Pig Butchering USDT Tracing in APAC: Intake Checklist for Law Firms

Pig butchering (sha zhu pan, 杀猪盘) is the dominant investment-fraud typology in APAC, accounting for the majority of crypto-related fraud loss reported to police in Hong Kong, Singapore, Malaysia, Thailand, and the Philippines from 2022 onwards. Romance or friendship grooming on WhatsApp, Telegram, Line, or WeChat is followed by an inducement to invest in a fake crypto trading platform. Many investigated matters use stablecoins, including USDT on TRON, but the asset and network must be established from the victim's transaction records rather than assumed from the typology.

The forensic signature is consistent across operators. Victim deposits land in a per-victim "collection" address (a fresh TRON address generated by the platform). Within hours — sometimes minutes — a sweep consolidates dozens to hundreds of victim collection addresses into a single "pool" address. From the pool, funds move into an OTC desk or a regional exchange (Binance, MEXC, OKX, KuCoin, HTX, or one of the smaller licensed regional VASPs). A subset is bridged to ETH or BSC for further laundering through Tornado Cash or Railgun.

The operators behind these platforms are typically based in compound complexes in Sihanoukville (Cambodia), Myawaddy (Myanmar), or Laos special economic zones, with backend infrastructure in mainland China or Hong Kong. The on-chain pattern is recurrent enough to guide triage, but every address, hop, controller, and off-ramp attribution still requires case-specific evidence.

Counsel: collect the following before engaging forensics. Missing items don't kill a case, but gaps can delay tracing or prevent an authority or VASP from acting.

• Platform name + URL + screenshots of the trading dashboard, withdrawal page, and "customer service" chat.
• Every deposit TX hash from the victim's wallet (full 66-character hash for ETH/BSC, full 64-character for TRON). Partial hashes are useless.
• Date range of the relationship + the messaging transcripts (Telegram, WhatsApp, Line export). Pure on-chain analysis cannot prove the social-engineering element required for fraud charges — the messages do.
• Victim's KYC at the source VASP — where the victim acquired the USDT in the first place. Needed downstream for the receiving VASP to confirm the victim's identity when freezing.
• Local police report or filed complaint number — many VASPs and issuers require an official case reference before considering preservation, disclosure, or freeze action.
• Counterparty social media handles — Instagram / LinkedIn / dating-app profiles used during grooming. These often link to a small set of recycled persona-photo libraries that forensic teams can pattern-match across cases.
• Bank or PSP records for the fiat-to-USDT acquisition leg. Many APAC victims used local P2P (Wise, Revolut, regional banks) — those records prove pre-fraud asset ownership.
• Recovery attempts already made — particularly any contact with "recovery agents" who themselves are often part of the same fraud ring (advance-fee re-victimization).

A representative pattern seen in some APAC pig-butchering matters is:

• Hop 1: Victim → Collection address. Fresh TRON address, one per victim, displayed in the fake platform UI as "your deposit address". Used for 1-N deposits per victim, then never used to receive again.
• Hop 2: Collection → Pool. A later sweep may consolidate multiple collection addresses. Shared ownership cannot be inferred from timing alone; each relationship must be tested against transaction and attribution evidence.
• Hop 3: Pool → Distribution. Splits to multiple downstream addresses — OTC desk deposits, exchange deposit addresses, bridge contracts, or further consolidation layers.
• Hop 4: Off-ramp. OTC desk converts to local fiat (CNY via regional informal banking, or USD/SGD/HKD via licensed OTC), or exchange deposit cashes out via P2P, or bridge moves to ETH for mixing.

Some matters involve bridges or other cross-chain services. The observable portion of the route depends on available chain data, bridge mechanics, and attribution evidence; bridge use alone does not establish the destination controller or a recovery outcome.

Pool addresses are the operator's structural weakness. They are reused across many unrelated victims because rotating them too aggressively breaks the operator's own accounting. 5CIP tests candidate clusters with transaction-level evidence and available independent labels. Shared infrastructure is excluded from controller attribution unless the evidence supports common control.

This matters for two reasons:

• Joint disclosure context. Where lawfully documented, multiple victim paths can help an authority or VASP understand why an address matters. It does not compel a particular response.
• Cross-victim corroboration. Similar flows can support a typology assessment when backed by transaction hashes and independent evidence, while alternative explanations and shared-service exposure remain explicit.

For class-action style recovery, 5CIP produces a master report that enumerates the shared infrastructure and per-victim appendices that document each individual loss chain back to the shared pool.

• Hong Kong: Preserve evidence and use current Police, SFC, HKMA, VASP, and court channels as applicable. Interim relief depends on counsel, evidence, urgency, jurisdiction, and the court.
• Singapore: Preserve evidence and use current Police, Anti-Scam Centre, MAS-regulated-provider, mutual-assistance, and court channels as applicable.
• Malaysia: Bukit Aman Commercial Crime Investigation Department (CCID) handles; counsel should file a police report FIRST then attach the 5CIP packet to the request. Local exchanges (Luno MY) are responsive; offshore exchanges require Mutual Legal Assistance via Attorney General's Chambers.
• Thailand: Preserve the police report, bank-transfer evidence, and receiving-account details, then use the current official police and bank channels. Freeze timing and the required authority vary by bank, facts, jurisdiction, and whether funds remain; no fixed response time should be assumed.
• Philippines: Preserve evidence and confirm current AMLC, PNP, NBI Cybercrime, VASP, and court routes. Response and preservation timing are case-specific.
• Indonesia: Bappebti (commodity regulator) plus Polri Cyber Crime Directorate. Local crypto exchanges (Indodax, Pintu) registered with Bappebti are responsive; many cases route through P2P which is harder.
• Taiwan: Preserve evidence and confirm current Financial Supervisory Commission, Criminal Investigation Bureau, bank, VASP, and court routes.
• Japan / South Korea: Confirm the current police, regulator, VASP, and court process in the relevant jurisdiction; licensing does not guarantee disclosure, freeze, or recovery.

• Preserve immediately: File the appropriate report, preserve devices and communications, and record complete transaction hashes.
• Triage the route: Identify supported collection, consolidation, bridge, issuer, and VASP touchpoints without asserting ownership from proximity alone.
• Run lawful requests in parallel: Counsel selects the current preservation, disclosure, issuer, VASP, court, or mutual-assistance channels supported by the facts.
• Update from receipts: Treat every freeze, disclosure, and recovery as pending until the responsible third party returns a verifiable receipt.

Speed matters because funds can move, but no fixed recovery curve applies. Asset location, legal authority, counterparty records, and the continued availability of funds determine which recovery paths remain viable.

No responsible investigator can quote a recovery percentage from intake timing alone.

• Known asset location: Confirm whether funds remain at an address, issuer, bridge, or VASP and whether the holder can lawfully act.
• Evidence quality: Complete transaction hashes, ownership records, communications, and police or court references materially affect actionability.
• Authority and jurisdiction: Preservation, disclosure, freeze, and recovery are distinct actions with different legal thresholds.
• Counterparty cooperation: No VASP, issuer, bank, authority, or court outcome should be assumed before a current receipt exists.

Treat any guaranteed recovery percentage or guaranteed timeline as a warning sign. 5CIP reports supported paths and limitations; it does not promise a recovery outcome.

5CIP will tell counsel up front, in writing, what realistic recovery looks like for the specific case — not what the engagement letter would suggest. The full forensic methodology documents how confidence tiers (1A/1B/2/3) are assigned. Counsel ready to open a case use /case-intake; individual USDT scam victims (not counsel) should start at /usdt-scam-recovery for the realistic-timeline process and counsel referral.

The 5CIP APAC pig-butchering report ships in a single package containing:

• Executive summary — 2 pages, suitable for filing as exhibit to a police report or court application.
• Tier 1A direct trace — per-victim wallet → collection → pool → off-ramp, every hop with TX hash, block, timestamp, and block-explorer screenshot.
• Cluster analysis — the shared pool infrastructure, other victims sharing it, time series of pool inflows/outflows.
• VASP subpoena targets — exact addresses, TX hashes, date ranges to include in each disclosure request. Pre-drafted disclosure-request letter template per jurisdiction.
• Tether/Circle freeze packet — ready for issuer-level submission via the standard stablecoin-freezing workflow.
• Anti-money-laundering narrative — typology classification, layering pattern, predicate offense classification — for use in the law enforcement referral.
• Chain of custody log — analyst identity, API call timestamps, data source attestations. SHA-256 hashes on each evidence file.
• Honest limitations section — what we could not determine, and why. Defense counsel will probe this; better to surface it ourselves.

• Delay evidence preservation or reporting. Use the appropriate current police and provider channels promptly; required forms and authority vary.
• Engaging "recovery agents" first. Re-victimization rate on cold-contact recovery agents is high; they extract additional fees with zero recovery.
• Sending partial TX hashes. A 6-character truncated hash is not actionable. VASPs reject the request. Always send the full hash.
• Treating each victim as a standalone case. APAC pig-butchering operators run pools shared across hundreds of victims; cross-victim clustering is the fastest path to VASP cooperation.
• Waiting for a long narrative before preserving evidence. A concise, transaction-backed preservation packet can be prepared while deeper analysis continues.
• Believing the platform's "withdrawal" pretense. Many victims, before engaging counsel, attempt withdrawals that require additional "tax deposits" — these are pure additional theft. Stop them immediately.
• Conflating the off-ramp counterparty with the principal fraudster. The OTC desk that converted the pool's USDT to fiat is often a downstream third party that needs subpoena, not the operator itself. Naming them as defendant without forensic support invites dismissal.

The most common APAC case structure: victim in HK/SG/MY/TW, fraud platform operating from a SE Asia compound, off-ramp via OTC in mainland China or via VASP in Seychelles/BVI. Three coordination paths:

• Victim-jurisdiction primary. File in the victim's home jurisdiction and assess the applicable mutual-assistance route for foreign-held records or assets.
• VASP-jurisdiction direct. Where permitted, local counsel can assess preservation or disclosure relief in the relevant entity's jurisdiction.
• Issuer-level parallel. For supported assets, counsel can submit the issuer's current compliance materials. The issuer decides whether the request, authority, and evidence meet its requirements.

5CIP coordinates all three in parallel as the default. Counsel chooses which to lean on based on cost, urgency, and the specific facts.

We do not take cases where recovery is structurally impossible. We tell counsel up front, refund the engagement, and document our reasoning. The structural disqualifiers:

• Available evidence shows no traceable asset or legally actionable counterparty after reasonable checks.
• All funds bridged to Monero or other privacy chains with no further on-chain visibility.
• The likely cost and jurisdictional complexity materially exceed the client's stated recovery objective.
• Victim cannot produce transcripts AND no police report filed — fraud element cannot be established, only theft.
• Victim's source-of-funds itself is questionable (e.g., the deposited USDT was previously stolen from a third party) — engaging would create conflicting victim claims that we cannot ethically arbitrate.

Passing intake means the matter is suitable for scoped investigation; it does not guarantee an attribution, freeze, disclosure, or recovery result.