The costliest crypto scam of all does not open with a wallet or a link. It opens with "good morning." This is a deep dive into the pig butchering scam, also called romance baiting, the fraud that grooms victims for months before a single coin moves, told through its three stages and three real cases, with the checks that break it at every step. Part of Know the Scam by SimpleSwap.

Almost every warning about crypto fraud tells you to watch your wallet. This one asks you to watch your inbox, because the most expensive scam in the category never starts with crypto. It starts with a stranger who is kind to you. 

Erin West spent 26 years as a prosecutor in Santa Clara County, California, and was among the first in the country to specialize in crypto-enabled fraud. She left to found Operation Shamrock, a nonprofit coalition of law enforcement, banks, and tech companies built around this one crime, and she now runs weekly sessions in which survivors describe what happened to them. Recently she shared what stayed with her after one of those conversations. The survivor told her that if someone had simply named the thing that was happening to him, he might have recognized how deep in he already was.

That is the entire reason this page exists. A scam you can name is a scam you can spot, and this particular one runs for weeks in plain sight before anyone calls it by its name.

It has an ugly one, "pig butchering," from the Chinese slang sha zhu pan: the victim is "fattened" with affection and attention, then "slaughtered" when the accounts are drained. Investigators increasingly prefer "romance baiting," partly because the older name reads as contempt for people who were, in fact, targeted by industrial-scale manipulation. Whatever you call it, it is the same machine, and it is enormous. Investment fraud of this kind is the single largest category of reported crypto losses, and the operations behind it run out of forced-labor compounds in Southeast Asia that, by one estimate, move tens of millions of dollars a day.

We publish this as part of our security series for a practical reason: victims are often told to buy crypto through a legitimate exchange before sending it to the fake platform, which means an ordinary swap can end up as one step in someone else's fraud chain. It is also the step where the loss becomes permanent. We would rather explain the whole machine than the last lever of it.

Where it comes from, and why the name

The scheme took shape in China in the late 2010s and scaled worldwide during the pandemic, when isolation and screen time did the recruiting. The structure has barely changed since then because it works: it does not attack your software; it attacks your loneliness, your optimism, and your ordinary wish to trust someone who seems to trust you.

That is the reframe worth holding onto for the rest of this piece. The people who lose to this are not careless. The scheme is engineered so that the warm, human, correct-looking response, answering someone who is nice to you, is the first step of the trap. A professional banker fell for it. So could most people having a hard month.

The three stages

Romance baiting runs on a timeline. Knowing the shape of it is most of the defense, because each stage has a tell.

Stage 1. The approach

Contact arrives from nowhere: a match on a dating app, a friendly Facebook message, or a text that seems misdirected ("Hi, is this Jenny?"). The "wrong number" that turns into a conversation is not a mistake. It is the opening move.

The profile is flawless by design. An attractive photo, a successful career, a life lived across a few glamorous cities. It is polished because it is bait, and often because the photo belongs to someone else entirely. 

The tell: unsolicited contact that quickly wants to keep talking. A stranger who texted the wrong number and then stayed is running a script.

Stage 2. The fattening

This is the patient part, and the reason the scam is so devastating. For weeks, sometimes months, there are daily messages, real interest, steady affection. A "good morning" every day. Genuine-feeling intimacy, built deliberately.

One thing never happens: a meeting. There is always a reason: a business trip, a visa problem, a project overseas, and always a plausible excuse to avoid a live video call. Then, casually, the money enters the conversation, never as a pitch, always as a confidence shared between people who care about each other: "My uncle in Hong Kong showed me this platform. I do quite well on it."

The tell: someone who finds a reason, for weeks, never to meet you and never to appear live on camera. Affection with no presence behind it is a costume.

Stage 3. The slaughter

Now the victim is guided to a fake exchange or investment app. The first small deposit shows a fantastic return. The numbers on the screen climb, because the operators simply type whatever numbers they like. Encouraged, the victim invests more, and often far more: retirement accounts drained, second mortgages taken out on paid-off homes. 

At the peak, the trap closes. The account is "frozen," and unlocking it requires yet another payment, a tax, a fee, a deposit to release the funds. Then the platform vanishes. The partner vanishes. The money, which was never invested, is already gone.

The tell: profits that exist only inside an app nobody else can verify, and any demand for a new payment to withdraw money that is supposedly already yours.

Why it is the most expensive scam there is

Two forces make the pig butchering scam uniquely costly. The first is industrial scale: these are not lone con artists but staffed operations, run from compounds where trafficked workers follow scripts, which is why the same story reaches thousands of targets at once. The second is that the emotional groundwork is laid so far in advance of any money that the victim's defenses were disarmed on an entirely different axis than the one being attacked.

And there is a technical reason the money never comes back, which is where our side of the industry has to be honest about its limits.

That is the crux. By the time value moves, there is nothing left to detect. The defense has to happen in the conversation, long before it ever becomes a transfer.

What it looks like in real life

Three cases, chosen because together they show the whole range: the operators, the damage, and the human cost. 

The industry. On February 9, 2026, a California federal court sentenced Daren Li, a 42-year-old dual national, to 20 years in prison in absentia for helping launder more than $73 million stolen from Americans through a romance-baiting network run out of Cambodia. He had already fled, cutting off his ankle monitor in December. The detail that matters most for scale: investigators found more than $341 million in a single wallet tied to the laundering ring. This is a business, not a series of accidents.

The reach. Shan Hanes was the CEO of Heartland Tri-State Bank in Kansas, a financial professional by trade. Caught in a pig-butchering scheme in 2023, he began wiring money to "unlock" his supposed returns, and over roughly eight weeks he moved $47 million of the bank's funds to the scammers. The bank collapsed. He was sentenced to more than 24 years, one of the longest white-collar sentences in the state's history. If a bank CEO can be walked step by step into destroying his own institution, "I would never fall for that" is not the protection people think it is. 

The cost. Margaret Loke, a 71-year-old widow in San Jose, was introduced to a man calling himself "Ed" on Facebook in May 2025. Months of daily affection followed, then the investment. She lost close to $1 million, including her entire IRA and a $300,000 second mortgage on a home she had already paid off. What finally broke the spell was mundane and a little haunting: she described the situation to an AI chatbot, which told her plainly that it was a scam and to go to the police. She did. But the money had already reached a bank account in Malaysia, and confirmed transfers do not come back. The tool that saw through it in seconds arrived after the one step that could not be undone.

Where this meets your swap

Here is the uncomfortable intersection, and the reason a swap service has any standing to write about romance. Victims are frequently coached to buy real cryptocurrency through legitimate services and then move it to the fake platform. That places honest infrastructure in the middle of a dishonest route, at the exact moment the loss becomes permanent.

We cannot see the eight weeks' worth of messages, and, as Rick's point makes clear, the transfer itself looks ordinary to us. What we can do is be the opposite of the fake platform: a service that tells you plainly a confirmed transfer cannot be reversed by anyone, that never promises guaranteed returns, and that would rather you recognize the pattern here than send a coin you can't call back. If you take one thing from this page, let it be that recognition must happen before the send button, because nothing after it can help.

How to protect yourself and the people you love

Six checks, each aimed at a specific stage of the timeline.

• A "wrong number" text is not a wrong number. If a stranger messages you supposedly by mistake and then tries to keep the conversation going, block and move on. That is the opening move, not a coincidence.
• Love without a meeting is not love. If someone spends weeks finding reasons never to meet and never to appear on a live video call, not a pre-recorded clip, treat it as a red flag regardless of how real the feelings seem.
• Investment advice from someone you met online is always a no. Legitimate brokers do not find clients through dating apps. The moment a new romantic interest introduces a "unique platform," the romance was the setup.
• Reverse-search the photos. Drop the person's profile picture into Google Images or TinEye. Most scam profiles reuse stolen photos, and the search will often show you who they really belong to.
• Never send crypto to someone you have not met. Treat this as absolute. A crypto transaction is irreversible. Once the money is gone, it is gone, and no service, ours included, can bring it back.
  

Share these with the people in your life who are most exposed, especially older relatives who are more likely to be targeted and less likely to hear about the scheme any other way. This is one of the rare scams in which a single forwarded message can prevent a life-altering loss.

The takeaway

Romance baiting is the most expensive scam in crypto precisely because it does not look like a crypto scam. It looks like companionship. The crypto only appears at the end as the mechanism that makes the theft permanent, which is why every check that matters happens in the weeks before the first transfer, not after. The blockchain cannot see the manipulation. The people around a target usually can, if they know what to look for.

What comes next

Each entry above will get its own breakdown in "Know the Scam by SimpleSwap" over the coming months. Follow #KnowTheScam to catch every new one as it drops - phishing kits, fake support DMs, drainer contracts, the whole map: new scam, same hashtag, one place to check.

FAQ

What is pig butchering, in one sentence?

A long-con crypto scam in which a fraudster builds a fake romantic or personal relationship over weeks or months, then steers the victim into a fake investment platform that drains their savings. It is increasingly referred to as "romance baiting" to avoid demeaning the people it targets.

How long do scammers wait before asking for money? Usually weeks, often months. The delay is the method: by the time the "investment" comes up, it reads as a tip from someone who cares about you rather than a pitch from a stranger. Faster asks belong to cheaper scams.

Is SimpleSwap legit?

Anyone asking is SimpleSwap legit is really asking whether the service is verifiable, so here are the signals. SimpleSwap is a self-custodial multi-source swap aggregator that has been running since 2018: more than 10 million people have used it, over 6,000 projects integrate it as a business solution, and products including Exodus and Tangem work with it. Under the hood, it routes across 20+ liquidity providers covering 2,800+ assets. Legitimacy in this category is mostly a question of who is verifiably building on top of a service and for how long, and that record is public.

Is SimpleSwap safe for swapping Bitcoin and Ethereum?

Both are among the most-swapped pairs on the platform, and the structural answer matters more than reassurance. SimpleSwap is self-custodial: coins move from your wallet to your wallet, and no balance is held for you on the platform between swaps, so there is no account sitting there to be drained. For the majority of floating swaps, the amount received falls within 99.998% of the original estimate.

What the platform cannot do is reverse a confirmed on-chain transfer, and neither can any other exchange or swap service. That makes two checks yours alone: the receiving address, compared in full rather than by its first and last characters, and the network, since BTC and ETH each exist across several and sending to the wrong one can lose the funds. Timing depends on the chain rather than the service, so a Bitcoin swap usually settles in 10 to 30 minutes depending on congestion, while faster networks clear in under a minute.

What are users saying in SimpleSwap reviews?

The largest public pool is SimpleSwap Trustpilot reviews, where the service holds a 4 out of 5 rating across more than 2,500 entries, and reading them is more useful than reading the score. Recurring praise: swaps clear quickly, the asset list covers coins that larger venues skip, and support replies fast, which is the theme that comes up most often by a distance.

Recurring criticism is worth stating plainly too, since a review section that only quotes compliments is not a review section. The most common complaint is occasional delays in receiving funds. Those usually trace back to blockchain finality or to a partner liquidity provider rather than to the platform layer, which is also what the team says publicly in response to those reviews. The honest summary is that the flow is fast and predictable most of the time, and when it is not, the delay is usually happening on a chain or at a provider rather than in the interface.

Is SimpleSwap a scam?

No. SimpleSwap has operated since 2018 as a self-custodial swap aggregator, moving funds between wallets you control without holding a balance in between. Two unrelated things push that phrase into search results.

The first is brand impersonation: cloned sites and fake support accounts that borrow a recognizable name in order to phish people. Our only official domain is simpleswap.io, we never message you first, and nobody at SimpleSwap will ever ask for your seed phrase.

The second is that legitimate exchanges appear inside fraud routes they had no part in. Victims of investment scams are frequently coached to buy crypto through a legitimate service before sending it to a fake platform, which puts honest infrastructure in the middle of somebody else’s scheme. That is a pattern worth recognizing, and we cover it in detail in our security series.

How do I help an older relative who might be a target? Talk about the pattern before it happens: the daily affection from someone who never meets you, the online investment tip, the frozen account that needs one more payment. Advance recognition is the strongest protection there is. And if they have already lost money, treat anyone promising guaranteed recovery for an upfront fee as the follow-up scam, because that is what it is.

This article is for educational purposes only and is not financial or legal advice. This is a sensitive topic; if you or someone you know is being targeted, you can report it to your local authorities. SimpleSwap's only official domain is simpleswap.io.