How ‘pig butchering’ scams have emerged as a billion-dollar crypto industry

At a Thai police headquarters in October 2022, Chinese businessman Wang Yicheng congratulated one of Bangkok’s most senior cybercrime investigators on his recent promotion, presenting the official with a large bouquet of flowers wrapped in red paper and a bow.

Wang, the vice president of a local Chinese trade group, wished the new cybercrime investigator “smooth work and new achievements”, according to the group’s website, which displays photographs of the event.

Over the past two years, Wang has forged relationships with members of Thailand’s law-enforcement and political elite, the trade group’s online posts show. During that time, a cryptocurrency account registered in Wang’s name was receiving millions of dollars linked to a type of cryptocurrency investment scam known as pig butchering, a Reuters investigation has found.

In total, crypto worth more than US$90mil flowed into the account between January 2021 and November 2022, according to registration documents and transaction logs reviewed by Reuters. Of that, at least US$9.1mil came from a crypto wallet that US blockchain analysis firm TRM Labs said was linked to pig-butchering scams. Two other major crypto-tracking firms also said the account received funds linked to such scams.

The victim of one of the scams was a 71-year-old California man. He sent money to crypto wallets that channeled more than US$100,000 into the account in Wang’s name, according to blockchain analysis company Coinfirm. The man’s family told Reuters he lost about US$2.7mil, his life savings, after falling prey to someone claiming to be an attractive young woman called Emma.

The previously unreported transactions provide rare insight into the finances of pig-butchering scams, which involve engaging unsuspecting people online. Scammers cultivate trust and then persuade victims to invest in fraudulent crypto schemes, sometimes via fake websites built to look like legitimate trading platforms. Sometimes the targets initially receive real returns to trick them into believing the scheme is legitimate.

Such scams have drawn intensifying scrutiny from global law enforcement over the past year, but little is publicly known about the people behind them.

Wang, who is 41 according to the account registration documents, didn’t respond to detailed questions for this article. Neither did the Thai government, the Thai police or the Bangkok-based trade group Wang represented, the Thai-Asia Economic Exchange Trade Association.

Some aspects of the pig-butchering operation remain murky. Lisa Wolk, a blockchain intelligence analyst at TRM, said the crypto account in Wang’s name “is a node in a money laundering network and not necessarily the ultimate recipient of funds”. Reuters was unable to determine whether anyone else benefited from the account or used Wang’s identity to open it.

In January, agents from the US Federal Bureau of Investigation and the US Secret Service attended a briefing about cyber fraud, according to Erin West, a California prosecutor specialising in cybercrime who participated. A 72-page presentation prepared for the attendees, which Reuters reviewed, provides details on cyber scams operated from South-East Asia and cites Wang as among alleged beneficiaries. The presentation depicts money flowing into a crypto wallet identified as belonging to Wang, notes his role at the Thai-Asia association, and includes a picture of his identity card and other photos of him.

The FBI and Secret Service declined to comment on the briefing, or on whether Wang was part of any investigation. The briefing was given by the Global Anti-Scam Organisation, a US non-profit that advocates for fraud victims and investigates cases.

The crypto account registered to Wang was held at Binance, the world’s largest crypto exchange, according to three blockchain analysis firms. Asked about the account, Binance spokesperson Jessica Jung declined to comment on individual users or Reuters’ findings. In an August post on its website, the company said the number of reports of pig-butchering scams it had received this year was double that of 2022, an increase it attributed to an influx of inexperienced crypto investors and scammers looking to exploit them.

Crypto fraud has emerged as a multibillion-dollar criminal specialty that has entrapped victims around the world. In the United States alone, victims reported losses of US$2.6bil from pig butchering and other crypto fraud last year, more than double the previous year, according to the FBI. The true scale of the losses is unknown because victims are often too embarrassed to report crimes to authorities.

In April, the US Department of Justice said it seized about US$112mil worth of crypto linked to pig-butchering scams, without identifying suspects. A warrant that resulted in the seizure of more than half that amount specified a Binance account registered in Thailand.

‘Absolute devastation’

West, the California prosecutor, said many victims in the hundreds of pig-butchering cases she has handled since early 2022 have lost more than US$1mil. Many are never able to recover their money. West said at least one victim died by suicide and another attempted suicide. “I’ve never seen this level of absolute devastation,” she added.

Pig-butchering scams originated in China, financial crime specialists say. Many are now run by criminal organisations out of South-East Asia that use victims of labour trafficking to contact individuals around the world, the US Treasury said in September. Cases are difficult to prosecute. Perpetrators are typically “ruthless transnational organised crime syndicates” that thrive on corruption, Jeremy Douglas, regional representative of the United Nations Office on Drugs and Crime, told Reuters.

Several scams connected to deposits made into the account in Wang’s name were run from an industrial park on the Myanmar-Thai border, one of the blockchain analysis firms told Reuters. Workers are trafficked to the area, known as KK Park, by gangs that force them to con people online, according to two former workers and groups that support workers or scam victims.

The Thai government, Myanmar’s ruling military junta and the Myanmar border guard that controls the area didn’t respond to questions about the industrial park or whether gangs operate there. Reuters was unable to contact the park’s owners.

China has announced a crackdown on cyber scams in recent months in partnership with Thailand and Myanmar. Thailand has also said it is combating cyber fraud. Thai police in September announced the arrest of several Chinese nationals in connection with a crypto investment fraud operation.

Binance publicly said it assisted Thai police with a probe into “a significant pig butchering scam,” and that about US$277mil of assets were confiscated. Thai police didn’t respond to questions about the operation or whether there was any connection to Wang.

Birds’ nests to crypto

Wang was born in 1982 in the port city of Ningbo on China’s east coast, according to the identity card used to register the crypto account.

In his late twenties and thirties, he started several businesses in China, mostly related to technology, including computer and electronics sales, according to publicly available corporate records. The records show one business involved selling birds’ nests, a culinary delicacy in China often used in soups.

By 2018, Wang had moved south to the coastal city of Xiamen, according to the identity card. By the following year, all of his Chinese-based businesses had been de-registered, apart from one in Ningbo that shut down in September of this year, the corporate records show. That firm, called Ningbo Laizheda E-Commerce Company, didn’t respond to a request for comment.

Wang branched out into businesses in Thailand. In 2018, he became a partner of the Thai arm of a major Chinese maker of crypto production gear called Bitmain, according to Thai corporate records. In response to Reuters’ questions, Bitmain said Wang was not an employee but a “close partner” and customer who purchased its bitcoin mining machines. Bitmain said it supplies “digital miners in the legal way”.

The crypto account in Wang’s name was registered in November 2020, according to the financial records Reuters reviewed. The three blockchain-analysis firms determined the account was with Binance. The documents, which relate to the Binance account, span two years to November 2022. They show that the account was accessed mostly from Bangkok.

Deposits started arriving in the account in early 2021 and quickly increased in size to include sums of more than US$100,000, the financial records show.

By October 2021, Wang had become vice president of the Thai-Asia Economic Exchange Trade Association, according to the group’s website. The group formed in 2019 to unite overseas Chinese businessmen in Thailand, the website says. It says the group is committed to promoting cultural exchanges and business investment between Thailand and China and other Asian countries.

The group also publicly espoused the Chinese government’s political positions. In an undated video on the group’s website, Wang and other association leaders chant, “Build a Thai-China bridge, tell China’s story well!”

The Thai-Asia trade association until recently shared its small office building in Bangkok with another Chinese group, the Overseas Hongmen Cultural Exchange Center, corporate records and photographs show. The two groups also shared some common leadership: The head of the Overseas Hongmen group was an adviser to the Thai-Asia association, according to the Thai-Asia association website.

In February, Thai police said it raided the Hongmen group’s part of the office, alleging the group had ties to the 14K Triad. The United States has called the 14K Triad one of China’s largest criminal organisations. In 2020, Washington sanctioned Wan Kuok Koi, known as Broken Tooth, accusing him of being a 14K leader and attempting to create a network of businesses, including cryptocurrencies, to export crime and co-opt elites in South-East Asia. He could not be reached for comment.

A month after the Thai police raid, the Overseas Hongmen Cultural Exchange Center was dissolved, corporate records show. Neither the Hongmen center nor the Thai-Asia association responded to questions on the raid.

‘Honorary advisers’

Wang and other trade group leaders have courted senior officials in Thailand. The trade group’s website details at least 100 meetings since its formation with officials in the Thai police and government, as well as with staff of the Chinese embassy in Thailand and visiting Chinese officials.

Reuters found no evidence that Thai and Chinese officials were aware of the pig-butchering connections to the account in Wang’s name. The Thai government, the Thai police and the Chinese embassy in Bangkok didn’t respond to questions about the meetings. China’s foreign ministry, in response to questions about Wang and his interactions with Chinese officials, said, “We are not aware of relevant circumstances.”

The association also appointed at least eight senior Thai officials as “honorary advisers”, according to its website. It says some of the trade group’s leadership served as advisers to the police, including its president, who advised the police cybercrime unit. The association’s representatives and officials frequently exchanged gifts, from whisky and fine wines to “precious Buddha statues”, the website details.

Among the advisers named on the association’s website is Kornchai Klaiklueng, who headed the Thai police’s cybercrime division until last year and is now assistant to the national police chief. Photos posted on the trade group’s social media account show Kornchai participated in events with Wang or other trade group leaders on more than 10 occasions between December 2019 and August 2023.

Another listed adviser is Chatchaphantakarn Klaiklueng, the head of the Bangkok division of the cybercrime police. Chatchaphantakarn is the police official to whom Wang paid his congratulatory visit in October 2022. Kornchai and Chatchaphantakarn are brothers according to Chatchaphantakarn’s Facebook page. They have another brother, Ponganan Klaiklueng, who’s also a cop, according to Ponganan’s social media account and a local media report. Ponganan is also an adviser to the trade group, the association’s website says.

During a November 2021 visit to the trade association’s office, Chatchaphantakarn praised the friendship between Thailand and China and said his family has “Chinese blood”, according to a video posted to his Facebook page. At the time, Chatchaphantakarn ran training for the Thai police, the trade association’s website says.

Weeks later, the association announced on its website that it was funding a renovation of a police shooting range and other facilities. The association didn’t respond to questions on the funding.

The Thai police and the three brothers didn’t respond to requests for comment on the police officials’ relationship with Wang.

Among the most senior of Wang’s contacts is Thammanat Prompao, Thailand’s agriculture minister. A political power broker, he played a key negotiating role in the recent formation of Thailand’s coalition government.

Thammanat was sentenced to prison in Australia on drug-trafficking charges in the 1990s, according to Australian and Thai court records. He served four years in prison and was released in 1997, according to Australian media reports. He told Thailand’s parliament in 2020 that he was caught with flour.

In a December 2021 meeting with Thammanat at his office in Bangkok, Wang and other representatives of the trade group presented the politician with a hamper that included bottles of Johnnie Walker whisky, according to the association’s website. Thammanat has also held an honorary position at the association, according to a video and articles on the trade group’s website.

Thammanat didn’t respond to requests for comment. In a video published in November 2022 by Thai PBS, a local TV channel, Thammanat denied any involvement with Chinese criminals in response to media reports alleging that he had such ties.

‘Complex layering scheme’

In 2022, the volume of crypto reaching the account in Wang’s name mushroomed to almost US$79mil, a near six-fold increase on the previous year, the account records seen by Reuters show.

Coinfirm, the blockchain analysis firm that reviewed the transaction records for Reuters, said deposits from funds linked to pig-butchering scams it previously investigated began entering the account as early as February 2022. Stolen crypto was moved to the account via a “complex layering scheme”, involving multiple different wallets, Coinfirm’s then-head of fraud investigations Roman Bieda told Reuters in May. The crypto moved between “dozens” of wallets and was mixed with funds from other sources, he said.

Some US$9.1mil flowed to the account registered in Wang’s name from the wallet linked by TRM to pig-butchering scams. The funds were moved in more than 50 transactions between August and October 2022.

Coinfirm linked the funds to pig-butchering scams based on information gathered from multiple victims and from publicly-available information, Bieda said.

Coinfirm said it identified funds originating from four pig-butchering scams. One involved a website called bigoneit.site, which channeled some of the funds the California man invested in the scam to the Wang-registered account. The site was a fake version of a legitimate crypto exchange called BigONE.

The 71-year-old man works in a home improvement store and lives alone. A Chinese American who immigrated to the United States in the 1980s, he built up his savings by working and contributing to a pension, while also trading stocks, according to his niece.

In March 2022, he received a text message from someone claiming to be a young woman, according to messages he shared. The texter later identified herself as “Emma”. Over the following weeks, the man and Emma built up a rapport. Emma encouraged him to send crypto to the fraudulent website, the messages show, interspersing small talk and trading tips with what she said were photos of herself – a slim young woman with long hair.

By July last year, the California man had poured some US$2.7mil into the scam, his niece said. The victim, who spoke on condition of anonymity, said Emma’s “smooth talking” convinced him that he could make money. He discovered he’d been scammed when he was unable to withdraw his funds. His family reported the theft to law enforcement, incident reports show.

“I trusted her,” he said, adding, “my heart is too kind.” Scammers will “try to use your weakness to gain what they need”.

The genuine crypto exchange BigONE said it takes fraudulent websites seriously, and that it had received at least 10 reports of such sites.

“We always emphasise in any promotional material that only big.one and bigone.com are official domains,” the Seychelles-registered company said.

Reuters was unable to reach the operators of the fake website.

More than US$102,000 originating from fraudsters’ wallets that the California man identified were deposited into the account in Wang’s name between June 26 and Oct 23, 2022, according to Coinfirm.

Nearly all of the crypto deposited in the Wang-registered account was moved to other wallets, the transaction records reviewed by Reuters show. Between January 2021 and October 2022, about US$87.5mil was transferred to almost 50 other crypto wallets, including at least five registered at regionally based crypto exchanges, Coinfirm said.

The account goes dark

On Nov 3, 2022, activity in the crypto account registered to Wang abruptly stopped, the financial records show. The pattern of transfers to the account suggests Binance may have started an investigation and suspended the account, Coinfirm said.

Any financial firm should carry out additional checks on clients whose accounts process large amounts of money, said Ross Delston, a former US banking regulator and expert witness on anti-money laundering issues. Red flags likely to trigger checks on the source of funds include a high volume of transactions and frequent deposits of round-numbered figures, Delston said.

The account registered to Wang frequently received such deposits, according to the financial records.

Binance didn’t respond to questions about the activity in the account in Wang’s name or any checks it made on the account. Binance said that it works to combat pig butchering, helping law enforcement identify, freeze and seize criminal assets, providing investigative training, and running crime prevention campaigns.

Binance chief Changpeng Zhao stepped down and pleaded guilty to breaking US anti-money laundering laws on Tuesday, as part of a US$4.3bil settlement resolving a years-long probe. Over five years, Binance processed transactions by users who “laundered proceeds” of criminal activity including scams, US authorities said.

Wang has continued to court officials. In August, he helped host an event in Bangkok, according to photos and a description published on the Thai-Asia association’s WeChat account.

Standing on a red carpet under a chandelier and flanked by floral decorations, Wang “warmly welcomed” the guests. They included a government minister, senior police officers and Chinese embassy officials, according to the trade group’s post.

Among those in attendance: Kornchai Klaiklueng, the assistant to the national police chief who previously headed up the cybercrime unit. – Reuters