If you work in financial investigations, law enforcement, or compliance, you have almost certainly encountered a pig butchering scam — even if it wasn't labeled as one. This post is for those who haven't heard of it, and a primer for those who have but want to understand the mechanics and the role Tokenlon plays in virtually every case.
Sha Zhu Pan (杀猪盘) translates literally from Mandarin as "pig butchering plate" — a reference to the deliberate fattening of a pig before slaughter. In the fraud context, the "pig" is the victim, fattened through weeks or months of a fabricated relationship before the scammer moves in for the financial kill.
Pig butchering scams are a form of investment fraud that originated in China and have since been industrialized by cybercrime syndicates operating out of Southeast Asia, primarily in Myanmar, Cambodia, and Laos. They combine romance fraud with fake cryptocurrency investment platforms, executed at scale from organized compounds that employ — often through coercion and human trafficking — thousands of workers.
The formula is well-honed and consistent across cases:
Nearly all victims are non-cryptocurrency users prior to the scam. Large individual losses — frequently six figures in USD — are characteristic of pig butchering cases. The US FBI has consistently ranked these scams among the costliest fraud categories by total losses per victim.
Victims are directed to send funds in cryptocurrency — almost always USDT (USD Tether) on Ethereum or Tron, or Bitcoin — to addresses controlled by the scammers. This solves a core operational challenge for the syndicates: how to move money internationally, at scale, without triggering bank controls.
The deposit addresses given to victims (Level 0, or L0 addresses) are short-lived. They are typically used across multiple victims for a few weeks before being drained and abandoned. Funds are rapidly moved onward through a series of intermediate addresses to obscure the trail and ultimately reach a cash-out exchange.
The laundering pattern follows a consistent structure:
Among investigators tracing pig butchering cases, one entity appears with striking regularity: Tokenlon. Tokenlon is a decentralized exchange (DEX) built on Ethereum that supports token-to-token swaps and a Bitcoin bridge. It is little known outside East Asia, yet it processes an outsized share of PBS proceeds.
Analysis by Chainbrium of more than 7,000 reported PBS addresses found that approximately 90% of L0 addresses have exposure to Tokenlon — meaning that funds from nearly every pig butchering case touch Tokenlon at some point in the laundering chain. In terms of traced dollar amounts, Tokenlon accounted for approximately 29% of the nearest identifiable entity exposures, second only to Binance.
There are several reasons Tokenlon has become the preferred intermediate step for PBS syndicates:
For investigators encountering a pig butchering case, a few practical observations:
Expect Tokenlon. If you are tracing USDT or ETH losses from a PBS victim, you will very likely encounter Tokenlon addresses in the chain. Recognizing Tokenlon's smart contract addresses (0x03f34bE1BF910116595dB1b11E9d1B2cA5D59659 for the main exchange contract, among others) will prevent you from treating them as the end of the trail.
Do not stop at a DEX. A decentralized exchange is not the end of traceability — it is a waypoint. Funds swapped through Tokenlon can still be followed. The output token and receiving address on the other side of the swap is visible on-chain. Specialized blockchain analytics tools handle DEX hops; a trained analyst can trace through them.
Preserve the full trail early. Scam address activity is often short-lived. L0 addresses drain quickly. The full transaction history and downstream trace should be captured as soon as the victim reports, before addresses go cold and before the chain becomes harder to reconstruct.
The platform is always fake. The investment website or app the victim used to "see" their returns does not reflect any real positions. It is a front-end display designed to show fabricated profits. No legitimate exchange, DeFi protocol, or investment platform is involved in generating those numbers.
Pig butchering is not a fringe phenomenon. Chainbrium's Project TRANSACCT analysis of blockchain data from late 2020 to mid-2023 found that more than 7,000 reported L0 addresses alone received at least $10.2 billion in victim funds. When adjacent L1 consolidation addresses are included, total PBS intake by Southeast Asian cybercrime syndicates during that period may reach $45 billion — a figure that rivals the entire annual GDP of Cambodia.
These amounts represent only the cryptocurrency portion of losses. An estimated 30% of PBS victims outside Asia also transfer funds via bank wire, which does not appear on-chain at all.
The syndicates operating these scams are not individuals running cottage operations. They are organized criminal enterprises employing hundreds to thousands of workers — many of whom were themselves trafficked into the compounds under false pretenses of legitimate employment. The cryptocurrency infrastructure they use is sophisticated, adaptive, and well-funded.