How Pig Butchering Scams Use Shell Companies To Launder Money
Recent cases show how scammers steal business identities to bypass verification and set up U.S. bank accounts to move stolen funds.
Last month, the U.S. Attorney’s Office for the Eastern District of New York charged two people with laundering proceeds from cyber investment fraud scams, also known as pig butchering. The pair were key players in a group that moved more than $40 million through a Chinese money laundering network.
The FBI says crypto investment fraud cost Americans $7.3 billion in 2025. The criminal networks are now using AI to run the scams at scale. OpenAI last week wrote a report about the operations of a group in Cambodia that it shut down back in February.
The court documents are currently sealed, so we can’t see the full machinery yet. But a recent case in Queens lets us look under the hood…
In early 2023, Tiffany Yang befriended other users on Facebook Messenger using a fake profile under the name “Lily Lyst.” Eventually, Lyst would talk them into putting their savings into an investment platform that didn’t really exist.
In October, Queens District Attorney Melinda Katz charged Yang with stealing at least $2 million from 17 victims. By then, Yang had distributed over $5 million through 97 bank accounts that were tied to multiple shell companies all registered to her Flushing apartment.
Pig butchering runs on a script—a jingliao—that leads the victim to a fraudulent website to invest in virtual currency. The scammer coaches the victim and uses the fraudulent website to show fake profits and get the victim to invest more. The fattening of the pig.
Over the course of a year, Yang got one of her victims to put up to $1.1 million into what he believed to be his account on SpreadEx Ltd., a real gambling and investing service. She led him to a fake version of the site he used for months but once he tried to withdraw funds, the site disappeared—butchering the pig.
Investigators traced one victim’s $45,000 deposit into the supposed SpreadEx account and found Yang on the other end. The money had landed in the account of Jian Ma Foot Spa 2 Inc., one of at least 97 shell companies that bank records tied to Yang’s Flushing apartment.
Cloning business identities
The complaint named only six of the companies that Yang controlled. Running those names on Middesk’s entity graph didn’t immediately yield connections but it revealed a pattern in how they had been created.
The fraud network registered the companies in daily batches of three or more. They hijacked the identity of legitimate businesses, some with active licenses. Following that pattern, we found more than 20 real New York businesses whose identities were stolen around the same time that Yang’s companies were being registered.
The fraudsters added a surname at the beginning of the new registered company name, such as Chen New Funny Nails Inc. or Chen Graceful Nails Inc., and registered them at the address of the real New Funny Nails Inc. The strategy got them past identity verification screenings at multiple major banks.
Those business bank accounts were ultimately where the stolen funds landed once the victims deposited what they thought were investments.
In October, law enforcement searched the apartment and found Yang in the living room. She had $80,000 in cash and checkbooks in the name of various companies from multiple banks.
The Largest Cryptocurrency Seizure In History
Schemes like Yang’s are usually run overseas. Days after Yang’s arraignment, U.S. authorities indicted Chen Zhi, chairman of the Cambodian conglomerate Prince Holding Group. They said Zhi allegedly ran a vast fraud and money-laundering operation and they were seizing about 127,271 bitcoin, worth roughly $15 billion.
The government says the bitcoin it wants to seize is the proceeds of “pig butchering” investment scams run at mass scale out of forced-labor compounds in Cambodia and laundered through Prince Group’s businesses.
Prosecutors alleged that Prince Group is part of a booming Southeast Asian scam economy built on trafficked labor. They pointed to an estimate of 350,000 people working in compounds across Cambodia, Laos and Myanmar that pull in up to $75 billion a year.
The compounds “housed vast dormitories surrounded by high walls and barbed wire, and functioned as violent forced labor camps,” prosecutors said. Workers are trained to build relationships with victims and to spin up social media accounts in bulk. Two facilities alone ran 1,250 phones controlling 76,000 social media accounts, according to court filings.
OpenAI said last week that a network of users in Cambodia used its models to “create and support the operation of fake online personas, generate and translate messages sent to scam targets, create promotional content for their fraudulent schemes, and assist with day-to-day operations.” The company shut the network down back in February. It did not say the network was connected to Prince Group.
Just like in Yang’s case, victims wired funds to shell companies registered in Brooklyn and Queens. They watched the fake balances climb and deposited more. If they asked to cash out, the scammers would go quiet.
Prosecutors say the stolen funds were then routed to the compound’s accounts and laundered back to Prince Group and its executives.
The New York Connection
Last month’s indictment talked about two members of a larger network in China and it said that the people were connected to a third man: Cheng Wei Huang.
A quick search on federal court records turns up two other cases involving Huang: a 2024 money laundering one and a 2023 kidnapping. Huang had posed as an FBI agent and abducted a couple in Queens, allegedly on orders of a local Chinese organized-crime figure. The couple had supposedly stolen from a crime syndicate they worked for.
Prosecutors linked Huang’s 2024 money laundering case to last month’s arrest in the pig butchering network. Neither Huang nor the recent arrests are tied to the Prince Group case.
Huang waived indictment and pleaded guilty in both of his cases but his sentencing has been repeatedly adjourned, a pattern that some might read as a cooperation deal. For now, his sentencing is scheduled for December but we might hear of other developments before that happens.