Interested in how pig-butchering scammers rip off people for billions? Here’s an anatomy of a victim from start to finish — someone who took out loans and paid into a crypto investment pig-butchering scam.

An Indian-Australian who’d been scammed twice through pig-butchering scams reached out to me. He sent me everything — screenshots, chat logs, wallet addresses, bank details, even a recording of a short video call with the scammer.

He wants to stay anonymous, but that detail matters: this didn’t happen “somewhere on the internet.” It happened to an Australian, and the trail runs through the U.S., Malaysia, and crypto rails.

Here I’ll detail the first of two scams that victimised this same person.

She Moved Us to WhatsApp — Here’s Why That Matters

It began in August 2024 with a reply to a Facebook post in a group called Investment Lovers. A profile using the name Arzo Mughal (claiming to be in Portland, Oregon) looked legitimate enough — family photos, trading chat, the usual gloss. Then she asked to switch to WhatsApp. That move off-platform is deliberate. Scammers want you in a private channel where they can’t be flagged and where the social proof disappears. Once you accept the switch, the grooming gets easier.

On WhatsApp she introduced Up-Business[.]top, pitched as a high-yield, U.S.-based platform powered by something she called AI Quantification. She even name-dropped public figures to make it sound serious. The site looked slick. Looking slick is the cheapest part of the con.

The $100 Withdrawal That Hooks You

Following her instructions, he installed Phantom Wallet and connected it to the site. On 13 October 2024 he sent USD $664 — AUD to USDT, then into ETH via Phantom. Days later the dashboard showed “profit,” and the site allowed a $100 withdrawal. That tiny win is bait. It’s there to make the platform feel safe so you’ll scale up.

He did. Over the next weeks he added more, reaching about USD $10,000 by November. The site kept reporting gains. Then came the push.

“Lock Your Funds, Lock Your Fate”

She pitched AI Quantification — lock funds for 30–120 days, earning much more. She sent her own “profit” screenshots and started nudging emotions: “short-term pain, long-term gain.” That line is a tell. Real investing doesn’t need pressure, deadlines, or appeals to family goals. Grooming does.

By 20 December 2024, he’d committed AUD $173,669 (≈ USD $109,550) — taking all of his family savings and a mortgage against his house. He put in far more than he could afford to lose. One transfer alone was USDT 6,770.78. He wasn’t reckless; he was groomed — with friendly, affectionate chat, a constant stream of profits, a working website, flattery, and a “system” that seemed perfectly legitimate.

“Pay a Fee to Get Your Own Money?” No.

In mid-January 2025 he tried to withdraw USD $35,000. Support (on the site and in their Telegram) told him he had to pay a “processing fee” of USD $49,782.75 first. This is the point where victims think they’re one payment away from resolution. You’re not. Whenever a platform demands new money to release your existing balance, that’s a scam, not a policy.

Around this time the tone shifted on a phone call. He says she started on Gaza-war rhetoric, blamed Westerners and Jews, and asked him to “bring in more people to raise funds.” There are no messages or recordings — only his recollection — but it was enough for him to hit the brakes. He refused the fee. His account froze. Her Facebook profile vanished.

Laundering Script: “Tell the Bank It’s for Sunway REIT”

He posed as a “cousin” with AUD 1.3 million ready by bank transfer. They bit. He was given Maybank (Labuan) details for Asia Digital Bank Ltd (Labuan Investment Bank) and told to tell his bank the payment was for Sunway REIT Management Sdn Bhd. That’s not an investment workflow; it’s a laundering script. If anyone instructs you to lie to your bank about the purpose of a payment, you’re dealing with criminals.

When a Scam Sheds Its Skin

Up-Business[.]top went offline. Weeks later a replacement site appeared: AliBarbit[.]life. Same registrar family, same Arizona mailbox details, same Cloudflare masking, same single-page app that immediately wants a wallet connection. Different name, same hands. I ran the new site through a malware aggregator and it came back flagged Malicious.

What the Evidence Proves (and Why It Matters in Australia)

He reported the case across jurisdictions — Australian Federal Police via the ACSC, Western Australia Cybercrime, plus FBI IC3, FTC, SEC, CFTC, FINRA, and Malaysia’s CCID — and archived every chat and screenshot. The technical footprint ties both sites together and points to the same operator group:

  • Domains: Up-Business.top → AliBarbit.life (rebrand after heat).
  • Masking: NameSilo registration with privacy proxies; Cloudflare fronting to hide origin.
  • Wallets that received funds:
    0xB10ABECA64cf19d37c45045a5851BB528fB21E47 and 0xF5d9dF3973a456f816b76FDb7e2224903E4Cd4E9.
  • Bank route offered: Maybank Labuan, Asia Digital Bank Ltd (Labuan Investment Bank), with a cover story referencing Sunway REIT Management to slip past checks.

Australians are not fringe targets here; they are prime. The cross-border setup is designed so local police can’t easily reach the servers, the accounts, or the culprits — unless victims preserve evidence exactly like this and analysts follow the money to choke points such as exchanges, banks, and bridges.

Read This Before You Connect a Wallet

Here’s what I want Australians (and anyone else) to take from this case. If a stranger who “just wants to learn trading” nudges you to WhatsApp, understand why: fewer witnesses, fewer reports, more control. If a site hands you an early $100 withdrawal, that’s not proof it works — that’s proof they know how to train trust. If a platform locks funds, pressures loans, or asks for a fee to release your balance, you’re not investing — you’re being herded.

The Australian who shared this with me knows the money is gone, but he also knows the lesson is worth more in public than in silence. As he put it:

“If someone offers huge returns, there’s something wrong with it. Spend a bit of money on real advice before you spend a lot on a lie.”

This is Scam 1 of his two. The second — different brand, same playbook — comes next.

Disclaimer: How This Investigation Was Conducted

This investigation relies entirely on OSINT — Open Source Intelligence — meaning every claim made here is based on publicly available records, archived web pages, corporate filings, domain data, social media activity, and open blockchain transactions. No private data, hacking, or unlawful access methods were used. OSINT is a powerful and ethical tool for exposing scams without violating privacy laws or overstepping legal boundaries.

About the Author

I’m DANNY DE HEK, a New Zealand–based YouTuber, investigative journalist, and OSINT researcher. I name and shame individuals promoting or marketing fraudulent schemes through my YOUTUBE CHANNEL. Every video I produce exposes the people behind scams, Ponzi schemes, and MLM frauds — holding them accountable in public.

My PODCAST is an extension of that work. It’s distributed across 18 major platforms — including Apple Podcasts, Spotify, Amazon Music, YouTube, and iHeartRadio — so when scammers try to hide, my content follows them everywhere. If you prefer listening to my investigations instead of watching, you’ll find them on every major podcast service.

You can BOOK ME for private consultations or SPEAKING ENGAGEMENTS, where I share first-hand experience from years of exposing large-scale fraud and helping victims recover.

“Stop losing your future to financial parasites. Subscribe. Expose. Protect.”

My work exposing crypto fraud has been featured in: