Pig Butchering Scam Trails Blend with Russian Assassins
Marius, a Lithuanian small-business owner and stock market investor, fell victim to a pig butchering scam. His life savings, about €150K ($162.5K), were gone in a few months.
Marius was like thousands of victims worldwide: an attractive and luxurious woman approached him on a dating app and gained his trust. Then, he was lured into investing via a platform where fund withdrawals were never meant to be possible.
The only difference is that, in his case, the lost money traveled through hands closely tied with Russian assassins.
Pig Butchering: A Billion Dollar Crime Industry
Because of its similarity to fattening hogs before slaughter, the illicit scheme is metaphorically called the pig butchering scheme. Originating in China during the pandemic, it has spread worldwide and is a billion-dollar industry today.
According to the FBI, investment scam victims in the United States alone lost over $4.6 billion last year.
Today, the pig butchering scam is a profitable branch of organized crime. In Southeast Asian countries, particularly Cambodia, specialized labor camps are set up where people are forced to carry out financial scam operations.
However, Marius’ story raises suspicions: Could it be possible that behind the pig butchering scam schemes in Europe lie much more powerful forces than just organized crime?
A Glamorous Jeweler from Moscow
When Marius joined Tinder on his lazy vacation day a few years ago, he soon received a message from an attractive jewelry maker named Irina. She lived in Moscow, and her social media profiles proudly displayed her luxurious tastes.
Soon after, Irina invited Marius to switch their communication to WhatsApp, where both kept exchanging messages and photos. A month later, Irina casually mentioned how she funded her lavish lifestyle.
The woman explained that her brother worked as a financial analyst for wealthy portfolio manager Nikolay, who had insider connections in various corporations. She and her brother traded from their investment account by following Nikolay’s signals for a 23.5% profit fee.
Irina offered Marius to join them. She explained that it would only take two hours per week and cost the same 23.5% quarterly fee once he made profits. She then brought Marius in contact with Nikolay.
At first, the latter was unhappy with the “too small” amount of €10K, which Marius decided to start with. But he later relented. All that was left was to open an investment account, send funds in Bitcoin, which would later be converted to euros, and start trading.
Marius Starts Making Profit
The platform used by Irina and Nikolay was Aplore.com. According to their website, it is a broker registered in Romania and licensed in Cyprus . However, Marius found no information proving this on the official registries.
“I was inclined to invest through, for example, IB [Interactive Brokers, a popular brokerage firm]. I suggested IB, but I was criticized that the leverage there is too small, it's not suitable for trading cryptos, in short, it's a sandbox,” claims Marius.The scammers had the answers to all his questions. They could explain everything logically. The Lithuanian businessman believes this is what finally convinced him.
He transferred the required amount in BTC to Aplore’s digital wallet and started trading. The choice was wide: from fiat currency pairs to equities, oil, and crypto.
In just the first week, Marius increased his portfolio by more than 30 percent with Nikolay’s guidance.
Problems and Demands Begin
Soon after, Nikolay’s team started urging Marius to increase his account balance. Higher leverage was possible above €50K, and oil options were available for those with more than €70K in their portfolio.
But minutes after Marius’s additional €40K reached Aplore’s account, the support team called with a new request for 30 percent of the account value as insurance against leverage trading.
A three-day deadline was given for transfer to a new wallet. If the transfer were not made, the trading account would be suspended.
Eventually, his deposits surpassed €140K, and the gains from successful trades expanded to €30K. But Marius was never able to withdraw his funds. Every attempt was met with excuses and requests for additional money.
At that time, reviews started appearing online, indicating that Aplore was a fraud. Marius filed a report with the police but continued communicating with the scammers without sending more money.
One day, Aplore suddenly disappeared. Irina, her brother, and Nikolay became out of reach, too.
Funds Flow to Ukrainian Crypto Exchange
As on-chain data revealed, funds from Marius’s Aplore account immediately left the platform and landed in digital wallet 38aoWNkpyKxqE1HQqJapHevfJWRSjepK2K, which accumulates inflows from numerous one-off deposits.
When a larger amount was gathered, the wallet sent out much bigger sums to intermediaries, where the process repeated. Intermediary wallets accumulated BTC and then moved it further to new destinations.
Eventually, a cumulative amount of $7.05 million was siphoned into the bc1qng0keqn7cq6p8qdt4rjnzdxrygnzq7nd0pju8q address.
Coinfirm, a blockchain analytics platform specializing in investigation solutions, identified the address as associated with WhiteBit, a Ukrainian cryptocurrency exchange, after Marius contacted them for help.
“I contacted WhiteBit, and they confirmed it,” Marius says.
Stolen funds leave Aplore, then change hands and merge with numerous other funds until landing at the same address on the WhiteBit crypto exchange. Source: ArkhamThe money, however, didn’t stay there for long. Having changed various hands, it flew into darknet markets and to the wallet 1BKN5obhkdoequshHnn96zZvFi3wCEdfiC on the HTX (former Huobi) exchange.
From there, its journey continued until it eventually entered a Binance account containing millions of dollars worth of other funds.
WhiteBit: Crypto Exchange Supporting Ukraine
WhiteBit is not a new name in the crypto world. Founded in 2018 in Ukraine by ex-salesman Volodymyr Nosov, it is often presented as one of the biggest European crypto exchanges, with a daily trading volume of over $2.5 billion.
Moreover, it is an active partner of Ukrainian state institutions. After Russia invaded, WhiteBit partnered with the Ukrainian Ministry of Foreign Affairs to aid consular services.
The exchange even purchased a Eurovision 2022 trophy for $900k at a charity auction to support the Ukranian army.
WhiteBit also became an official partner of UNITED24, an initiative by President Volodymyr Zelensky to raise funds for military and humanitarian aid in Ukraine. Finally, the exchange is an official partner of the Ukrainian national football team and FC Barcelona.
However, when digging deeper into its founders, the reality behind WhiteBit is much darker.
WhiteBit Group Sponsored Russian State Hitmen
As stated on the official WhiteBit website, the crypto exchange is managed by the WhiteBit Group, a conglomerate of eight different entities spread across the globe.
At least one of the UK-registered companies, WhiteBit Solution LLP, is run by two administrators , WhiteBit Solution LTD and Coddan Nominee Administrator LTD. Both are registered at the same address in the Seychelles, one of the most popular offshore financial hubs.
Coddan Nominee Administrator LTD has a branch, Sofbiz, formally based in Prague and led by the same director, Yekaterina Ostapchuk.
In 2019, Sofbiz was exposed as a financer of the attempted political coup and assassination of Montenegrin Prime Minister Milo Djukanovic during the nation’s 2016 elections.
The plotters allegedly planned to break into parliament, assassinate the Prime Minister, and bring a pro-Russian government to power, thus preventing Montenegro from joining NATO.
The attempted coup failed, and Montenegro’s judicial authorities officially confirmed that the attempt was organized and financed by Russian military intelligence (GRU). Two GRU agents were found guilty.
Although the events took place years ago, Coddan Nominee Administrator LTD remains the manager of WhiteBit Solutions LLP to this day.
The latter has not submitted any account filing with the UK government since March 2023. Although its status is still active, the confirmation statement is overdue.
Police Struggle with Crypto Crime Investigations
The wallet associated with WhiteBit, through which the stolen funds were funneled, has been flagged as fraudulent multiple times in open sources. It received incoming transfers from another suspicious address just a day before this article’s publication.
However, Marius no longer expects to recover his lost money. WhiteBit advised him that an official inquiry from law enforcement was the only way to disclose who was behind the suspicious wallet.
However, local police did not know what to do with the information he gave them. Marius says there are very few people who understand cryptocurrencies and blockchain.
"The police, at least in Lithuania, lag light-years behind the scammers' abilities. When a case is initiated, it is immediately assigned to a category where investigation is unlikely. Accordingly, minimal attention and resources are allocated."As the Lithuanian Criminal Police Bureau (LKPB) confirmed to DailyCoin, romance and investment scams often involve individuals operating in foreign countries. The police, following their competence and legal regulations, request data from their foreign colleagues.
“International cooperation, especially with third countries, when it comes to obtaining financial or electronic communication data, is a complex, lengthy process. Often, foreign entities do not provide significant data, which complicates the investigation of similar crimes,” explains the LKPB.
Over the past three years, the LKPB has seen 33 cases of romance and investment scams (pig butchering) involving cryptocurrencies. However, the authorities did not indicate that any had been successfully solved.
Scammers Return
While law enforcement struggles with their investigations, scammers run rampant. According to Marius, even though he came to terms with his financial losses and strives to forget painful lessons, scammers don’t let him.
"Every 2-3 weeks, I receive a call from a fake money recovery company, claiming they've recovered my money and want to return it, but I need to install AnyDesk or fulfill other additional conditions."Sometimes, scammers simply send emails mimicking legitimate company emails or pretend to be a cryptocurrency bank that doesn’t actually exist.
If they call, they always use a fake number and a VPN. After missing the call, it’s impossible to call them back.
But there are also some tricks that Marius has practiced to identify scammers.
If fraudsters ask him to identify before logging into a new platform, he insists that the scammers go first. If they suggest switching to WhatsApp or Telegram chats, Marius requests a video call. Their standard response is that company policies prohibit it.
“Then I ask them to send an email to prove they're really from the actual company and, for example, to take a photo of their work ID card. That's where it usually ends.”Scammers typically purchase domains similar to genuine money recovery companies’ domains. Requesting legitimate proof always scares them.
“After receiving such an email and being asked to send one from the genuine domain, a calm period for 2-3 weeks starts again,” Marius sighs. “But in reality, there won’t be any calmness until I change my phone number.“
Check out our story about the vanished BKEX crypto exchange:
How to Make a Crypto Exchange Disappear? BKEX May Know a Trick
A must-know list of why crypto withdrawals get suspended:
Crypto Withdrawals Frozen? Here’s What You Must Know
Disclaimer: The content of this article solely reflects the author's opinion and does not represent the platform in any capacity. This article is not intended to serve as a reference for making investment decisions.
You may also like
FBI raids Polymarket founder's home
Digital asset trading infrastructure provider Wyden completes $16.4 million Series B financing