Case Overview
In November 2024, 42‑year‑old Daren Li, a dual Chinese and St. Kitts‑and‑Nevis national, pleaded guilty to conspiracy to launder more than $73 million obtained through international “pig‑butchering” scams. After fleeing in December 2025, a California federal court sentenced Li in absentia to 20 years in prison followed by three years of supervised release.
How Pig‑Butchering Scams Operate
Scammers build trust on messaging apps, dating platforms, and social media before introducing fraudulent investment opportunities. Victims are coaxed into sending cryptocurrency, which is never invested but instead drained by the fraud ring.
- Initial contact via “romance baiting” or friendship.
- Gradual introduction of high‑return crypto or forex deals.
- Victims transfer funds to wallets controlled by the criminals.
- Scammers disappear once the promised returns fail to materialize.
Money‑Laundering Mechanics
Li and his co‑conspirators used a sophisticated network of money‑launderers to obscure the origin of the stolen funds:
- Over 74 shell companies received transfers into U.S. bank accounts.
- Funds were moved to Deltec Bank in the Bahamas for conversion into cryptocurrency, including Tether.
- More than $341 million in crypto was discovered in a single wallet used for laundering.
Legal Outcome
The court highlighted the gravity of Li’s conduct, noting the “devastating losses” suffered by American victims. Li is the first defendant directly involved in receiving victim funds to be sentenced; seven other co‑defendants have already pleaded guilty. In December 2024, the Justice Department charged four additional suspects in a related $80 million pig‑butchering scheme.
Broader Impact on Cybercrime
The FBI’s 2024 Internet Crime Report recorded over $6.5 billion stolen from 47,919 victims in investment scams—a sharp rise from the previous year. The Li case underscores the growing scale of crypto‑based fraud and the need for coordinated international law‑enforcement efforts.
Mitigation & Automation (Tines Guide)
Organizations can reduce exposure to pig‑butchering attacks by automating detection and response workflows. The Tines platform enables security teams to:
- Identify suspicious wallet transactions in real time.
- Automate alerts and quarantine actions across messaging and email tools.
- Integrate threat intelligence feeds to block known scam actors.
- Streamline incident investigations, cutting hidden manual delays.
Implementing intelligent, automated workflows helps protect both financial assets and brand reputation against sophisticated crypto fraud schemes.