The Platform Showed Profits. The Blockchain Showed Nothing.
This type of fraud has a name in the industry: "pig butchering" — shā zhū pán in Chinese, where most of these operations originate. The victim is fattened slowly, encouraged to invest more each time the dashboard shows gains, and then slaughtered when the operator decides the time is right. Our client had transferred $23,000. Alexei was asking for another $20,000 when she contacted us.
$23,000
In two tranches: $6,000 initial, $17,000 after "profitable" first month
$20,000
The "limited pre-ICO opportunity" Alexei was pushing when our client stopped all contact
Every stage is designed. Nothing is accidental.
Stage 1: The wrong number. Alexei's first message arrived as an apparent misdial — he was "trying to reach his cousin." The brief exchange was warm and accidental-feeling. He suggested they stay in touch. This opening — a plausible, low-pressure reason for contact — is a documented entry tactic for pig-butchering operations.
Stage 2: The relationship. Over six weeks, Alexei positioned himself as a Monaco-based cryptocurrency trader: smart, successful, generous with knowledge. His dating profile showed a Lamborghini Urus, rooftop champagne bars in Monte Carlo, and a claimed weekly trading income of $20,000. The photos were stolen from a real investor's Instagram. We traced them during our investigation.
Stage 3: The tip. He mentioned, casually, that he had access to a private trading platform with institutional-grade signals. A few trusted contacts used it. He could add one more. He wasn't selling anything — she could try it with a small amount. $6,000. She put in $6,000.
Stage 4: The early win. The dashboard showed a 34% return in three weeks. He was modest about it — this was typical, he said, not exceptional. She withdrew $800 as a test. The withdrawal processed without friction. This is deliberate: the first withdrawal always works. It establishes that the platform is real and that the money is accessible. It isn't.
Stage 5: The escalation. She invested another $17,000. The dashboard showed the total growing. Then she tried to withdraw $5,000. The platform reported a "liquidity hold" and required payment of a 15% "tax clearance fee" before withdrawal. Alexei explained this was a Korean regulatory requirement he hadn't anticipated. He was apologetic. Sympathetic. Working on it.
Stage 6: The next opportunity. While the "hold" was unresolved, he mentioned a limited pre-ICO opportunity — a token launch he had early access to. $20,000 would secure an allocation. This is where she contacted us.
Domain created 22 days before first contact.
The trading platform had a professional interface: live price tickers, a portfolio dashboard, a trading history, a withdrawal interface. It was a custom-built web application designed to look like a real exchange.
WHOIS records showed the domain was registered 22 days before Alexei's first message. The registrar was a privacy-proxy service in Panama. The hosting provider was a bulletproof host in Eastern Europe used by multiple other known fraud operations. The SSL certificate was valid but had been issued the same day as domain registration — a pattern absent from legitimate financial platforms, which typically have years of certificate history.
The platform was not listed on CoinMarketCap, CoinGecko, or any regulated exchange registry. It had no API connections to any real liquidity pool. The "profits" shown on the dashboard were numbers in a database — not reflections of any actual market activity.
Six wallets. Three mixers. Zero recoverable funds.
The receiving wallet address for our client's initial transfer was traceable on the public Ethereum and USDT blockchains. Using free block explorer tools — Etherscan and Tether's own transaction history — we traced the movement of funds from the moment of transfer.
The $23,000 moved through six intermediary wallets over 11 days, with each hop reducing the balance slightly through transaction fees and small diversionary amounts. By the sixth wallet, the funds had been passed through a mixing service — a protocol designed to obscure the origin of cryptocurrency by pooling and redistributing it — and cashed out through an exchange with minimal KYC requirements, likely offshore.
The funds were not recoverable. We told our client this clearly in the report. What the blockchain trace did provide was documentation for her police report and her bank's fraud claim — evidence that her funds had been deliberately moved through obfuscation infrastructure rather than held in a legitimate account.
Stolen photos. VPN infrastructure. Likely a team.
The luxury photos Alexei used were reverse-image matched to the Instagram account of a real investor based in Dubai — a person with no connection to any fraud operation. The real person had posted the same photos of his Lamborghini and Monaco rooftop visits publicly. Alexei had downloaded them and repurposed them wholesale.
The messaging account showed activity at all hours of the day and night — a pattern inconsistent with a single individual in any single time zone. Pig-butchering operations are typically run by teams, with different operators handling different phases of the relationship: initial contact, romance building, investment introduction, and the crisis stage (the "liquidity hold" that pressures further deposits). The seamless consistency of "Alexei's" persona across all these stages suggests a coordinated operation rather than a solo actor.
Why the $800 succeeded — and what that really meant.
The small successful withdrawal is the most psychologically important element of a pig-butchering scam. Once a victim has successfully withdrawn funds from the platform — even a small amount — they have personal experience that the platform works. This experience is used to override later doubts.
The withdrawal succeeded because the operator chose to let it succeed. The $800 was a calculated loss against the $17,000 it unlocked. This pattern is consistent across pig-butchering cases: one early successful withdrawal of between $200 and $1,000, followed by an escalation in deposits, followed by withdrawal blocks that frame further deposit requests as resolution fees.
If you have been able to withdraw a small amount from a crypto platform and are now being told a larger withdrawal is blocked pending a fee, that successful withdrawal is not evidence that the platform is legitimate. It is evidence that the operator decided it was worth $800 to keep you engaged.
Check the platform before you invest. Not after.
A legitimate cryptocurrency exchange is listed on CoinMarketCap or CoinGecko, has years of domain history, is registered with financial regulators in at least one jurisdiction, and processes withdrawals without preconditions. If the platform you are using does not meet all four of these criteria, do not invest further.
We can check the platform, the person, and the wallet addresses in our standard investigation. If the platform is fraudulent and you have already transferred funds, we can produce the blockchain trace documentation you need for law enforcement and bank fraud claims. This documentation does not recover the funds, but it is necessary for any formal process that might.
See more real investigations.
We regularly post anonymised case results and scam‑awareness tips on Instagram. Follow @allrussian.verify to stay informed.
Other fraud cases with financial loss
The next request is not the last one. Stop here.
If you've transferred money to a crypto platform through a personal contact and are now being told withdrawal requires a fee, contact us. We'll check the platform, the wallet, and the person — and give you a clear written report on whether what you're dealing with is real.