Back to the archive
    ARC-006CONFIDENCIAL · Anonimizado · Fuentes públicasCRÍTICO

    itradeinvestment.com — Pig Butchering scheme, regulated fintechs as a vector and cross-border mule network

    Intelligence analysis of a fraudulent investment platform combining romance-based social engineering (Pig Butchering), the instrumental use of regulated fintechs (Revolut, Wise, N26) as a laundering layer and a cross-border mule network to move funds toward crypto exchanges. The investigation reconstructs the criminal flow end-to-end: targeting, persuasion, deposit, exfiltration and footprint erasure — with no active interaction against the actor's infrastructure.

    Analysis type
    Corporate Fraud Intelligence · Financial OSINT
    Sector
    Financial services · Online investment (unregulated)
    Status
    Closed · Report delivered
    Date
    2025
    Pig ButcheringFinancial FraudThreat IntelligenceAML/KYCMoney MulesOSINT financieroDue DiligenceTRON / USDT
    01

    Context

    • ·Platform with no ESMA/CNMV licence presenting itself as an international broker with a professional back-office and credible dashboards.
    • ·Initial targeting on social and dating apps: sustained emotional bond over weeks before the first deposit.
    • ·Cross-border operation with multilingual interface, 24/7 Telegram/WhatsApp support and an onboarding flow that mimics a real KYC process.
    02

    Methodology

    • ·Passive reconnaissance: historical WHOIS, certificates, DNS, Wayback, URLScan, Shodan, Censys.
    • ·Front-end inspection without active interaction with the backend (no deposits, no real credentials).
    • ·Financial OSINT on IBANs and beneficiaries given to victims (cross-checked against company registries, press and victim forums).
    • ·OSINT chain analysis on receiving USDT-TRC20 wallets (TronScan, Breadcrumbs) and tracing to weak-KYC exchanges.
    • ·Mapping of the Pig Butchering pattern against the FinCEN, Europol IOCTA and CipherTrace playbooks.
    03

    Findings

    01Unlicensed platform · regulated-broker impersonation
    CRÍTICO
    02Instrumental use of regulated fintechs (Revolut · Wise · N26)
    CRÍTICO
    03Network of ≥9 mule accounts across 4 EU jurisdictions
    CRÍTICO
    04Exit to USDT-TRC20 and weak-KYC exchanges
    CRÍTICO
    05Synthetic, non-auditable performance dashboard
    ALTO
    06Active footprint erasure: IBAN rotation every 30–45 days
    ALTO
    04

    Operational impact

    • ·Direct financial loss for individual victims with high average tickets (€5–80k) and prolonged psychological exposure.
    • ·Regulatory reputation: European fintechs appear as a functional vector of the fraud despite formal KYC/AML compliance.
    • ·Systemic risk for destination banks: chargebacks, FIU alerts and exposure to sanctions for weaknesses in transaction monitoring.
    • ·Crypto → exchange → off-ramp chain in non-cooperating jurisdictions makes effective recovery marginal without coordinated law-enforcement action.
    05

    Full document

    RESTRICTED ACCESS
    22 pp· 90 KB· PDF

    Document from the private archive

    This report is part of Zero101OSINT's private research archive. Access is individual, logged and traceable. No spam, no mailing list.

    Basic privacy information. Project: Zero101OSINT. Legal identity of the controller: pending owner confirmation. Manage the requested document and record the access request.

    Technology and email providers may process the submitted data. Legal basis, retention periods and international transfer arrangements remain pending owner confirmation. This request does not authorize advertising.

    Rights: access, rectification, erasure, objection, restriction and portability, where applicable. Contact: contacto@zero101osint.com. Privacy policy.

    PDF delivered through a temporary signed URL. The access request is recorded.