All notes
Investment scam / 2025-09-18
How to assemble a pig-butchering file
The scheme lives for months. Evidence is not one transfer, but a repeating descriptor and an off-ramp.
We need the date of first contact, platform links, every top-up, screens of the ‘withdrawal tax’ and addresses used on the crypto layer.
The operator often changes brand and keeps a payment trail. Linking brands is separate work, not a guess from chat.
Recovery, where possible, is almost always partial and runs through a bank, OTC desk or venue. Promising ‘we will get it all back’ is not honest here.