong-number variant works because the target is unsuspecting. The next variant works because the target thinks they are too professional to be scammed.

A LinkedIn message from a "Senior VP at JPMorgan" or "Portfolio Manager at Bridgewater" invites you to a private trading group, mentor circle, or "Web3 alpha" Discord. The vetting is fake; the curriculum is fake; the "live trading session" is a screen-share of a fabricated dashboard. The end-game is the same fake-exchange deposit cycle.

The LinkedIn variant has accelerated since 2024 because professional contexts disable the "this looks too good to be true" filter that dating-app users have learned to apply. The DM typically reads: "Hi [your first name], I'm building a small private group of operators interested in algorithmic trading. Looked at your profile and thought you'd be a fit. Drop me a WhatsApp if you'd like to learn more." The sender's profile shows 500+ connections, a polished headshot, a recognizable employer, and a carefully assembled work history. Most details are fabricated; the ones that are real are scraped from the actual person being impersonated.

Once you join the WhatsApp or Telegram group, the production value escalates. There are 30–80 other "members": some are bots, some are co-conspirators, a few may be other victims who don't yet know they're being farmed. The "mentor" runs daily "trading sessions" with screen-shared dashboards showing 8–15% daily gains. New members are encouraged to start with a "test trade" on the recommended platform (always one you haven't heard of). Within four to six weeks, the same withdrawal-tax wall appears.

The r/jobs and r/recruitinghell archives in 2025 show LinkedIn variants targeting recently laid-off tech workers, a particularly cruel pattern that exploits financial anxiety. A common giveaway: real recruiters at JPMorgan, Goldman, or Bridgewater never message strangers about private trading groups; they recruit via formal hiring processes, and they would lose their licenses for soliciting investment outside that. The "Discord trading class" variant is a 2026 evolution that adds a paid "membership tier" before the platform pitch (a $200 entry fee that doubles as identity-verification of a willing victim). Any LinkedIn DM that ends with "drop me a WhatsApp" is the opening of a pig-butchering script. Block, report, and never engage off-platform.

All three entry variants converge on the same trap. Whether you arrived via Hinge, an SMS misfire, or a LinkedIn pitch — the deposit cycle ends in the same place.

You see $42,000 on the dashboard and try to withdraw it. The "support" chat tells you the IRS requires a 10–20% withholding tax paid up front, refundable on transfer. You pay; then it's a "liquidity fee," then a "compliance review deposit." Each escalation is sized to the apparent balance. The withdrawal never happens — but the additional deposits do.

The withdrawal-tax trap is the single most lucrative phase of the pig-butchering economy because it activates after the victim has already crossed every other psychological barrier. The platform shows substantial profits (typically 2x to 5x the deposited amount), and the request to withdraw triggers the second-stage script. The first ask is almost always framed as a tax obligation: "Per IRS regulations, capital gains tax of 10% is collected at withdrawal. Once received, your full balance plus the tax payment will be transferred." The number is large enough to hurt but small relative to the apparent gains.

If the victim pays the tax, the script escalates: a "liquidity verification fee" (the platform claims your balance must be matched 1:1 in their reserves before transfer); a "compliance review deposit" (because your withdrawal exceeded a threshold); an "anti-money-laundering certification fee" (a real concept twisted into a fraud lever); a "wallet activation fee" if they're moving to crypto rails. Each escalation is sized at 10–25% of the displayed balance. The Reddit r/CryptoScams threads document victims who paid four to seven escalating fees, each time told they were one payment away from receiving their funds. A retired federal employee who lost $400,000 to a platform called Wealth Fims (later rebranded as ETRDStocks) documented the entire ladder of fees in a 168-upvote post.

The hardest fact to communicate: the moment a withdrawal is denied for any reason on a platform of this kind, every dollar previously deposited is already gone. The dashboard is a screen. It shows whatever the operators want it to show. There is no balance to release. Real exchanges do not collect taxes for the IRS; the IRS collects its own taxes via 1099 reporting at year-end. Real exchanges do not require deposit fees to enable withdrawals. The single sentence to remember: any platform that requires you to deposit additional funds to withdraw your own money is a scam, in any jurisdiction. Stop depositing now.

The withdrawal-tax wall is the dominant trap mechanism, but it is not the only one. A second variant strips wallets in a single transaction — no fattening, no fees, no escalation.

A Twitter "alpha" account or Telegram channel touts a new "DeFi liquidity-mining" opportunity with 50–200% APY. You connect your wallet to a clean-looking dApp; the moment you sign the approval transaction, the contract drains every approved token. The losses are total and instant — no withdrawal-tax phase, just a single malicious smart contract.

The yield-farming variant differs structurally from the romance-pivot variants because it weaponizes the wallet-connection model rather than persuasion. The funnel: a Twitter or Telegram channel posts a link to a "new DeFi protocol" offering implausibly high yields. The site looks polished, with Tailwind CSS, animated charts, a "TVL" counter, and a "team" page with stock-photo headshots. To "stake" or "provide liquidity" you connect your MetaMask or Phantom wallet and sign a token-approval transaction. The transaction is unlimited approval to a malicious contract. Within seconds, every token in the wallet that the contract is approved to spend is transferred out.

Unlike the deposit-cycle variants, there is no slow build and no withdrawal phase. The moment of approval is the moment of total loss. Victims report waking up to drained wallets after going to sleep with the approval transaction signed the night before; the drain happens when gas conditions are favorable to the attacker. This variant overlaps with classic pig-butchering when the Telegram referral itself originated from a Hinge or LinkedIn pivot, since the operators run both funnels in parallel.

The variant is "medium" rather than "high" only because the population at risk is narrower; most people who would never connect a hardware wallet to a random dApp are protected by ignorance rather than discipline. But for crypto-fluent users, the risk is severe and the recovery is zero: a draining contract on Ethereum, Solana, or Base is permissionless and untraceable to a recoverable identity. Never sign a token-approval transaction on a dApp you discovered through a Telegram or Discord referral. Use only protocols you've verified through Coinbase, DeBank, or DeFiLlama, and revoke unused approvals at revoke.cash monthly.

The deposit cycle wears different masks. The damage runs deepest, however, when the script reaches your kitchen table.

The pig-butchering script includes an isolation phase: the "mentor" or "girlfriend" suggests the trading is a "personal financial journey" your spouse "wouldn't understand" — and to keep it private until the profits are realized. Victims open separate accounts, take secret HELOCs, and drain joint savings without their spouse's knowledge. The financial damage is compounded by the relational damage.

The secrecy hook is the most carefully built phase of the script and the one that produces catastrophic outcomes. After the victim has shown initial profit, the contact suggests that the trading should remain private for now: "your husband would just worry," or "let's surprise her with the gains," or "this is your project." The framing maps to whatever isolation pattern the victim already has: a wife who handles the finances, a husband who doesn't ask, a parent whose adult children are too busy to notice.

The r/BestofRedditorUpdates thread "My spouse got caught in a pig slaughtering scam and now our life's savings are gone" (4,971 upvotes as of Apr 2026) is the canonical case: an academic spouse who took a HELOC against the family home, drained joint retirement, opened individual brokerage accounts, and cumulatively wired more than a million dollars to a fake exchange over eight months — entirely without the other spouse's knowledge. The thread captures the discovery moment, the legal aftermath, the bankruptcy filing, and the marriage's near-collapse. A second thread, "San Francisco retiree loses $500K life savings to pig butcher scam despite warnings from family" (423 upvotes), shows the elderly variant: an adult son who "alerted 3 police agencies including the FBI" was unable to stop his father once the secrecy hook was set.

The defense is structural rather than tactical: both spouses must have visibility into all financial accounts, and any "private investing" framing should itself be the red flag. The r/financialindependence thread "What's your plan to avoid pig butchering?" (333 upvotes) surfaces the consensus rule: "It's important for both spouses to be aware of the finances. This can happen when one spouse sits by and lets the other one make all the financial decisions." For elderly relatives, contact your state's Adult Protective Services the moment you suspect a pig-butchering script is active — they have legal authority to intervene that family members do not. The single sentence: any "investment opportunity" that requires you to keep it secret from your spouse, financial advisor, or banker is a scam. Real investments do not need to be hidden.

By the time most victims publicly post their loss, the operators have already moved on. But a second wave of fraudsters is just arriving — a meta-scam that targets people whose defenses are now zero.

Within hours of posting "I lost $X to a crypto scam," you receive a flood of DMs from "professional fund-recovery specialists," "blockchain forensic experts," and "ethical hackers" who claim they can trace and reverse the transactions for a small upfront fee. Every one of them is a follow-on scammer farming people who have already proven they will pay.

The recovery-scam ecosystem is a parasite on the pig-butchering ecosystem. The moment a victim posts publicly about a loss (on r/Scams, r/CryptoScams, r/personalfinance, Twitter, or a victim-support Facebook group), they receive a deluge of unsolicited messages from accounts claiming to specialize in fund recovery. The pitch is written for someone in a state of financial grief: "I am a former [FBI / SEC / Chainalysis] investigator," "I have proprietary blockchain-tracing software," "I have a 92% recovery rate," "the consultation is free."

The actual sequence is a small upfront "investigation fee" ($200–$2,000), then a larger "court filing fee" or "exchange unlock fee" ($5,000–$20,000), then a final "tax payment to release the recovered funds." It is the same withdrawal-tax script weaponized against people whose defenses are now zero. The r/Scams moderators auto-post a sticky comment on every new submission warning about this exact pattern; the comment in the corpus reads: "you will start getting private messages from scammers saying they know a professional hacker or a recovery expert lawyer that can help you get your money back, for a small fee. We call these RECOVERY SCAMMERS, so NEVER take advice in private."

The hard truth, repeated by the FBI, the FTC, and every legitimate consumer advocate: funds sent to pig-butchering platforms are bridged through mixers within hours. Six-figure recoveries do happen occasionally — but only through bank wire reversal in the first 24–48 hours, never through a stranger who DMed you on Reddit. There is no "blockchain forensic expert" who can claw back funds from a Cambodian compound for a $1,500 retainer. Anyone who DMs you offering recovery services is a scammer. Block them all without exception. The only legitimate recovery path is IC3 + your bank's fraud department, both pursued without paying anyone a fee.