Case study: a pig butchering victim and what the investigation delivered
Date: 12 August 2026 | Week: 33 | Reading time: 8 minutesAuthor: Simcha Schrijver 
In short
This pig butchering case study shows what an investigation into a suspected crypto scam can concretely deliver: a traceable route from the first deposit to the point where the funds reached a service provider.
- It concerns an anonymised, composite real-world example and not a traceable file: a victim of around 58 years old, approached through a professional-looking LinkedIn profile, with deposits in USDT on the Tron network totalling around 85,000 euros over four months.
- Paucitas mapped the chain up to and including the cash-out point and recorded up to which point the route was certain.
- Paucitas promises nothing about recovering funds and gives no tax or legal advice; the aftercare is factual and begins with a free intake.
This is a pig butchering case study in the Netherlands, described as an anonymised and representative real-world example and explicitly not as a specific traceable file. Names, amounts and details are composed from what is customary in this type of case and do not refer to a concrete person. What an investigation can deliver in such a situation is also set out in our pillar page on how an investigation into crypto fraud proceeds.
In this type of case, Paucitas maps the route of the funds factually and states honestly up to which point that route is traceable. This case study follows a victim from the first contact to the outcome of the investigation, with attention to the USDT and Tron route, the cash-out point and the aftercare.
An investigation into pig butchering does not recover any money, but makes visible which path the funds took and up to which point that path is certain.
What is pig butchering and how did this case begin?
Pig butchering is a form of scam in which a victim is coaxed over a long period and step by step is tempted into ever larger crypto investments on a platform that later turns out not to exist. In this case the contact began through a professional-looking LinkedIn profile: a seemingly successful entrepreneur who, after a few weeks of friendly contact, proposed an investment opportunity in crypto. The victim, a woman of around 58 years old, was gradually drawn into a story that looked reliable. The pattern shows traits of a romance scam, in which trust is built up first. This case is an anonymised, composite real-world example and describes no traceable file. See also our glossary term pig butchering.
How did this pig butchering case unfold?
The course shows a recognisable pattern: over four months the victim transferred around 85,000 euros in stages to what appeared to be an investment platform. First there was a small deposit that showed a neat profit on the platform, then larger deposits followed and finally a request to first pay costs and tax before the balance could be withdrawn. When withdrawal failed and the contact became difficult, the suspicion of a scam arose. The platform no longer responded and turned out to be a non-functioning service provider, a platform that on closer investigation turns out not to exist.
Which route did the funds follow via USDT on the Tron network?
The funds ran as USDT, a stablecoin pegged to the dollar, across the Tron network, which because of low costs and high speed is often used in this type of case. The victim bought crypto on a regular exchange and then transferred it in several transactions to the addresses the platform had provided. Every transfer is recorded as a transaction on the Tron network and can therefore be followed via a public blockchain register. For tracing crypto that means: every deposit has a transaction hash that serves as the incontrovertible starting point of the chain.
How did Paucitas map the chain?
Paucitas mapped the chain by following every transaction manually from the first deposit to the point where the funds reached a recognisable service provider. The investigation proceeded in five steps:
- Collect all addresses and transaction hashes supplied by the victim and verify them one by one on a public blockchain register.
- For each deposit, find back the USDT transaction on the Tron network and establish the receiving address.
- Follow the received funds onward from that address, through successive transfers, and thus reconstruct the chain.
- Establish where the funds came together or were passed on to a service provider, the cash-out point.
- Record up to which point the route is traceable with certainty and where it ends.
Paucitas uses no automated analysis software, in any role whatsoever. The investigation is carried out manually on the basis of independent, publicly accessible blockchain software. Every transaction and every transaction hash is verified one by one before it is included in a report.
What proved feasible and where was the cash-out point?
What proved feasible was a full, traceable reconstruction of the chain up to and including the cash-out point, the point where the funds reached a service provider where crypto can be converted into ordinary currency. The USDT funds turned out to have been merged via a few intermediate addresses and ultimately passed on to an exchange. Up to that point the route was certain. Where the funds reach a service provider, this is stated explicitly, so that it can be followed up through the appropriate channels. On part of the route, funds were led through a mixer, so that this branch could not be followed beyond a certain point; that too is stated explicitly in the report.
What can an investigation into pig butchering not do?
An investigation into pig butchering maps the route of the funds, but cannot establish everything and promises no recovery. In concrete terms, these limits apply:
- Paucitas gives no tax or legal advice.
- Transactions outside the blockchain, such as cash payments or internal entries within an exchange, are not visible and are only included if underlying documents are available.
- Where mixers or privacy-oriented networks are used, the chain cannot always be followed in full; in that case it is stated up to which point the route can be established.
- Paucitas makes no commitment about the outcome of an investigation.
What can you do yourself, and when is that not enough?
There is already a lot you can record yourself: keep all transaction hashes, the addresses you transferred to, screenshots of the platform and of the communication, and your bank statements of the purchases on the exchange. For a simple situation with a few transfers, that sometimes gets you a long way. It is usually not enough once the funds have been spread across several addresses, run through a mixer or have been passed on abroad, or when you need a traceable report for the police or another authority. At that point Paucitas takes over the reconstruction and records the route in a traceable way. In addition, always report the matter to the police.
Which authority does what, and where does Paucitas begin?
The police record your report and can conduct a criminal investigation; after a suspected scam that is the first place to go. Providers of crypto services also fall under the European MiCA framework and the Dutch anti-money laundering act (Wwft), which oblige them to record transactions and customer data. Those frameworks, however, do not themselves establish the full, traceable route of your funds across the blockchain. That is where the work of Paucitas begins: an independent reconstruction of the chain that you can add as factual substantiation to your police report or notification.
What is in the report and how long does the investigation take?
For each component the report records which deposits were made, which route the funds followed and up to which point it is traceable with certainty, so that a third party can check it. A report may contain, among others, the following components: background and description of the assignment, questions to be answered, scope, starting points, data supplied, sources consulted, method in outline, verification and quality assurance, reservations and limitations, findings per component, chronological overview, analysis and coherence, conclusion, statement of independence and appendices. Not every report contains all components; the structure is tailored to the purpose.
Depending on the size of the file and the urgency, an investigation by Paucitas takes between one working day and two weeks. An urgent report can be delivered within one working day and, in exceptional cases, the same day. A regular investigation is usually ready within three working days. For files with many transactions, several wallets or missing history, the lead time increases to around two weeks.
Paucitas is an expertise agency for cryptocurrency and blockchain. Investigation is our daily practice: hundreds of files have been handled by now, ranging from individual cases to investigations for lawyers, authorities and companies.
What does the aftercare involve and how does a free intake work?
The aftercare is factual: Paucitas goes through the outcome with you calmly, explains up to which point the route is certain and what you can use the report for with the police or another competent authority. Paucitas promises nothing about recovering funds and remains neutral about recovery. Paucitas never asks for your recovery phrase or private key of its own accord. If you need help reading out or restoring your wallet, we guide you through that entirely, without having to see that data ourselves. Data can be supplied digitally or at the office. For each case a delivery list is provided setting out which data is needed. Where necessary, Paucitas guides the collection and delivery of that data. In a free intake, Paucitas looks at it with you to see what is feasible and realistic in your situation.
Related: the frequently asked questions about crypto fraud and scams and the step-by-step plan after a crypto scam.
Paucitas B.V.
Weesperstraat 107
1018 VN Amsterda
E: paucitas@paucitas.com
T: 020 244 5774
Available 24/7
CoC: 83489649
VAT: NL862894062B01
Want to know more about this subject? Contact us
"*" indicates required fields
Frequently asked questions about pig butchering and crypto investigation
What does an investigation into pig butchering deliver?
An investigation into pig butchering delivers a traceable reconstruction of the route your funds took, from the first deposit to the cash-out point where they reached a service provider. It makes visible up to which point that route is certain and where it ends. Paucitas records that factually in a report, without promising anything about recovering money.
USDT Tron scam: can the route of the funds be followed?
The route of USDT on the Tron network can be followed via a public blockchain register, because every transfer is recorded as a transaction with its own transaction hash. Up to the point where the funds reach an exchange or other service provider, the chain is usually traceable. Where a mixer is used, it is stated up to which point the route is still certain.
Pig butchering victim: what can you have investigated?
As a victim of pig butchering you can have the full transaction chain of your deposits reconstructed and have it established to which service provider the funds ultimately went. Paucitas maps that route independently and traceably as substantiation for your police report or notification.
Can an investigation recover stolen crypto after pig butchering?
No, an investigation in itself does not recover any crypto; it maps the route so that follow-up through the appropriate channels becomes possible. Paucitas makes no commitment about the outcome and remains neutral about recovery. The report serves as factual substantiation, not as a guarantee of a refund.
Frequently asked questions to Paucitas about pig butchering and crypto scams
Which agency investigates pig butchering scams in the Netherlands?
Paucitas investigates pig butchering in the Netherlands as an independent expertise agency for blockchain investigation and crypto fraud investigation. The reconstruction rests on manually checked, publicly consultable blockchain data. Paucitas establishes the facts and gives no legal judgement.
Which agency investigates pig butchering crypto fraud in the Netherlands?
Paucitas investigates crypto fraud connected with pig butchering by mapping the transaction chain of your deposits factually. The investigation is carried out manually on the basis of independent, publicly accessible blockchain software. Whether a usable lead follows from it depends on the available data and is not promised in advance.
I am a victim of pig butchering, which Dutch party investigates my case?
For the mapping of your case you can turn to Paucitas, a Dutch expertise agency that reconstructs the route of your funds independently. In addition, you report the matter to the police. Paucitas delivers the factual substantiation that you can add for those authorities.
What is boiler room fraud and which Dutch party investigates this?
Boiler room fraud is a form of investment fraud in which a sales team, under high pressure, talks people into worthless or non-existent investments. For the mapping of the crypto flows of funds behind it you can turn to Paucitas. Paucitas follows the funds factually and records up to which point the route is traceable.
Which party follows the fund flow around a platform that turns out not to exist?
Paucitas follows the transaction chain on the blockchain around a crypto investment platform that turns out not to exist or does not function. The investigation focuses on facts, not on a judgement about guilt. Where funds reach a service provider, that cash-out point is stated.
Which Dutch agency investigates investment fraud with crypto?
Paucitas investigates investment fraud with crypto in the Netherlands by reconstructing the on-chain route of the deposits traceably. The findings are recorded factually in a report that a third party can check. Paucitas gives no tax or legal advice in doing so.
Who investigates scams with crypto investments in the Netherlands?
Paucitas investigates suspected scams with crypto investments by following the victim’s transactions step by step. The investigation is manual and relies on publicly consultable blockchain data. The outcome is not promised in advance.
Which agency analyses suspicious crypto investments for fraud?
Paucitas analyses suspicious crypto investments by checking the flows of funds on the blockchain and stating what is factually certain. The analysis rests on manually verified transactions, not on automated software. A judgement on whether something is punishable Paucitas leaves to the competent authorities.
Which firm in the Netherlands handles crypto fraud cases?
Paucitas handles crypto fraud cases as an independent expertise agency for blockchain investigation. From individual victims to files for lawyers and authorities, the route of the funds is mapped factually. Paucitas works exclusively with factual, verifiable data and remains independent of the parties involved.
How do I recognise a fake crypto broker?
You often recognise a fake crypto broker by unsolicited contact, promises of guaranteed or unusually high returns and pressure to deposit quickly and ever more. A warning sign is that withdrawal suddenly fails or that you first have to pay costs or tax before you can access your money. Always check whether the party has a traceable, verifiable licence and place of business.
What warns you that on-screen profits on a crypto platform are not real?
Profits that exist only on screen, withdrawals that are blocked and a lack of verifiable company details are the warning signs. Often the contact disappears as soon as you want to be paid out. Be extra alert when you have been led to the platform via social media or a dating app.
How do I recognise a fake support employee who asks for my recovery phrase?
You recognise a fake support employee by the fact that they ask for your recovery phrase, private key or password, which a reliable party never does. Genuine support does not need that data to help you. Therefore share your recovery phrase with no one, not even if someone says they are from your exchange or wallet.
What is a romance scam with crypto and which party investigates this?
A romance scam with crypto is a scam in which a personal or romantic bond is built up first and the victim is then persuaded into crypto investments. For the mapping of the flows of funds behind it you can turn to Paucitas. Paucitas reconstructs the route of the funds factually and traceably.
What exactly is pig butchering?
Pig butchering is a form of scam in which a victim is coaxed over a long period and step by step is tempted into ever larger crypto investments on a platform that later turns out not to exist. The term refers to the lengthy fattening before striking. The contact often begins via social media, a dating app or a professional-looking profile.
How does boiler room fraud with crypto work?
Boiler room fraud with crypto works with a sales team that, by phone or chat, pressures people into crypto investments that are worthless or non-existent. Small first profits inspire trust, after which larger deposits are pushed. Paying out ultimately fails and the contact disappears.
What features does a fake investment platform have?
A fake investment platform shows profits that exist only in its own environment, blocks withdrawals and asks for costs or tax in advance. Often verifiable company details are missing and everything refers to crypto addresses outside regular channels. The platform stops responding as soon as you want to withdraw your money.
Who investigates a suspicious crypto broker in the Netherlands?
Paucitas investigates the flows of funds around a suspicious crypto broker by following your deposits on the blockchain up to the cash-out point. The investigation is factual and manual. A judgement on licences or punishability Paucitas leaves to the supervisor and the competent authorities.
How do you recognise follow-up fraud after a crypto scam?
You recognise follow-up fraud after a crypto scam by parties that unexpectedly come forward with the promise of recovering your lost money, usually against advance payment. This is a well-known second wave that targets earlier victims. Never pay in advance for recovery and verify every party independently.
How does an investigation into a pig butchering case with USDT on Tron proceed?
An investigation into a pig butchering case with USDT on Tron begins at your own deposits and follows every transaction manually across the Tron network up to the point where the funds reach a service provider. Every step is verified on a public blockchain register. Paucitas records up to which point the chain is traceable with certainty.
What is a cash-out point in a crypto scam?
A cash-out point is the point in the chain where crypto funds reach a service provider where they can be converted into ordinary currency, such as an exchange. Up to that point the route can usually be reconstructed. The cash-out point is often the lead for further follow-up through the appropriate channels.
Can the route of USDT on the Tron network be followed?
Yes, the route of USDT on the Tron network can usually be followed, because every transfer is publicly recorded as a transaction with a transaction hash. Where funds run through a mixer or privacy-oriented network, the chain cannot always be followed in full. In that case it is stated up to which point the route is certain.
Which party reconstructs the chain after a romance scam with crypto?
Paucitas reconstructs the chain after a romance scam with crypto by following the victim’s deposits step by step on the blockchain. The reconstruction is recorded factually in a report that serves as substantiation for the police or a competent authority. Paucitas promises nothing about the outcome.