TL;DR
Pig butchering and crypto investment fraud cost $7.228B in 2025. Crypto ATMs added $389M (+58%). Victims 60+ lost $4.432B in crypto fraud. FBI found 78% of victims never knew they were scammed. This is not a technical problem with a technical fix. It is persuasion, isolation, and urgency — defeated by verification rituals, not by reading whitepapers.
| PLAY | HOW IT FEELS | RITUAL THAT BREAKS IT |
|---|---|---|
| Pig butchering | Weeks of rapport → “mentor” → fake gains → withdrawal fees | 1-day rule. Verify platform via official app. Never pay to withdraw. |
| Romance + invest | Lover is trader. You “help” invest larger. | Second-channel verify. No one with a phone can be trusted to invest yours. |
| Crypto ATM | “Bank”/“support” walks you to ATM, stays on phone. | Hang up. Walk away. ATMs do not verify “fraud protection.” |
| Authority impersonation | Police/bank/exchange “freeze” you. Stay on line. | Hang up. Call number on card/site. Real authorities don’t demand crypto. |
| Celebrity deepfake | Video ad: “10x guaranteed.” Fake live P&L. | Assume endorsed video can be synthetic. Verify via official handle only. |
The scammer’s job is not to hack your wallet — it is to hack your social context: become your friend, your mentor, your bank, your police. LLMs make that scalable in every language, and deepfake video handles the “proof” step. TRM counts pig-butchering operations up 164% in a year. The FBI’s Level Up notifications stopped retirees from cashing out 401(k)s, selling houses, and taking loans — all within the “investment” frame, all preventable with one outside phone call.
Defense is therefore social, not cryptographic. Never keep it secret. Scammers demand secrecy (“don’t tell your bank, they’ll block it”). Secrecy is the isolation protocol. Break it: tell one person, show the “platform,” verify the URL together. Institutionalize a family code word for money requests and a 24-hour rule for any new investment, however convincing the gains chart looks. Fake platforms show gains precisely to unlock bigger deposits.
For builders and community managers: the highest-leverage intervention is a verification nudge at the moment of pressure — before the ATM, before the wire, before the “withdrawal fee.” A 10-second interstitial (“Verify via official app. No legitimate service charges withdrawal fees”) prevents more losses than a 10-page article. SCHOOL is that interstitial, made teachable.
3,780 victims notified in 2025. 78% unaware they were being scammed. Estimated savings: $225M. 38 victims referred for suicide intervention.
FBI · OPERATION LEVEL UP
THE FAMILY PLAYBOOK (TEACH THIS VERBATIM)
1. No secrecy. Anyone who says “don’t tell” is the scammer. 2. Hang up and call back on a known number. 3. 24 hours before any crypto investment. 4. Code word before any transfer. 5. ATMs don’t protect you — walk away and call your bank from the ATM’s card.
DEFENSE CHECKLIST — MODULE 07
[01] Secrecy = attack signal. Tell one person, verify together, every time.
[02] 24-hour rule for new investments. Fake gains dissolve by morning.
[03] Hang up and call back on official numbers. Authorities never demand crypto.
[04] Family code word for transfers. ATM “protection” is a scam tell — walk away.
[05] Assume celebrity / support video can be a deepfake. Verify via official handle.
SCHOOL INDEX
← PREVIOUS · MODULE 06
DeFi Safety: Approvals, Bridges, Audits
Unlimited approvals, $2.9B in bridge history, 89% protocol-logic bugs, and how to vet any yield product in 10 minutes.
NEXT · MODULE 08 →
Field Checklists
Printable playbooks: new-user setup, before-you-sign, before-you-bridge, and a 5-minute / 1-hour / 24-hour incident response.
PNTHR SCHOOL · FREE + OPEN · SOURCES: FBI IC3 2025 · CHAINALYSIS 2026 · TRM LABS · CERTIK · IMMUNEFI · TUTELA · EDUCATION ONLY · NOT FINANCIAL ADVICE · NOT LEGAL ADVICE