Scamming Scammers - Weaponizing OSS Against Pig Butchering, Organized Crime

Scamming Scammers - Weaponizing OSS Against Pig Butchering, Organized Crime

Speakers: Erin West, Former Prosecutor, Founder of Operation Shamrock

Conference: DEF CON

YouTube: https://www.youtube.com/watch?v=0KGhP4qjmXk

Overview

Erin West, a veteran prosecutor with 26 years of experience in Santa Clara County, delivered a stark and urgent call to action at DEF CON, exposing the devastating global crisis of pig butchering scams (known as Sha Zhu Pan). This sophisticated, long-con romance and investment fraud scheme is not merely a collection of isolated incidents but a meticulously orchestrated operation run by Chinese organized crime, including known triads. The talk highlighted the unprecedented scale of financial theft—estimated at over $50 billion annually in the U.S. alone—and the horrific human cost, with hundreds of thousands of individuals trafficked and enslaved in scam compounds across Southeast Asia.

West’s presentation transcended a typical security brief, serving as a passionate plea to the technical community for assistance. She articulated a critical failure of traditional law enforcement, banking, and diplomatic channels to adequately address this rapidly escalating threat. The core message was that the enemy is outrunning conventional defenses, necessitating innovative, community-driven disruption strategies. By detailing the psychological manipulation, technical infrastructure, and geopolitical implications of these scams, West aimed to galvanize the DEF CON audience to leverage their unique skills in open-source intelligence, illicit finance tracking, and supply chain analysis to combat this crisis.

The urgency of West's message underscored that pig butchering is not just a financial crime but a multifaceted attack on individuals, national economies, and even national security, with Chinese state involvement in infrastructure development in regions housing these scam operations. Her talk revealed a grim reality: while physical borders are heavily guarded, digital borders remain alarmingly vulnerable, allowing organized crime to operate with near impunity. The call to "do something" was a direct challenge to the cybersecurity community, emphasizing that their expertise is no longer just beneficial but absolutely essential in disrupting this global criminal enterprise.

Background

▶ Watch: Introduction and urgent call for community help (0:00)

Pig butchering scams are a highly evolved form of long-con fraud, blending elements of romance and investment schemes to systematically defraud victims. The name "pig butchering" derives from the analogy of fattening a pig before slaughter—scammers build deep emotional connections with their targets, cultivating trust over weeks or months, before leading them to fraudulent investment platforms where their funds are ultimately stolen.

The typical modus operandi begins with an unsolicited message, often a misdialed text, initiating contact. If the victim responds, the scammer, often posing as an attractive and successful individual (e.g., "Jessica," "Ethan"), quickly moves the conversation to end-to-end encrypted platforms like WhatsApp. Here, they spend an "inordinate amount of time" crafting a seemingly perfect relationship, leveraging psychological manipulation to fulfill emotional needs the victim may be lacking. Scammers are trained to understand victim demographics and responses, often portraying themselves with appealing hobbies like golf or yoga, and displaying ostentatious wealth to build credibility.

Once trust is established, the scammer introduces the "secret" to their wealth: highly profitable cryptocurrency investments. This always involves an "attractive lure" (the scammer's apparent success) and a "knowing professor" (often a fictional uncle or expert) who will guide the victim. Initially, victims are encouraged to invest a small, manageable sum, often around $5,000, which the scammer knows is accessible to them due to prior profiling. The victim is then guided, screenshot-by-screenshot, to open an account on a legitimate, American-based cryptocurrency exchange such as Coinbase, Kraken, Binance, or Crypto.com. They are instructed to convert their fiat currency into a stablecoin, typically Tether (USDT).

The critical turning point, and where the theft occurs, is when the scammer directs the victim to transfer their USDT to a fraudulent, custom-built investment application, often disguised with a seemingly professional interface but bearing red flags like "Goo Markets." On these fake platforms, victims see fabricated profits—their initial $5,000 might appear to double to $10,000 within days. Sometimes, scammers even allow small withdrawals to reinforce the illusion of a legitimate platform and further cement trust. However, the money is "long gone," having already moved "down the blockchain" through a network of money mules for rapid conversion and laundering.

The scam culminates when victims, convinced by their "success," invest every penny they possess, often liquidating retirement accounts, college funds, or even taking out equity lines of credit. When they finally attempt to withdraw a large sum, they are hit with exorbitant "taxes" or "fees" (e.g., 24% of their portfolio), which must be paid with new money, not from their supposed gains. This is the sunk cost fallacy in action, as victims, having invested so much, desperately try to recover their funds, only to lose more. By the time victims realize they've been scammed, they have lost everything, are heavily in debt, and are often too humiliated to report it.

Erin West highlighted that this is not an "elder fraud problem"; while seniors are impacted, statistics show that individuals under 60 are losing more money. The annual financial impact is staggering: $6.5 billion lost to investment scams and over $7 billion total when romance fraud is included, representing a 40% increase year over year. Due to massive underreporting (estimated 1 in 7 to 1 in 15 victims report), the true figure is likely over $50 billion annually in the U.S. alone. This crisis is exacerbated by the fact that local law enforcement often turns victims away, lacking the resources or expertise to handle complex cryptocurrency-based international fraud.

The geographical nexus of these operations is Southeast Asia, particularly Cambodia and Myanmar, with growing presence in the Philippines and Dubai. These scam centers are controlled by notorious Chinese organized crime groups, including individuals like Broken Tooth Koi and Shenzee, associated with known triads. They are "masterful and funded," operating at a scale that is "bulldozing" traditional law enforcement efforts. The recruitment of scammers themselves involves human trafficking, where individuals from countries with high unemployment (e.g., Uganda) are lured with fake job offers (e.g., $1,000/month for data entry) via platforms like Meta, only to find themselves imprisoned in fortified compounds, forced to scam under threat of extreme violence and torture.

West underscored the geopolitical implications, noting China's Belt and Road Initiative has facilitated the construction of infrastructure in these regions, including casinos and airports, some of which are being repurposed or built specifically for scam operations, and even accommodate military aircraft, raising national security concerns, such as the Dar Sor airport adjacent to the Ream naval base in Cambodia, now effectively a Chinese naval port.

Key Findings

▶ Watch: Scammers' psychological tactics: building false trust (4:10)

Erin West's talk unveiled several critical findings regarding the nature, scale, and implications of pig butchering scams:

1. Unprecedented Scale and Sophistication: Pig butchering is not a niche crime but a global, industrial-scale operation. It combines advanced social engineering with sophisticated financial and logistical infrastructure, resulting in billions of dollars stolen annually (estimated over $50 billion in the U.S. alone, considering underreporting) and a 40% year-over-year increase. The scams are designed to take "every penny" from victims, who often incur massive debt.

1. Organized Crime and Human Trafficking: The operations are directly controlled by powerful Chinese organized crime syndicates (triads) and are inextricably linked to widespread human trafficking. Hundreds of thousands of individuals (estimated 200,000 to 240,000 across Cambodia and Myanmar alone) are enslaved in fortified compounds, forced to work 16-hour days under threat of severe violence and torture, including "war crimes level violence."

1. Exploitation of Legitimate Infrastructure: Scammers leverage widely adopted, legitimate technologies and services:

• Social Media Platforms (Meta/Facebook): Used for initial recruitment of both victims and trafficked scammer employees.
• Encrypted Messaging Apps (WhatsApp, Telegram): Preferred for communication due to their end-to-end encryption, allowing scammers to operate with less scrutiny.
• Regulated U.S. Cryptocurrency Exchanges (Coinbase, Kraken, Binance, Crypto.com): Used by victims to acquire initial cryptocurrency (Tether/USDT) before being directed to fake platforms.
• App Stores: Host fraudulent investment applications that appear legitimate to the untrained eye.
• Satellite Internet (Starlink): Increasingly adopted by scam compounds, circumventing local telecom disruptions.
• Consumer Electronics (Apple iPhones): Older models like iPhone 7s are widely used by scammers for their operations.
• Logistics and Construction: Dedicated companies like KK Concrete and Jingu Logistics support the physical construction and supply of the scam compounds, often operating in allied countries like Thailand.

1. Failure of Traditional Responses: Existing mechanisms—local law enforcement, banking regulations, cryptocurrency industry self-governance, and international diplomacy—are proving inadequate. Law enforcement agencies are often overwhelmed, lack crypto expertise, or turn victims away. Financial institutions struggle to identify and intercept fraudulent transfers once funds leave regulated exchanges.

1. National Security Implications: The operations have significant geopolitical ramifications. Chinese organized crime's involvement in developing infrastructure in strategic locations (e.g., Cambodia's Dar Sor airport next to the Ream naval base, which is now a Chinese naval port) raises concerns about enabling Chinese military presence and influence, effectively blurring lines between criminal enterprise and state interests. This is framed as an "act of war" on digital borders.

1. Disruptive Potential of "What If We Could": Despite the overwhelming scale, West demonstrated that targeted disruption is possible. The temporary shutdown of KK Concrete in Thailand, which supplied building materials to scam compounds, proved that even small disruptions can make operations "more difficult, more expensive, more time consuming," offering a viable strategy when direct arrests of kingpins are challenging. This highlights the power of creative, unconventional approaches.

Technical Deep Dive

▶ Watch: Transition to crypto investment: the 'knowing professor' (5:30)

The technical underpinning of pig butchering scams is a complex fusion of advanced social engineering, cryptocurrency exploitation, and a sophisticated, resilient physical and digital infrastructure. Understanding these layers is crucial for developing effective countermeasures.

Social Engineering at Scale:

At its core, the scam relies on meticulously crafted psychological manipulation. Scammers are trained to identify and exploit emotional vulnerabilities. The "attractive lure" (e.g., "Jessica" or "Ethan" displaying wealth and charm) establishes an aspirational connection, while the "knowing professor" (a fictional uncle or expert) provides an authoritative, trustworthy figure for investment advice. Scammers meticulously profile victims, gathering information about their financial status, family, and emotional needs over weeks or months. This deep relationship building, often described by victims as the most cared-for they've ever felt, overrides natural skepticism and ethical boundaries, making victims susceptible to clearing out retirement funds or taking on significant debt. The use of WhatsApp and Telegram is strategic, offering end-to-end encryption that makes conversations difficult for external monitoring and fostering a sense of privacy and intimacy.

Cryptocurrency Mechanics:

The financial component of pig butchering hinges on a multi-stage cryptocurrency flow designed to rapidly exfiltrate and launder stolen funds:

1. On-Ramping via Regulated Exchanges: Victims are guided to open accounts on well-known, regulated U.S. cryptocurrency exchanges such as Coinbase, Kraken, Binance.US, and Crypto.com. These platforms provide a seemingly legitimate entry point into the crypto ecosystem, building initial confidence.
2. Tether (USDT) Conversion: Victims are instructed to convert their fiat currency into Tether (USDT), a stablecoin pegged to the U.S. dollar. USDT is a preferred choice for illicit transactions due to its high liquidity, widespread acceptance across various blockchains (e.g., Tron, Ethereum), and relatively low transaction fees, facilitating rapid movement of large sums globally.
3. Transfer to Fraudulent Platforms: The critical step involves directing victims to transfer their USDT from their legitimate exchange account to a custom-built, fraudulent investment platform (e.g., "Goo Markets"). These platforms are designed to mimic legitimate trading interfaces, displaying fake charts, trading histories, and inflated account balances. The illusion of profitable trades encourages victims to invest more.
4. Rapid Blockchain Movement: Once USDT is transferred to the scammer-controlled address on the fake platform, it is immediately moved "down the blockchain." This involves rapid transfers through multiple intermediate wallets, often utilizing mixers or privacy-enhancing tools, to obfuscate the trail. The funds are then typically moved to other exchanges or over-the-counter (OTC) desks in jurisdictions with less stringent regulations, where they are converted back into fiat currency through a network of money mules and cash-out points. The speed of this process is a key challenge for recovery, as victims often don't realize they've been scammed until days or weeks after their money is gone, by which time the funds have been laundered.

Infrastructure and Enabling Technologies:

The physical and digital infrastructure supporting these scams is vast and adaptable:

• Scam Compounds: These are not makeshift operations but purpose-built or repurposed multi-story buildings, often resembling resort hotels or college dormitories. Located primarily in Cambodia, Myanmar, the Philippines, and even Dubai, they are fortified prisons, sometimes housing "thousands of people" per facility, working in rooms with 6-8 individuals. These compounds are equipped with "insane" wiring for numerous computers and phones, and often feature "Chinese decorations," indicating their origin.
• Telecommunications and Connectivity: Initially, scam centers relied on local cellular towers. West highlighted the presence of communication towers from Thailand, an ally, directly across the Moy River from scam compounds in Myanmar (KK Park), enabling their operations. While some of these towers are now being addressed (e.g., shutdown planned for February 2025), scammers have already adapted by deploying Starlink satellite internet dishes. This shift to Starlink represents a significant challenge, as it provides high-speed, globally accessible internet, making compounds less reliant on local, potentially disruptable infrastructure.
• Hardware: Scammers predominantly use Apple iPhones, often older models like the iPhone 7s, for communication and running scam scripts. The use of specific hardware, while seemingly minor, represents another point of potential disruption if supply chains or device activation could be targeted.
• Logistics and Supply Chain: The construction and operation of these massive compounds require extensive logistical support. West identified KK Concrete in Thailand as directly supplying building materials to scam centers. Furthermore, she found evidence of Jingu Logistics (with a domestic warehouse in Shenzhen, China) shipping supplies from Guangdong, China, to these facilities, indicating a sophisticated and international supply chain. Disrupting these logistical arteries, as demonstrated by the temporary shutdown of KK Concrete, can significantly increase the cost and difficulty of operations for the scammers.
• Fake Profiles and Ads: Scammers flood platforms like Meta (Facebook) with fake job advertisements to recruit human trafficking victims and create deceptive profiles for pig butchering. West demonstrated the use of reverse image search to expose these fake profiles, revealing stolen identities of real influencers (e.g., a German influencer masquerading as "Emily Parker from Nashville"). Meta's efforts to take down "7 million" WhatsApp groups are acknowledged but deemed insufficient, as new ones quickly emerge.

West emphasized that this is a problem of unprotected "digital borders," where sophisticated adversaries are leveraging globalized technology and infrastructure to target individuals and nations. The lack of a coordinated, multi-faceted response from governments and tech companies allows this "scam economy" to flourish, even becoming a significant portion of a country's GDP, as observed in Cambodia.

Demo / Proof of Concept

▶ Watch: The critical pivot: legitimate crypto to fake platform (6:30)

While the talk did not feature a traditional software or hardware demonstration, Erin West provided compelling "proof of concept" through her firsthand investigative travels and observations in the heart of these scam operations. Her personal accounts served as a visceral demonstration of the scale, brutality, and brazenness of the criminal enterprise.

West described her direct visits to Cambodia, Myanmar, the Philippines, and Dubai, often traveling with journalists to document the reality on the ground. She detailed the "astounding, jaw-dropping, life-changing" experience of witnessing the construction boom in Cambodia, where massive, multi-story buildings—resembling resort hotels but functioning as prisons—are being erected in remote areas. She highlighted the "audacity" of this "scam economy," which has now replaced tourism and garments as Cambodia's primary GDP driver.

A significant portion of her "demo" involved recounting her visit to raided scam centers in the Philippines, providing a chilling glimpse into the inner workings of these compounds. She walked through a facility an hour and a half outside Manila, which comprised "35 buildings" emerging "out of nowhere" amidst water buffalo. She specifically highlighted:

• Big Boss Villa: A lavish, five-story villa belonging to a "big boss," which she described as "ostentatious," filled with high-end handbags and fancy wine. The doors closed like "bank vaults," and the villa even featured "escape tunnels underneath it," indicating the criminals' preparedness. Notably, when raided, "no one was there," showcasing the difficulty of apprehending high-value targets.
• Scamming and Torture Rooms: West entered the actual rooms where scams took place. She picked up notebooks containing victim notes and scam scripts, some with lines like "You must be a smooth criminal for stealing my heart." She observed the "tons of wires" and "Chinese decorations," providing tangible evidence of the operations. Crucially, she also pointed out a "torture room" where people were handcuffed and beaten, with "various implements to beat people," underscoring the extreme violence inherent in these compounds.
• Armored Vehicles: She showcased seized "level six armored cars" used by the mobsters, demonstrating their operational security and the high stakes involved. She described how these vehicles could withstand AK-47 fire, a stark contrast to regular cars.

Further illustrating the desperate conditions, West showed a video of an escape attempt from a compound, where individuals, including a "16-year-old," were seen "bobbing in the water" of a river, with some ultimately drowning due to inability to swim. This raw footage underscored the life-or-death stakes for the trafficked workers.

Her "proof of concept" extended to identifying specific infrastructure enabling the scams, such as the KK Concrete facility in Thailand, which she observed supplying building materials to the nearby KK Park scam compound in Myanmar. She also presented a clear close-up image of a Starlink dish on a scam compound roof, visually confirming the shift in telecommunications strategy. These observations served as concrete evidence of the enemy's operational methods and points of vulnerability.

Defensive Implications

▶ Watch: The final blow: fake 'tax' and total loss (8:00)

Erin West’s talk provided a comprehensive, albeit sobering, assessment of the defensive implications for individuals, tech companies, and governments in the face of pig butchering scams. Her message was clear: current defenses are insufficient, and a paradigm shift is required.

For Individuals:

• Heightened Awareness: The most immediate defense is education. Individuals must be aware that unsolicited messages, romance overtures leading to investment discussions, and promises of guaranteed high returns are hallmarks of these scams.
• Skepticism of Online Relationships: Be wary of online relationships that quickly move to encrypted apps or financial discussions.
• Reverse Image Search: A simple yet powerful tool for verifying online profiles. West demonstrated how reverse image searching a scammer's profile picture could reveal a stolen identity (e.g., a German influencer being used as "Emily Parker").
• Never Pay "Taxes" or "Fees" for Withdrawals: This is a universal red flag. Legitimate platforms do not demand new money for withdrawals, especially not a percentage of "gains."
• Report, But Understand Limitations: While reporting to local law enforcement or the FBI is crucial for data collection, individuals should manage expectations regarding immediate recovery, as current systems are often overwhelmed.

For Tech Companies (Meta, Starlink, Apple, Crypto Exchanges):

Tech companies are inadvertently enabling these operations and must take proactive steps:

• Social Media Platforms (Meta, LinkedIn):
• Proactive Scam Detection: Develop more robust AI and human moderation to identify and remove scam profiles, job ads, and investment-related content.
• Improved Reporting Mechanisms: Create more functional and responsive channels for users and law enforcement to report scam activity, ensuring that reported content is acted upon swiftly and effectively. West questioned Meta's claim of taking down 7 million WhatsApp groups, asking about the source of intelligence and sustainability.
• Satellite Internet Providers (Starlink):
• Due Diligence for Service Provision: Implement stricter verification processes for bulk orders or installations in high-risk geographic areas known for scam compounds.
• Collaboration with Law Enforcement: Respond to legitimate requests from law enforcement regarding suspicious usage patterns or locations linked to criminal activity. West explicitly stated Starlink had not responded to her outreach.
• Hardware Manufacturers (Apple):
• Supply Chain Monitoring: Investigate how their devices, particularly older models, are being mass-acquired and utilized in known scam centers.
• Device-Level Protections: Explore potential features or policies that could deter the large-scale use of their devices for illicit activities, without compromising user privacy.
• Cryptocurrency Exchanges (Coinbase, Kraken, Binance, Crypto.com):
• Enhanced AML/KYC: Strengthen Anti-Money Laundering (AML) and Know Your Customer (KYC) protocols to better detect and flag suspicious large-scale conversions to stablecoins followed by immediate transfers to unverified external platforms.
• Scam Address Blacklisting: Proactively identify and blacklist known scam addresses, preventing victims from sending funds to them.
• Victim Support: Provide clearer warnings and educational resources to users about common crypto scams.

For Law Enforcement and Government:

West argued for a radical shift in approach, treating these scams as an "act of war" on digital borders:

• National Strategy and Task Force: Implement a cohesive national strategy and establish a dedicated national task force, as advocated by West during her congressional testimony. This would centralize efforts, pool resources, and ensure consistent response across jurisdictions.
• "What If We Could" Mentality: Adopt an innovative, proactive mindset. The success of the React Task Force in Santa Clara County, led by individuals like John Aldridge, in tracing stolen cryptocurrency and recovering funds, despite a lack of established blueprints, serves as a model.
• Disrupting Supply Chains and Infrastructure: Target the physical and logistical infrastructure supporting scam compounds. The successful, albeit temporary, shutdown of KK Concrete in Thailand demonstrated the effectiveness of disrupting material supplies. Similarly, identifying and interrupting logistics companies like Jingu Logistics (shipping from Guangdong, China) could cripple operations.
• International Collaboration: Foster stronger international partnerships. The Crypto Coalition, which grew from 85 to 2,400 members of law enforcement across state, local, national, and international levels, is a vital step. Operation Shamrock, West's non-profit, aims to further bridge gaps between law enforcement, banking, and victim support groups.
• Targeting Money Mules and Couriers: While kingpins are hard to apprehend overseas, disrupting the networks of money mules and couriers operating on U.S. soil can create significant friction for the criminal organizations.
• Changing the Narrative: Challenge the misconception that these scams only affect "old people" or that victims "gave their money away." Emphasize that these are sophisticated attacks targeting all demographics and exploiting hopes for financial security.
• Addressing Geopolitical Factors: Recognize the national security implications of Chinese organized crime's activities and their ties to state-backed infrastructure projects. This requires a coordinated diplomatic and intelligence response.

The core defensive implication is that the current fragmented, reactive approach is failing. A unified, aggressive, and technically informed strategy, drawing on the collective expertise of the cybersecurity community, is desperately needed to turn the tide against this pervasive and destructive criminal enterprise.

Key Takeaways

• Pig butchering is a global, industrial-scale crisis: These are not isolated scams but highly organized criminal operations driven by Chinese triads, resulting in tens of billions of dollars stolen annually and a 40% year-over-year increase in losses.
• Human trafficking is central to the scam model: Hundreds of thousands of individuals are enslaved in fortified scam compounds across Southeast Asia, forced to defraud victims under threat of severe violence and torture.
• Scammers exploit legitimate technology and infrastructure: They leverage well-known social media platforms (Meta), encrypted messaging apps (WhatsApp, Telegram), regulated cryptocurrency exchanges (Coinbase, Kraken), satellite internet (Starlink), and consumer hardware (Apple iPhones) to facilitate their operations.
• Traditional responses are failing, demanding innovation: Law enforcement, banking, and diplomatic efforts are currently outmatched, necessitating a national strategy, a dedicated task force, and creative "what if we could" approaches from the technical community.
• Targeted disruption of infrastructure is a viable tactic: Interdicting supply chains for construction (e.g., KK Concrete) or shutting down enabling telecommunications (e.g., local towers) can make operations more difficult and costly for scammers, even if kingpins remain elusive.
• The cybersecurity community's expertise is critical: Experts in illicit finance, OSINT, supply chain analysis, and digital forensics are urged to contribute their ideas and skills to Operation Shamrock, recognizing this as an "act of war" on digital borders.

About the Speaker(s)

Erin West is a highly experienced legal professional and a passionate advocate against sophisticated financial crime. She served as a prosecutor for 26 years in Santa Clara County, California, where she was a key member of the elite local and state law enforcement team known as React. During her tenure with React, West was at the forefront of high-tech crime prosecution, notably being among the first to prosecute SIM swappers and successfully recovering cryptocurrency for victims of scams. Recognizing the overwhelming scale of international scam problems and the limitations of traditional law enforcement, she retired from her prosecutorial role. Following her retirement, West founded Operation Shamrock, a non-profit organization dedicated to bringing together law enforcement, banking groups, and victim support to combat these global criminal enterprises. She is a mission-driven individual, actively raising awareness through public speaking, a podcast, and social media, and advocating for a national strategy and task force to address the crisis of pig butchering scams.