Criminal Justice & the Rule of Law Cybersecurity & Tech Foreign Relations & International Law

Pig-Butchering Scams and the Limits and Promise of Civil Forfeiture

Yotam Berger
Monday, August 10, 2026, 2:00 PM
The United States has increasingly used civil forfeiture to recover cryptocurrency stolen by transnational scam networks. The strategy has produced important seizures—but it remains structurally fragile and insufficiently focused on victims.
(Prompart, https://tinyurl.com/mccamr22; CC BY 4.0 DEED, https://creativecommons.org/licenses/by/4.0/)

This article is based on “Confronting Pig-Butchering Scams Through Civil Forfeiture,” a Note forthcoming in the Stanford Law Review, volume 79

***

A, a 51-year-old Massachusetts resident, first met “Emily” on LinkedIn. She presented herself as the employee of a California venture capital firm and, after an initial exchange, suggested that they continue their conversation on WhatsApp. Over the next several days, the two engaged in what appeared to be genuine personal conversations. Ten days after their first contact, Emily introduced A to several investment opportunities. He ultimately invested more than $400,000 in cryptocurrency, only to discover that he could not withdraw his funds.

When A eventually confronted Emily, the scammer on the other side of the correspondence mocked him. “You might as well call the police now and find your poor FBI daddy,” the scammer wrote. “LOL ... Hurry up and call the police, poor little baby.” Only then did A report the incident to law enforcement.

A was the victim of a pig-butchering scam, one of many Americans who have lost hundreds of thousands of dollars to this growing criminal industry. Two aspects of his case, however, are somewhat unusual. First, the perpetrator explicitly acknowledged the fraud and taunted him to “call the police,” revealing their confidence that traditional law-enforcement mechanisms would prove ineffective. Second, “Emily” was at least partially mistaken: This was one of the relatively rare cases in which the FBI succeeded in seizing and recovering a portion of the stolen funds.

“Pig-butchering” is an unsavory term for a rapidly expanding form of transnational fraud. Scammers contact victims through social media, dating applications, or messaging platforms and cultivate relationships with them over time. Eventually, the scammers persuade their targets to purchase cryptocurrency and transfer it to what appears to be an investment platform. The platform displays fabricated profits, sometimes even permitting a small initial withdrawal. Once victims invest more substantial sums, however, they discover that their money is gone.

Cyber fraud itself is not especially novel. What is new is its industrialization. Pig-butchering scams have developed into a large transnational industry, concentrated primarily in Southeast Asia and responsible for billions of dollars in annual losses. In 2025, the FBI reported that cryptocurrency investment fraud was the largest source of financial losses to Americans, generating $7.2 billion in reported losses. The bureau described these scams as being perpetrated largely by organized criminal enterprises in Southeast Asia that use trafficking victims as forced labor.

The people behind the scam online profiles, then, are often not willing participants. Many have been trafficked into compounds in places such as Cambodia, Myanmar, and Laos, where they are forced to conduct scams under threats of violence. A 2025 United Nations report estimated that at least 300,000 people were involved in the forced scam workforce, while Interpol has reported beatings, torture, sexual violence, and debt bondage inside scam compounds. Amnesty International has framed these compounds as the sites of slavery.

Modes of Disruption

The result is a system of dual victimization. On one side of the screen, victims lose their life savings. On the other, trafficked workers are often forced to carry out the fraud. Meanwhile, the transnational criminal organizations profiting from it have become deeply embedded in the political economies of the jurisdictions in which they operate, sometimes benefiting from official collusion and political protection. This may reflect, in part, the industry’s immense economic significance: One study estimated that scam operations generate revenues equivalent to roughly half of Cambodia’s formal gross domestic product.

The allegations against Chen Zhi provide an example. According to a federal indictment filed in the Eastern District of New York, Chen Zhi’s Prince Group presented itself as a legitimate conglomerate while operating one of Asia’s largest transnational criminal organizations, deriving enormous profits from forced-labor scam compounds in Cambodia. The indictment alleges that Chen and his co-conspirators used political influence to shield the enterprise. Those allegations are particularly notable given Chen’s political stature: he served as an adviser to Cambodia’s prime minister and was granted the title “lord.”

Host jurisdictions have nevertheless taken some measures against the compounds. Cambodia, for example, has enacted legislation targeting online scam operations and, following Chen’s indictment in the U.S., extradited him to China. Cambodia and other countries in the region have also conducted raids, sometimes in cooperation with foreign authorities, including, for example, the U.S., the United Arab Emirates, and China. One prominent example of a crackdown includes the operation against the notorious KK Park compound in Myanmar. Yet the industry continues to flourish, and reported losses due to these “investment scams” have risen substantially in recent years. The growing use of artificial intelligence will likely increase the scale and sophistication of these schemes by reducing language barriers and enabling scammers to produce increasingly convincing messages, images, videos, and fraudulent platforms.

The United States has adopted several strategies in response. The first is prevention. Agencies publish warnings and educational materials, while initiatives such as the FBI’s Operation Level Up attempt to identify victims while a fraud remains in progress. According to the FBI, the program notified thousands of potential victims between its launch in January 2024 and the end of 2025, preventing an estimated $500 million in additional losses.

A second strategy targets the organizations operating the compounds. The Treasury Department has imposed sanctions on alleged scam operators and associated companies. The Justice Department has increasingly treated the problem as one of transnational organized crime rather than merely a collection of individual fraud cases. Its Scam Center Strike Force brings together prosecutors, the FBI, the Secret Service, and other agencies to pursue organizational leaders and disable the infrastructure that permits the compounds to target Americans.

Third, the government has pursued measures after victims discover the fraud and report it. In at least several dozen cases, U.S. authorities have initiated civil forfeiture proceedings to trace and seize stolen funds. The most prominent example is the Chen Zhi matter, in which the United States seized approximately $15 billion in cryptocurrency. In March 2026, President Trump also issued an executive order addressing “cybercrime, fraud, and predatory schemes against American citizens.” The order directed federal agencies to develop action plans, continue prioritizing prosecutions, and establish a victim-restoration program, among other measures.

Civil Forfeiture and Pig-Butchering Scams

Civil forfeiture is a legal action that permits the government to obtain property connected to a crime without first securing a criminal conviction against its owner. The proceeding is brought in rem, against a thing, the property itself. A person claiming an interest in the property may appear in court to contest the forfeiture, and if no successful claim is filed, the property may be forfeited to the United States.

In a study of federal court dockets, I identified 81 civil forfeiture actions targeting assets connected to pig-butchering schemes filed by March 2026. Eighty of the cases followed a broadly similar pattern. Victims were contacted online, directed from legitimate cryptocurrency exchanges to fraudulent investment platforms, shown fictitious returns, and eventually prevented from withdrawing their funds. The actions were filed in 33 federal district courts, with more than half filed in 2025.

Even successful seizures generally recovered only a small portion of the losses (with the notable exception of the Chen Zhi-Prince Group case). For example, in one case, at least 13 victims lost more than $5 million, while the government seized less than $80,000. In another, at least a few dozen victims lost at least $14 million, but less than $650,000 was recovered.

The cases also reveal how the government obtains control over cryptocurrency. Although virtual assets may be held in unhosted wallets controlled directly by their owners, the funds in the dataset were usually seized through one of two intermediaries (again, with the only exception being the Chen Zhi case). In 38 cases, the relevant assets were held by a cryptocurrency exchange, such as Binance, that agreed to freeze the account and transfer the funds. In 31 cases, the government relied on a stablecoin issuer, such as Tether. Because a centralized issuer controls the stablecoin, it may freeze particular tokens, “burn” (or destroy) them, and reissue an equivalent amount to a government-controlled wallet.

The Fragility and Legitimacy Problems

The strategy that arises from the docket analysis has produced real results. Assets have been removed from criminal organizations. But the cases also expose two fundamental limitations: fragility and legitimacy.

It is fragile because it ordinarily depends on the cooperation of foreign private companies. A U.S. court may issue a warrant directing an exchange or issuer to transfer cryptocurrency, but many of the relevant companies are incorporated abroad, in places such as the Cayman Islands or El Salvador. The warrant does not, by itself, compel compliance in those jurisdictions.

The existing system therefore frequently operates through voluntary cooperation. Investigators identify a wallet, ask an exchange or issuer to freeze it, obtain a warrant, and then request that the company transfer the assets to the United States. Some companies comply (one may speculate that complying with the U.S. government may be a favorable move, at least to an extent, in certain contexts, even if the warrant has just been issued in the U.S.). Others may delay or decline. Obviously, in the forfeiture actions we see only the successful efforts, and even then, sometimes more than one warrant had to be issued before the foreign intermediary complied.

That arrangement can work so long as cooperation serves the intermediary’s interests. But it may not be a durable foundation for a major enforcement strategy. Companies may face conflicting demands from other jurisdictions, resist disclosing customer information, or reconsider cooperation if it threatens their business. Dependence on a small number of intermediaries may also give those companies substantial leverage over the government.

Further, this strategy also depends on scammers making avoidable mistakes. Authorities can seize funds from an exchange only if the scammers leave the assets in an account controlled by that exchange. Stablecoins are reachable only if their issuer is both technically able and willing to freeze them. Once criminal organizations adapt—by moving assets into unhosted wallets, using less cooperative intermediaries, or converting proceeds into other forms of property—the current model may become considerably less effective.

Civil forfeiture, then, is not only intermediary-dependent but reactive. Authorities typically intervene after a victim has reported the crime, investigators have traced the funds, and the assets have reached a location where a cooperative institution can freeze them. At each stage, substantial sums may already have been moved beyond reach. In this regard, the dockets examined show that scammers use sophisticated methods to conceal and commingle stolen funds. The money often moves rapidly between wallets, where it is divided and mixed with other assets. The government relies on complex investigative tools and software to trace these transfers, but some funds may nevertheless become effectively unrecoverable along the way.

The second limitation, legitimacy, concerns what happens after the money is seized and how often victims actually recover. Of the 81 cases in the dataset, 29 remained pending at the cutoff date, in which the search has been made and the dataset assembled in March 2026. Among 51 concluded proceedings, 42 resulted in the entire seized amount being forfeited to the United States. In just eight cases, the victims appeared in court, and the cases generally ended with agreements dividing the assets between the victims and the government—even though the victims had not recovered the full amounts stolen from them.

These figures do not necessarily mean that victims ultimately received nothing. After property is forfeited, the Justice Department may distribute it through an administrative process known as remission. Before forfeiture, victims may attempt to file claims in court. Doing so requires them to learn that the government has seized property connected to their losses, demonstrate an interest in that specific property, and participate in federal litigation. That may be difficult even for a sophisticated American claimant. It is considerably less realistic for foreign victims who do not speak English, cannot identify the relationship between the seized wallet and the wallet to which they transferred funds, and may be unaware that a proceeding even exists.

After forfeiture, victims may petition the Justice Department for remission. To qualify, they must establish a specific pecuniary loss directly caused by the offense, show that they did not knowingly contribute to it, and demonstrate that they lack another reasonably available source of recovery. The regulations also give the department discretion when calculating losses is too difficult, when the likely payments would be small compared with administrative costs, or when the number of victims and the amount available make distribution impracticable. Those grounds fit poorly onto pig-butchering scams. These cases characteristically involve large numbers of victims, complex laundering, commingled assets, incomplete information, and recoveries that constitute only a fraction of total losses, and victims may need to pay more funds in legal fees to their lawyers, on top of the funds they have already lost.

The problem is not that forfeiture itself is illegitimate, then. Removing funds from organizations engaged in fraud and human trafficking can damage their operations. Nor is full recovery always possible. The legitimacy problem, though, lies in the gap between enforcement success and victim recovery. A case may be publicly described as successful once millions of dollars have been seized and forfeited, even when victims recovered hardly anything.

This gap becomes especially significant when the United States seizes funds stolen from a pool of global victims. Foreign victims may face the greatest barriers to learning about the proceeding, connecting the seized assets to their losses, and navigating a U.S. administrative process. Civil forfeiture may therefore succeed as a disruption mechanism while failing as a victim-recovery system.

Toward a More Durable Enforcement Strategy

The answer, I argue, is not to abandon civil forfeiture, but to reduce its fragility and strengthen its legitimacy. That requires both developing less intermediary-dependent methods of seizure and creating more effective mechanisms for returning forfeited assets to victims, both American and international.

The Chen Zhi case offers one possible model for more robust enforcement. Unlike nearly all the other cases in the dataset, the government seized bitcoin held in unhosted wallets, apparently without relying on a cryptocurrency exchange or stablecoin issuer. The public filings do not explain precisely how the government obtained control of the assets. One speculation would be potential utilization of cooperating witnesses with access to evidence, or technical methods that may provide lawful access to devices containing wallet credentials. Such approaches could allow authorities to reach criminal proceeds even when scammers avoid cooperative intermediaries.

International cooperation is equally important. Scam organizations may hold property outside both the United States and the jurisdictions in which their compounds operate. Cooperation with foreign authorities can help identify and seize those assets. Physical access to scam compounds may also yield devices, financial records, wallet credentials, and other information needed to trace criminal proceeds. Where host jurisdictions tolerate the scam industry, the United States should combine law enforcement cooperation, diplomatic pressure, and targeted sanctions to encourage more meaningful action against the compounds and their operators.

More effective seizures, however, would only make the legitimacy problem more pressing. The current process does too little to ensure that victims, especially unidentified and foreign victims, can recover forfeited assets.

Notices should be made more accessible and informative. Rather than relying primarily on technical notices published on forfeiture.gov, the government should circulate notices through social media, embassy channels, and other platforms likely to reach victims, and translate them into relevant languages. Notices should also include information that could allow victims to recognize a connection to their losses, such as related wallet addresses, the names of fraudulent platforms and identities, and the dates during which the schemes operated.

The remission framework also requires reform. The Justice Department should narrow its discretion to deny otherwise valid petitions merely because the victim pool is large, individual recoveries may be modest, or calculating losses is administratively difficult. Those characteristics are inherent in industrialized pig-butchering schemes and should not, I believe, by themselves defeat compensation.

The process should also become more transparent. The government could publish more systematic information about how remission decisions are made and how forfeited funds are distributed, while preserving the anonymity of individual claimants. For large and complex cases, the government may consider establishing a dedicated fund similar to those used in other major fraud cases.

Finally, authorities should use crypto-tracing data proactively to identify victims. The same analysis that traces funds to a wallet targeted for seizure may reveal the accounts from which victims originally transferred their money. If victims can be identified, the government should contact them directly and inform them of the forfeiture and remission processes.

Pig-butchering scams are among the most pressing criminal threats of our day. Civil forfeiture has shown that some limited proceeds of pig-butchering scams can be recovered. However, the seizure itself should not be the only measure of success. A more durable strategy must reduce reliance on voluntary private, offshore cooperation and create a realistic path for returning recovered funds to victims.


Yotam Berger is a J.S.D. candidate at Stanford Law School, where he is a Stanford Interdisciplinary Graduate Fellow and a Knight-Hennessy Scholar. He previously clerked at the Supreme Court of Israel, worked for Israel’s Deputy State Attorney, and served as Haaretz’s West Bank correspondent. His research examines cybersurveillance and the evolving relationship between law enforcement, Big Tech, and the commercial spyware industry.
}

Subscribe to Lawfare