Follow the Money · 06 — The Compound: When the Victim and the Worker Are Both Prey

Follow the Money — Case 06. This register follows illicit value from the keyboard to its final resting place, and closes on the money's disposition: LAUNDERED · RECOVERED · FROZEN · CONVERTED · VANISHED · SPENT.

The first five cases followed money moved by criminals. This case follows money moved by a victim's own hand — and then follows it to a place where it becomes the wage of another victim's captivity. Pig-butchering is the crime, and it is the one entry in this register where the money trail does not end at a wallet or a warhead or a frozen address. It ends at a compound, behind a fence, guarded, in Myanmar or Cambodia or Laos, where a trafficked human being was forced under threat of violence to run the script that emptied the first victim's bank account.

That doubling is why this case had to be written, and why it is the hardest to write with the register's usual cool. The popular name is a translation of the Chinese sha zhu pan — fattening the pig before the slaughter. A stranger reaches a target on a dating app, a social-media message, a text that looks like a wrong number, and over weeks or months builds a real-feeling relationship. Then comes the investment tip: a cryptocurrency platform, generous returns, a dashboard that shows the victim's money growing. The victim invests, sees the gains, invests more, is allowed one small withdrawal to seal their faith — and then, when they try to take it all out, is told there are taxes to pay first. They pay. The platform goes dark. The savings are gone.

This is the letter about a conversion that happens twice. The victim's dollars are converted into crypto and then into the untouchable revenue of a criminal network. And human beings — lured by fake job ads, imprisoned, beaten — are converted into the instruments of the fraud. The disposition is CONVERTED, and the thesis is that here, uniquely, following the money and following the people are the same act, because the money's destination is a room full of other prey.

1. The Long Con: how trust is fattened

Begin with the method, because the method is the cruelty. The US Treasury's DeFi risk assessment defines it plainly: pig-butchering is where scammers initiate and develop relationships with victims and pressure them to invest in fake investment platforms that let the scammer steal the invested funds; the scammers meet victims on dating apps, social media, or text messages made to look misdirected, and after building trust over weeks or months, introduce the idea of investing using virtual assets. Read the timeline in that sentence: weeks or months. This is not a smash-and-grab. It is a patient, engineered cultivation of a human bond, and it is the opposite of the impulsive-greed story the public tends to tell about scam victims.

The name says everything the euphemism hides. Sha zhu pan means fattening the pig. In the operators' own metaphor, the victim is livestock: something to be fed, kept comfortable, and grown to maximum weight before the kill. The relationship is the feed. The scammer remembers the victim's children's names, sends good-morning messages, shares invented troubles and triumphs, becomes the warmest presence in a lonely person's day. Only once the bond is load-bearing does the money enter — softly, as a tip from someone who cares, an opportunity they want to share because they have grown to trust you. Europol's crypto-tracing report notes that these schemes run through established call-centres, brokers, and internet platforms promising high profits: this is industrialized deception, staffed and scripted, not a lone con artist improvising.

The fake dashboard is the engine. The victim is directed to a slick platform — an app, a website — that shows their deposit and then shows it growing, day by day, in convincing green numbers. The gains are fiction, rendered in HTML, but they do what fiction does: they make the next deposit feel not like a risk but like a mistake to miss. To cement belief, operators frequently allow one small, real withdrawal early on — proof the platform pays — which is the most expensive lie in the script, because it converts doubt into trust at exactly the moment the victim is deciding whether to commit their savings. Then the balance is large, the victim tries to withdraw it all, and the final extraction begins: a tax, a fee, a compliance hold, one more payment required to release funds that do not exist. The register states this precisely so no reader mistakes it for gullibility: the victims are chosen because they are trusting and human, and the operation is built, professionally, to defeat exactly those traits.

2. The Compound: the second victim

Now follow the script back to the hand that typed it, because this is where pig-butchering stops resembling any other fraud in the register. The 2024 National Money Laundering Risk Assessment says it without flinching: some of the perpetrators of these scams may themselves be victims of separate crimes, including human trafficking; the schemes are often run by criminal networks that place fake job advertisements to attract young, English-speaking people from Asian countries, who are then held against their will in secure compounds, generally in Asia, and forced — often under threat of violence — to scam people throughout the globe.

Sit inside that sentence, because a whole second crime lives there. A young person in Asia answers what looks like a legitimate job posting — customer service, translation, tech support, good pay abroad. They travel. On arrival their passport is taken. They are moved into a guarded compound, told they now owe a 'debt' for their transport and lodging, and set in front of a phone with a script and a quota. If they refuse, or fail to hit targets, or try to leave, they are beaten; escape attempts are punished; some compounds are documented sites of torture. The ODNI's 2024 threat assessment describes exactly this machinery in the transnational-crime context: traffickers coerce or defraud victims into forced labor, confiscate identification documents, and require the payment of imposed debts. That is debt bondage, and it is what keeps the compound staffed.

So the person defrauding the lonely retiree in Ohio is frequently a captive being tortured in Myanmar. This is the doubled horror the register exists to state plainly and refuse to simplify. It would be easier to write a clean villain and a clean victim. The truth is a chain of victimhood: a trafficked worker, coerced under violence, made into the instrument that destroys a stranger's life — while the actual perpetrators, the network operators who own the compound and pocket the money, sit above both. The register names them separately and deliberately. The trafficked worker is a victim. The financial target is a victim. The criminal network is the perpetrator. Collapsing the first two into 'the scammer' is not just imprecise; it hands the operators the cover they rely on, letting the people they enslaved absorb the blame for the crime committed with their captive hands.

3. The Conversion: dollars, to crypto, to a fence

The money's journey is a sequence of conversions, and naming each is the register's discipline. It starts as ordinary savings — a retirement account, a home-equity line, a lifetime's caution — sitting in a bank. The victim, believing they are investing, moves it: fiat out of the bank, often into cryptocurrency bought at a legitimate exchange, then out of the victim's own control and into a wallet the operation holds, sometimes routed through the fake platform's deposit address. In that moment the victim's dollars have become the criminal network's crypto, and the first conversion is complete.

The second conversion is the laundering, and it uses every technique this register has catalogued. The proceeds move through chains of intermediary wallets, sometimes through mixers, and above all toward the cash-out points — exchanges, frequently the nested or lightly-regulated exchangers concentrated in and around the Southeast Asian jurisdictions where the compounds physically sit. There the crypto becomes local fiat, is moved through money-mule accounts, and is folded into the operating revenue of the network. Speed and layering are the point: by the time the victim understands what has happened — often when the withdrawal is refused — the money has usually already changed form and jurisdiction more than once, which is why recovery is so rare and why the crime scales across borders that no single police force controls.

And then the third conversion, the one that makes this the register's darkest CONVERTED case. The money does not just disappear into a criminal's pocket; it becomes the operating capital of the compound. It pays the guards, extends the fences, funds the recruitment ads that lure the next batch of trafficked workers, and services the corruption that lets the compounds persist. The retiree's savings are converted, finally, into the machinery of somebody else's imprisonment. That is the sentence this case is built to make unavoidable: in pig-butchering, the stolen money is reinvested into the trafficking that produces the next scammer, who will be forced to steal the next victim's money, which will fund the next compound. The conversion is a cycle, and the currency of the cycle is human beings.

4. The Scale: an industry, not an anecdote

It would be tempting to read all this as a lurid edge case. The numbers forbid it. The FBI's IC3 documents investment fraud — driven heavily by these crypto pig-butchering schemes — as one of the largest and fastest-growing categories of reported loss in its annual reporting, with crypto-investment fraud losses running into the billions of dollars and climbing year over year. And the reported figures are a floor, not a ceiling: victims frequently never report, out of shame, self-blame, or the belief that nothing can be done; cross-border cases resist counting; and many victims do not even understand which crime happened to them. Whatever the true total is, it is larger than the record shows.

Behind those loss figures sits a labor force of the enslaved measured, by humanitarian and UN-linked estimates, in the tens or hundreds of thousands across the Southeast Asian compound belt. This is not a handful of rooms. It is a regional industry with recruitment pipelines, real-estate footprints visible from satellites, internal management hierarchies, and enough political entanglement to survive periodic crackdowns and simply relocate. The register avoids citing a single precise headcount it cannot stand behind, and instead states the shape the sources agree on: a large, organized, cross-border economy whose product is fraud and whose raw material is trafficked people.

The scale is the argument against every comforting dismissal. This cannot be waved off as a few careless victims meeting a few bad actors online. It is a structured criminal industry that converts the savings of the trusting into the revenue of traffickers at a scale that shows up in national threat assessments. When a crime is this organized, 'be more careful online' is not a response; it is an abdication. The response has to follow the money — and, because of what this money is, follow the people it was converted into.

5. The Recovery Problem, and the one thing the ledger still gives

The honest news about the individual victim's money is bad: it is usually gone. The conversions happen fast, the jurisdictions are non-cooperating, and by the time the fraud is understood the funds have moved through crypto, mules, and exchanges across borders. The IC3 'kill chain' — the rapid-recall process that can freeze fraudulent transfers — works only in the first hours and only where a cooperating exchange still holds the funds; for most pig-butchering victims that window has closed before they even suspect the truth. The register will not offer false comfort: recovery, for the person who lost the money, is the exception, and a rare one.

But the register's founding paradox still has something to say, and it is the reason the crypto leg matters. The money's crypto form, the very thing that let it move fast and far, is also permanently written on the public ledger. Blockchain analytics have used that permanence to map the wallet clusters tied to compound operations, to identify the cash-out exchanges the networks depend on, and to link scattered victim reports into coherent pictures of single organizations — turning thousands of isolated tragedies into a traceable structure. That does not usually give the victim their savings back. It does something else: it makes the network visible, supports takedowns and sanctions against the operators and their exchanges, and — crucially — gives investigators a thread that runs from a wallet to a compound, which is to say, from the money to the people who need rescuing.

This is the register's structural point about Case 06. In every other case, following the money is about accountability for a theft. Here it is also, literally, a map to a prison. The same trace that identifies where the retiree's dollars went identifies where trafficked workers are being held, because those are the same coordinates. That is why 'follow the money' and 'follow the people' collapse into one investigation. The ledger cannot un-steal the savings. But it can point at the fence — and behind the fence are the second set of victims, whom the financial trail is, whether the tracer intends it or not, a way to find.

6. The counter-narrative, steelmanned

The strongest objections to this letter come from two directions at once, and both deserve a fair hearing.

The first says the register is too soft on the scammers. Whatever the coercion, the argument goes, the person on the keyboard did knowingly, for weeks, lie to a lonely human being and take their life savings; framing them primarily as victims risks excusing real harm and insulting the retiree who is now bankrupt and ashamed — coercion may mitigate culpability, but it does not erase the reality that a person was defrauded by another person who chose, each day, to keep typing. The second objection says the register is too soft on the targets: that dressing up 'people sent their money to a stranger's crypto app' as an unavoidable, engineered tragedy denies victims agency and discourages the basic skepticism that actually prevents these losses. Both objections share a suspicion that the doubled-victim frame is a way of dissolving responsibility until no one is to blame.

The register grants what is true in each and refuses the dissolution. Yes, harm to the financial victim is real and total, and coercion of the worker mitigates but does not by itself erase individual culpability — which is exactly why the register names the network operators, not the coerced workers, as the perpetrators, and locates the moral weight where the freedom to choose actually sits: with the people who own the compound and take the money, not with the person being beaten if they stop typing. Guilt is not conserved by pretending the captive and the captor are the same. And yes, skepticism prevents losses and should be taught — but 'be skeptical' as an answer to an industrialized, months-long manipulation staffed by trafficked labor is like answering an armed robbery with 'be braver'; it mistakes a structural crime for a personal failing. The point of the doubled frame is not that no one is responsible. It is that responsibility belongs precisely where the coercion does not reach: to the networks that enslave the workers and rob the targets, and that rely on our instinct to blame the two sets of victims for each other. The register declines to give them that.

7. Disposition — CONVERTED

Case 06 followed the money from a bank account emptied by its own owner's trusting hand, through crypto and mules and Southeast Asian exchanges, to the revenue of a criminal network — and then one step further than any other case in this register, to the compound where that revenue buys the fences and pays the guards and funds the ads that trap the next worker. The money did not simply move. It changed form, twice over, and its final form was the machinery of somebody else's captivity.

The disposition — the money's fate — is CONVERTED. The victim's fiat was converted into crypto and laundered into untraceable local cash; and in the register's darkest sense, it was converted into human capital — folded into a forced-labor economy where the proceeds of the last scam finance the trafficking that produces the next scammer. It is the one conversion in this series that runs in both currencies at once, dollars and people, and the two cannot be separated, because in pig-butchering they are the same transaction seen from two ends. That is why this case, alone in the register, could not stay purely financial. The endpoint of the money trail is a room full of prisoners.

Hold what this case will not let you put down. The financial victims are not fools; they are trusting people defeated by a professional, patient, industrialized deception built to beat exactly the human traits we most want to keep. The workers running the scripts are, in documented fact, frequently trafficking victims held under violence — prey made into predators by the people who own them. And the perpetrators are neither of them: they are the networks that enslave the one to rob the other, and that survive by counting on us to blame the two victims for each other. The honeypot beneath these words watches machines probing for a way in; this case watches a human being probed for weeks for a way into their heart, by another human being with a fence at their back. The vectors do not lie, and here the vector is a wire transfer that becomes a cryptocurrency that becomes a guard's wages. Judge the network that runs the compound. Then understand that following its money is the same as finding its prisoners — and that the retiree's stolen savings and the trafficked worker's stolen freedom are, in the end, the same crime, converted into two currencies at once.

Follow the Money continues. Case 06 disposition: CONVERTED. Confidence: HIGH on the documented facts — the dual-victim finding, the compound/forced-labor mechanics, and the pig-butchering definition are stated directly in the US Treasury 2024 National Money Laundering Risk Assessment and the DeFi risk assessment; the scale is documented by FBI IC3; the trafficking/debt-bondage machinery by ODNI's 2024 threat assessment; the industrialized-deception framing by Europol. Specific loss totals and compound headcounts are stated as ranges/shapes rather than precise figures, flagged where the record is a floor not a ceiling. Both sets of victims are centered; the perpetrators are identified as the criminal networks, distinct from the coerced workers; the presumption of innocence is not at issue as no individuals are named. Classification: TLP:WHITE. Include everything — the vectors do not lie, and they do not judge. The reader judges the network, the conversion, and the crime that turns two victims into each other's undoing.