Cybercriminals now favor pig-butchering scams over ponzi schemes

Cybercriminals are switching up their game. Chainalysis, in its recent crime update, reports that scammers are ditching the old Ponzi schemes for something nastier: pig-butchering scams.

Huge syndicates, like one operating out of Myanmar’s KK Park, have pulled in over $100 million this year alone. These operations are big, organized, and running like clockwork.

Chainalysis says about 57% of the scam money in 2024 still goes to wallets that were active before this year. Old money meeting new tactics.

The twist? Many of these scammers aren’t just crooks. They’re victims, too. Kidnapped, trafficked to Southeast Asia, and forced to work in these scam rings under brutal conditions. It’s human trafficking mixed with cybercrime. 

Chainalysis claims they’ve tracked billions flowing through these networks, and it’s not slowing down.

Scammers favour quick hits 

Chainalysis says it’s seeing a change. Scams aren’t running as long anymore. The average lifespan of a scam in 2020 was about 271 days. This year? Just 42 days. Scammers are moving fast, setting up quick-hit operations, cashing out, and moving on. 

Why? Because it works. Over 43% of the scam revenue in 2024 has gone to wallets that only became active this year. New wallets, new scams. It’s a revolving door of crime.

Share of inflows to scam wallets based on year of first activity ⏐ Chainalysis

The blockchain analysis company reports that inflows from stolen funds have nearly doubled year-to-date. 

These scams are getting more sophisticated, blending on-chain tactics—using crypto wallets to move and hide funds—with off-chain manipulation like fake websites, social media profiles, and phishing attacks.

They’re regenerating their tactics, keeping one step ahead of the law.

Average scam lifespan by year first active on-chain ⏐ Chainalysis

Child sexual abuse material on the rise

It’s not just about money. Chainalysis also highlights another dark corner: child sexual abuse material (CSAM). There’s been a rise in China-based networks trafficking in this kind of content. 

These groups are now accounting for nearly 39% of global CSAM-related crypto flows, a sharp increase since late last year. The Internet Watch Foundation (IWF) says they’re seeing more reports of these sites, but it’s unclear if there’s a new trend or if these sites have just flown under the radar until now.

Inflows to China-based CSAM services as a share of global CSAM volumes ⏐ Chainalysis

Chainalysis dug into the wallets tied to these CSAM vendors. The oldest ones date back to mid-2023. Most popped up later that year. These are fresh entries, suggesting this is a growing problem, not an old one resurfacing. 

The on-chain activity is alarming . Small payments—$5 here, $41 there—might not seem like much, but they buy access to horrific content.