Critical risk level Seized

Spoofed exchange domains seized in "pig butchering" investigations

A cluster of fake investment websites seized under court authority in US "pig butchering" investigations, several of them spoofing the identity of a real exchange.

Also known as: Pig butchering domain cluster, Spoofed exchange sites

Type of scam

Romance and Long-Con Investment

Jurisdiction

United States (multiple districts)

First reported

May 2022

Last known activity

Jul 2024

How this operation works

In this pattern — which US prosecutors and the FBI call "pig butchering" — contact begins on a dating app, on social media, or with a text message that looks like a wrong number. A relationship is built over weeks or months before investment is mentioned at all. The victim is then handed to another member of the operation running a fraudulent trading platform, deposits are made, a dashboard shows the balance growing, and when withdrawal is attempted the funds and the contact both disappear. The websites used are frequently built to impersonate a real, licensed exchange. The US Attorney's Office for the Eastern District of Virginia announced the court-authorised seizure of seven domains that were all spoofed domains of the Singapore International Monetary Exchange, used between approximately May and August 2022 to defraud five US victims. The Secret Service separately seized the domains okex-nft.net and nft-uni.com in the Northern District of New York, used against victims between August 2022 and July 2023 and between November 2023 and March 2024 respectively. Seizing a domain does not recover the money and does not stop the operation, which simply registers another one. It matters here for a different reason: it establishes on the public record that these specific sites were instruments of fraud, and it demonstrates the method. If you were approached this way, the platform you were sent to was almost certainly a spoof of a real firm — and checking the exact spelling of the domain you used against the genuine firm's own website is often the fastest way to establish that.

Warning signs people reported

First contact was a dating app, a social media message, or a text that seemed to be a wrong number
A relationship or friendship developed for weeks before any investment was mentioned
The platform name closely resembles a real, licensed exchange, with a slightly different domain
You were sent a direct link or an app install file rather than finding the platform yourself
A small early withdrawal succeeded, which encouraged a much larger deposit
Withdrawal was met with a tax, fee, or verification payment demand

Websites and domains

okex-nft.net Suspended

Used against a victim between approximately August 2022 and July 2023.

nft-uni.com Suspended

Used against a victim between approximately November 2023 and March 2024.

What this operation claims about itself

Recorded as claimed. The licence check below is what we were able to verify.

Company name given: Various — commonly impersonating real licensed exchanges
Regulator named: Frequently claims the licence of the genuine firm being impersonated

Licence check

Impersonating a licensed firm

Several of the seized domains impersonated the Singapore International Monetary Exchange. Where a platform claims a licence, check the licence number on the regulator's own register and compare the firm name, address and website shown there. Cloned-firm fraud copies genuine licence details verbatim.

Official warnings

Have you lost money to this operation?

File a claim and we will assess what recovery routes are realistically open to you. We will tell you plainly if we do not think recovery is achievable.

File a claim

Is this entry about you?

Entries are compiled from reports made to us and from public regulator notices. If you believe an entry is inaccurate, contact us with supporting evidence and we will review it.