Researchers at Sophos have uncovered a ‘pig butchering’ cryptocurrency scam that has malicious actors making off with more than $1 million in just three months.
This operation demonstrated a high level of sophistication, employing a total of 14 domains and numerous nearly identical fraudulent websites, as detailed in the investigation.
The scammers exploited counterfeit trading pools within decentralized finance (DeFi) trading platforms, targeting unsuspecting victims. One unfortunate individual lost a substantial $22,000 within the span of a single week.
These ‘liquidity pools,’ encompassing various cryptocurrencies, offer users the opportunity to profit from trading one cryptocurrency for another. Participants earn a share of the fees generated by these trades, while another account, typically controlled by the pool operators, is granted access to participants’ wallets to facilitate transactions.
Sophos noted an alarming trend of fraudsters setting up such pools, essentially draining users’ entire liquidity pools for their own gain.
In Just One Week, a Victim Suffers a $22,000 Loss
The report highlighted the case of an individual named ‘Frank,’ who fell victim to a $22,000 loss due to an online dating scam.
Frank’s ordeal began when he was contacted by ‘Vivian’ on the dating app MeetMe, who presented herself as a German woman working in Washington D.C. Over the course of several weeks of romantic messaging, Vivian persistently urged Frank to invest in cryptocurrency, recommending a specific liquidity pool site.
Eventually, Frank succumbed and opened a Trust Wallet Account to convert his dollars into cryptocurrency, following a link provided by Vivian that led him to a fraudulent site impersonating the decentralized finance provider Allnodes.
Between May 31 and June 5, Frank invested $22,000 in the pool, only to discover three days later that his funds had been entirely drained by the scammers.
Desperate for help, Frank turned to Vivian, who continued to pressure him to invest more in the pool to recover his lost funds and enjoy promised ‘rewards.’ As Frank awaited authorization for a money transfer to Coinbase, he conducted some research and came across an article on liquidity mining from Sophos. He reached out to them for assistance.
Sean Gallagher, principal threat researcher at Sophos, advised Frank to block Vivian. However, Vivian persisted in her efforts to lure him back into the investment, even sending a lengthy and emotionally charged letter that Gallagher suspected was generated by an AI-powered application.
An Elaborate Operation
Sophos underscored the intricate nature of this ‘pig butchering’ scam operation, which operated without the need for any malware installation on the victim’s device, relying solely on social engineering tactics.
Gallagher pointed out, ‘This entire counterfeit liquidity pool was managed within the legitimate Trust Wallet app. At one point, Frank even attempted to contact Trust Wallet’s support to recover his funds but ended up connecting with a fake support contact associated with the fraudulent liquidity pool site.’
Gallagher cautioned that pig butchering scams, also referred to as shā zhū pán, are on the rise and proving remarkably effective for threat actors.
‘Very few individuals have a comprehensive understanding of legitimate cryptocurrency trading, making it easy for these scammers to deceive their targets. There are even toolkits available for conducting this type of scam, simplifying the process for various pig butchering operations to incorporate crypto fraud into their tactics. While Sophos tracked dozens of these fraudulent ‘liquidity pool’ sites last year, we’re now observing over 500,’ he disclosed.
He urged individuals to exercise caution when contacted out of the blue by someone they have no prior connection with, especially through dating apps or social media platforms. This caution should be heightened if the individual in question attempts to shift the conversation to platforms like WhatsApp and subsequently discusses cryptocurrency investments.
Sophos has shared its findings with cryptocurrency intelligence experts at Chainalysis and the exchange platform Coinbase, who are currently conducting ongoing investigations into the extent of pig butchering scams.
