Pig butchering isn't one scam — it's a logistics network. Romance and "wrong-number" grooming feeds the same downstream wallets and the same cloned-wallet phishing fronts. Over the last 90 days, GACS triaged 250k+ reports and ended up with a tight, repeating cluster: 16 drainer wallets across 3 chains, 88 phishing websites, 74 fake brokers, 34 fraudulent tokens. This is the public evidence file.
What the data shows
The "slaughter" phase almost never ends at the broker. Once a victim is convinced to "withdraw", they're pushed to a wallet-recovery or "tax-clearance" site that connects to MetaMask, Ledger Live, or a Tron wallet. The transaction signs away approvals to one of a small ring of drainer addresses. Same wallets. Same UI templates. Different victim each week.
- Ethereum drainers (10 mapped): highest-volume cluster, recycled across cloned MetaMask / Uniswap / OpenSea pages.
- Tron drainers (2 mapped): USDT-TRC20 is the laundering rail of choice; the Tron wallets receive the bulk of "tax-payment" deposits.
- Bitcoin drainers (2 mapped): mostly used for older romance-investment victims pushed to "BTC-only mining pools".
The mapped wallets (verified, active)
Every wallet below is live on the GACS public blacklist with three independent reports and a critical severity flag. Click through to see the evidence trail, last-seen date, and how to report a transaction touching it.
- ETH
0x6E1A19F235bE7ED8E3369eF73b196C07257494DE— view evidence - ETH
0x098B716B8Aaf21512996dC57EB0615e2383E2f96— view evidence - ETH
0xa7e5d5A720f06526557c513402f2e6B5fA20b008— view evidence - ETH
0xd882cFc20F52f2599D84b8e8D58C7FB62cfE344b— view evidence - ETH
0x910Cbd523D972eb0a6f4cAe4618aD62622b39DbF— view evidence - ETH
0xB541fc07bC7619fD4062A54d96268525cBC6FfEF— view evidence - ETH
0x000000A52a03835517E9d193B3c27626e1Bc96b1— view evidence - ETH
0x0000098A9E1B7b41Bf25f8e6422A1ec48E03d4e3— view evidence - ETH
0x4736dCf1b7A3d580672CcE6E7c65cd5cc9cFBa9D— view evidence - ETH
0xCcDbe40d8a25E1AaAf781d9D8e1C2e3046aB7B41— view evidence - ETH
0xFf57C4d12Ad58582B5b2737cf09b1bC1cD03b0Ea— view evidence - TRON
TXYZopYRdj2D9XRtbG411XZZ3kM5VkAeBf— view evidence - TRON
TLsV52sRDL79HXGGm9yzwKibb6BeruhUzy— view evidence - BTC
bc1qxy2kgdygjrsqtzq2n0yrf2493p83kkfjhx0wlh— view evidence - BTC
1KsAokmEoyDksHFcVdEi8DiNvmEFR4FBBs— view evidence
The phishing front-ends feeding the cluster
The wallets above don't get filled by accident. Victims are funnelled through a templated set of cloned "support" and "claim" sites. Same colour palette, same fake-KYC modal, different domain.
- metamask-help.com — fake MetaMask recovery
- metamask-support.io — same template, different TLD
- metarnask-wallet.com — homoglyph typosquat (rn → m)
- uniswap-claim.net — fake "missed airdrop"
- uniswapv4-airdrop.com — V4-themed bait
- opensea-airdrop.net — NFT recovery bait
- ledger-recovery.io — Ledger seed-phrase phishing
- ledger-live-start.com — fake Ledger onboarding
- ledger-update.net — "firmware update required" lure
There are 79 more in the public blacklist — browse the full crypto cluster.
Evidence timeline
A shareable, dated chain of what we observed, what we verified, and when each entity entered the public blacklist. Send this section to journalists, regulators, or your local fraud unit.
- T-90 days — First reports of "wrong-number WhatsApp + USDT-TRC20 mining pool" surge appear in the GACS intake queue (TR, MX, MY, US).
- T-60 days — Repeating template detected: 4 cloned MetaMask "support" pages register within 72 hours of each other on the same registrar.
- T-45 days — First Tron drainer wallet
TXYZopYRdj2D9XRtbG411XZZ3kM5VkAeBfcrosses 3 independent reports and is auto-promoted to critical. - T-30 days — 10 Ethereum drainers (incl.
0xCcDbe…,0xa7e5d5…,0xd882cF…) confirmed receiving deposits within 24h of victims interacting with the cloned MetaMask sites above. - T-21 days — Two BTC drainers added; both linked in chats to fake "Goldman quant" mentor accounts on Telegram.
- T-14 days — Ledger-recovery domain cluster goes live; same colour tokens and JS bundle hash as the MetaMask cluster.
- T-7 days — Uniswap V4 "missed airdrop" bait pages added; drainer wallets reused, no new addresses.
- T-2 days (today) — All 16 wallets and 88 sites snapshotted into this report. Every entity has a permanent
/scam/<slug>URL, an embeddable warning widget, and a public evidence trail.
What you can do with this report
- Verify before you sign. Paste any wallet, domain, or token symbol into the free Safe Scanner — the 16 wallets and 88 sites above are already in the database, plus 250k more.
- Embed the warnings. Any of these scam pages can be embedded as a warning widget on your own blog or forum thread — automatic backlink, automatic update when severity changes.
- Report what we don't have yet. If your scammer's wallet, broker, or "mentor" account isn't here, add it in 60 seconds. Three independent reports auto-promote an entity to critical.
- If you already sent money, open the Panic Guide — the first 24 hours matter most, and the Recovery-Scam guide explains why nobody legitimate will ever DM you offering to "get your funds back".
Methodology and disclosure
GACS is advisory-only. We do not execute trades, we do not move funds, and we do not guarantee recovery. Every entity above is sourced from at least three independent public victim reports, deduplicated against on-chain transaction graphs, and reviewed against our scoring methodology. Wallet addresses are factual on-chain identifiers; entity names reflect the public-facing brand the victim was shown. Inclusion is not a legal finding — it is a documented pattern of harm. To request a correction, use the feedback form.