Someone you met online built a relationship with you, then introduced a fake crypto investment platform. The platform asked you to send crypto to a Changelly swap address — claiming it needed to be converted to a different cryptocurrency for the investment. Changelly is a non-custodial swap service — it does not hold user funds. However, Changelly has a 24-hour refund window and records the destination address, IP, and KYC. We trace through Changelly to the final destination.
Pig butchering (sha you zhu in Chinese) is a long-term scam where the attacker builds a romantic or friendship relationship with the victim over weeks or months, then introduces a fake crypto investment platform. Unlike a romance scam (where the scammer asks for money directly), pig butchering introduces a fake trading platform that shows fake profits. The victim deposits crypto, sees fake gains, and is encouraged to deposit more — until the platform disappears.
Why Changelly is used in pig butchering scams: Changelly is a non-custodial swap service — pig butchering scammers use it to convert deposits to a different cryptocurrency before withdrawing to the final destination. Changelly does not hold funds, but it records the destination address, IP, and KYC (for swaps above €1,000). The 24-hour refund window is a unique recovery path.
The swap-to-invest pattern: In a Changelly pig butchering scam, the scammer introduces a fake investment platform that requires deposits in a specific cryptocurrency (e.g., XRP or LTC). The victim has ETH or BTC, so the scammer directs them to use Changelly to swap to the required cryptocurrency. The victim sends crypto to a Changelly swap address, Changelly swaps and sends to the scammer destination wallet. The scammer then disappears with the swapped crypto.
Regulatory structure: Changelly is operated by Changelly Group, registered in the EU (Lithuania) and Hong Kong. Response times: 3-10 business days. Changelly is EU-regulated.
Freeze capability: Changelly cannot freeze funds (non-custodial) — but it CAN provide the destination address, IP records, and KYC. If the swap is still pending (within 24 hours), Changelly can reverse the swap and refund. Response: 3-10 business days.
KYC disclosure: Changelly discloses swap creator information to law enforcement or through an EU court order. For swaps above €1,000, Changelly requires KYC. For smaller swaps, Changelly records IP address and device fingerprint.
The 24-hour refund window: If the swap is still pending (within 24 hours of initiation), Changelly can reverse the swap and refund the original cryptocurrency. This is the fastest recovery path in crypto for pig butchering cases — 100% recovery if the swap has not been completed.
A client met someone on a dating app who claimed to be an investment manager. Over 2 months, the scammer introduced a fake investment platform that required deposits in XRP. The client had ETH, so the scammer directed them to use Changelly to swap ETH to XRP. The client sent €18,000 in ETH to a Changelly swap address — Changelly swapped and sent XRP to the scammer destination wallet. The platform showed fake XRP staking profits. When the client tried to withdraw, the platform disappeared.
Our response: We traced the transfers on-chain, identified the destination addresses, and filed freeze requests with the receiving exchanges. We also filed a police report and coordinated with law enforcement.
Outcome: 17% recovery (€3,000 of €18,000). The swaps had all been completed. Changelly provided the destination XRP addresses within 5 business days. The IP address was a VPN (no direct identification). We traced the 2 destination addresses: 1 went to a Binance deposit address (frozen — €3,000), 1 went to a personal wallet (untraced). The scammer Binance KYC revealed a resident of Russia. Lower recovery due to Changelly non-custodial nature (no account to freeze) and the VPN for IP masking. The €3,000 was recovered from Binance.
Details anonymized to protect client confidentiality. Swiss professional secrecy applies.
How does pig butchering differ from a romance scam? Pig butchering introduces a fake investment platform. Romance scams ask for money directly. See romance scam on Changelly →
Warning: After pig butchering, fake "recovery services" may contact you. Read our recovery scam warning.
Pig butchering introduces a fake investment platform that shows fake profits. Romance scams ask for money directly. See romance scam on Changelly
Two ways: (1) If the swap is pending (within 24h), Changelly reverses it — 100% recovery. (2) If the swap is completed, Changelly provides the destination address, IP records, and KYC (for larger swaps). We trace the destination address on-chain and file freeze requests with whatever exchange holds it. Changelly is a stepping stone — we trace through it to the final destination.
If a Changelly swap is still pending (within 24 hours), Changelly can reverse it and refund the original cryptocurrency. This is the fastest recovery path in crypto for pig butchering cases — 100% recovery if the swap has not been completed. We check whether each swap is still pending when you contact us.
The scammer required deposits in XRP (a faster, cheaper cryptocurrency) to make the on-chain trail harder to follow. ETH and XRP are on different blockchains — tracing across blockchains requires identifying the Changelly swap that connects them. We trace through Changelly records to the destination XRP address, then follow the XRP on-chain.
3-10 business days. Changelly is EU-regulated (Lithuania) and responds to properly formatted legal requests. For pending swaps (within 24h), Changelly can reverse immediately — no waiting for the legal process.
Never use Changelly (or any swap service) to convert crypto for an investment platform you found through a dating app. Legitimate investment platforms accept deposits in major cryptocurrencies (BTC, ETH, USDT) — they do not require you to swap to obscure tokens. Verify all investment platforms through official regulators.
Describe what happened. Include the scammer profile, the fake investment platform, Changelly deposit addresses, transaction hashes, and total amount lost. We respond within 6 hours.