Romance scams, also known as “pig butchering scams” for the way bad actors say they “fatten up” their victims to extract the most possible value, are a large and growing problem with a significant crypto nexus. Romance scammers start by building a relationship over time with the victim (usually of a romantic nature, as the name implies), often initiating contact by pretending to have text messaged a wrong number or via dating apps. As the relationship deepens, the scammer will eventually push the victim to invest money (sometimes cryptocurrency, sometimes fiat) in a fake investment opportunity, and continue to do so until they eventually sever contact.
Source: CoinDesk
The FBI’s 2022 IC3 Report states that in 2022, Americans reported losses of over $700 million to romance scams in both cryptocurrency and fiat, and nearly $2.5 billion to crypto investment scams of any kind, regardless of whether there was a romance element. Those numbers also don’t take into account victims in other countries, such as China, whose residents are also heavily targeted in these schemes.
But, while many are aware of the havoc romance scamming wrecks on those who fall victim, there’s now also a growing awareness of the exploitation of the scammers themselves — the people on the other side of the unsolicited text messages. As we discussed on the Chainalysis Public Key podcast in 2022 with reporter Alastair McCready and as the New York Times more recently reported, individuals throughout China and Southeast Asia have been kidnapped, trafficked, and forced to work in labor camps housed within large compounds, carrying out pig butchering scams. Cities like Myawaddy in Myanmar are hot spots for this activity, as political instability there has allowed pig butchering gangs to operate with impunity.
Inside the KK Park: Myanmar’s most notorious pig butchering compound
We spoke with Eric Heintz, Global Analyst at the Global Fusion Center of the International Justice Mission. There, Heintz and his team assist IJM’s field offices in their work to help human trafficking victims of pig butchering gangs. As part of this effort, they also track the gangs themselves, monitoring their recruiting activity on social media, mapping out their compounds through satellite imagery, and communicating with victims.
“The conditions these people face are horrible,” he told us. “They’re forced to work 12 or more hours per day, and if they don’t meet quotas on contacting potential scam victims, the gangs beat them, torture them, and even withhold food.”
Heintz also told us a bit more about the compounds themselves. Typically, one company owns the land and the buildings, and then rents them out to other companies who carry out the actual romance scams. According to Heintz, the owners of the compounds often also provide “security” for their tenants, meaning guards who will prevent human trafficking victims from escaping.
How do the companies within these compounds use cryptocurrency? Of course, we know that they take crypto payments from scam victims. But Heintz also told us that pig butchering gangs will often tell the families of trafficked workers to pay them ransoms in exchange for their family member’s freedom — those payments also often happen in cryptocurrency. Heintz sent us ransom payment addresses provided to him by trafficking victims and their families, associated with a pig butchering gang at KK Park, one of the most notable compounds in Southeast Asia. “Some scam operations may be mixing proceeds from scams with ransom payments from victim families,” said Heintz. Indeed, the addresses he provided show on-chain connections to addresses associated with romance scams, in addition to activity likely related to ransom payments.
Satellite image of KK Park ©2023 Maxar Technologies
First, some context on KK Park before we dive into on-chain analysis. KK Park is one of the biggest, most notorious romance scam compounds in operation today. Located in the aforementioned Myanmarese town of Myawaddy, KK Park is reported to hold over 2,000 trafficked romance scam workers. The two ransom addresses provided to us by Heintz are, according to him, associated with a Chinese front company for a pig butchering gang that operates out of KK Park. The Chainalysis Reactor graph below shows some of the addresses’ on-chain activity.
From just the two ransom addresses provided to us by Heintz, we’re able to gain insight into millions of dollars’ worth of activity associated with this prolific pig butchering gang. First, we see that while the addresses were provided to victims’ families as a means of ransom payment, both have also received significant funds from a number of known scam addresses. Ransom address 1, for instance, has received roughly $24.2 million in crypto from the four scam-associated wallets to its left. Both ransom addresses send and receive significant amounts to and from mainstream exchanges — some of those incoming transactions are likely ransoms. In total, since becoming active in July 2022, the two addresses together have received just under $100 million in crypto inflows, though it’s unclear how much of that total comes from scamming versus ransom payments. Given that these are just two addresses from a single company operating out of KK Park, we can infer that on the whole, pig butchering scammers working out of the compound are making significant sums.
Our on-chain analysis shows how tightly interwoven pig butchering gangs’ ransom-taking operations are with their primary business of conducting romance scams. The brutal conditions trafficking victims face on the compounds also lend additional urgency to solving the problem of romance scamming — not only are consumers being bilked out of hundreds of millions of dollars each year, but the gangs behind those scams are also perpetuating a humanitarian crisis. The good news is the cryptocurrency ecosystem is taking action: In November, the stablecoin issuer Tether and the cryptocurrency exchange OKX announced that they collaborated with the United States Department of Justice in an investigation that led to Tether freezing approximately $225 million in USDT tokens linked to an international human trafficking syndicate in Southeast Asia responsible for romance scams, helped in part by Chainalysis solutions. Additionally, a South Korea-led Interpol operation in late 2023 saw authorities arrest 3,500 cybercriminals associated with online scamming and seize $300 million in funds, $100 million of which was made up of digital assets. We encourage all cryptocurrency businesses to search for any possible exposure they may have to this activity, and report as much information as they can to law enforcement.
This website contains links to third-party sites that are not under the control of Chainalysis, Inc. or its affiliates (collectively “Chainalysis”). Access to such information does not imply association with, endorsement of, approval of, or recommendation by Chainalysis of the site or its operators, and Chainalysis is not responsible for the products, services, or other content hosted therein.
This material is for informational purposes only, and is not intended to provide legal, tax, financial, or investment advice. Recipients should consult their own advisors before making these types of decisions. Chainalysis has no responsibility or liability for any decision made or any other acts or omissions in connection with Recipient’s use of this material.
Chainalysis does not guarantee or warrant the accuracy, completeness, timeliness, suitability or validity of the information in this report and will not be responsible for any claim attributable to errors, omissions, or other inaccuracies of any part of such material.