US Treasury sanctions firm linked to $200 million in ‘pig butchering’ scams

The U.S. Treasury Department sanctioned a Philippines-based company accused of enabling multiple “pig butchering” scams, which defrauded U.S. victims of more than $200 million with an estimated average loss of $150,000 per person.

According to a statement on Thursday, the agency’s Office of Foreign Assets Control sanctioned Funnull Technology Inc. and its administrator, Liu Lizhi. The agency said the company bought IP addresses from cloud service companies globally and then sold them to bad actors to “host scam platforms and other malicious web content.”

Funnull is also connected to the most crypto investment scam sites reported to the Federal Bureau of Investigation, according to the agency.

“Today’s action underscores our focus on disrupting the criminal enterprises, like Funnull, that enable these cyber scams and deprive Americans of their hard-earned savings,” said Deputy Secretary of the Treasury Michael Faulkender in the statement. “The United States is strongly committed to ensuring the continued growth of a legitimate, safe, and secure digital asset ecosystem, including the use of virtual currencies and similar technologies.”

Pig butchering has been on the government’s radar for years, amid an almost 40% increase in illicit revenue year-over-year in 2024, as revealed by Chainalysis earlier this year.

Pig butchering scams, also known as romance scams, build relationships with users and then lure them into fraudulent investments. Federal agencies such as the Federal Deposit Insurance Corporation and the U.S. Secret Service have issued warnings about these scams, and law enforcement has made several arrests tied to these operations.

Treasury said on Thursday that Funnull specifically created domain names using an algorithm that “generate large numbers of similar but unique names for websites.”

“These services not only make it easier for cybercriminals to impersonate trusted brands when creating scam websites, but also allow them to quickly change to different domain names and IP addresses when legitimate providers attempt to take the websites down,” the agency said.