Fake finance "directors" in WhatsApp groups steered 18+ US investors to NanoBit, a crypto platform that never traded. The SEC won a $5.5M default judgment.
Social Engineering Examples·6 sources
This WhatsApp pig butchering scam ran through at least seven investment chat groups, where fake "directors" posing as real finance professionals talked members into a crypto platform called NanoBit. It never made a single real trade. From about late 2023 to June 2024, at least 18 US retail investors lost around $967,835, the SEC alleged. The SEC sued in September 2024, in one of its first cases aimed squarely at pig butchering. On 16 June 2026 a New York federal court entered a $5,518,902 default judgment. Status: Default judgment, no collection reported.
| Stage | What the SEC alleged |
|---|---|
| Groups | At least seven WhatsApp groups, with names like "VIP8012" and "VIP34" |
| Experts | Two lead personas, "Pseudo-Director A" and "Pseudo-Director B" in the complaint, each impersonating a real senior investment professional |
| Crowd | Fake assistants and planted members who cheered the trades along |
| Pitch | NanoBit, a crypto trading platform (once at NanoBitUS.com), plus fake coin offerings called "Cosmic Energy" and "VTrade" with counterfeit whitepapers |
| Cover | A claim that affiliate "NanobitUS Securities" was an SEC-registered broker-dealer |
| Reality | No trades ever executed. The trading screen was fake |
Why does this work on careful people? Because nobody pitches you directly at first. You watch others "win" for a while. By the time the director mentions a platform, it feels like your idea.
Tip: before trusting any broker, look it up yourself on Investor.gov. A chat group saying "SEC-registered" means nothing.
| Figure | What it is |
|---|---|
| About $967,835 | Combined crypto and cash lost by at least 18 investors, as alleged |
| More than $2 million | Wired to Hong Kong bank accounts by Radiant Horizons, as alleged (for example $145,690 on 17 January 2024 and $127,638 the next day) |
| About $725,335 | Crypto received by three unhosted wallet addresses |
| $242,500 | Received by the alleged money mules and their entities |
| $5,518,902 | Total disgorgement, interest and penalties ordered on 16 June 2026 |
These are separate measures. The $2 million in wires is bigger than the $967,835 in investor losses, and the complaint treats them as different numbers, so don't add them up. Sweet Karma Fashion Inc. and Zhao Tropical Deli Inc., two small businesses with no obvious link to finance, served as cash conduits.
| Date | Event |
|---|---|
| About September or October 2023 | Scheme begins (the SEC's two releases give slightly different start dates) |
| June 2024 | Scheme ends |
| 17 September 2024 | SEC files suit in the Eastern District of New York (No. 2:24-cv-06517) against four companies and three individuals |
| 18 September 2025 | SEC drops its case against one individual, with prejudice |
| 16 June 2026 | Default judgment against the other six defendants: NanoBit Limited, Radiant Horizons Limited, Sweet Karma Fashion Inc., Zhao Tropical Deli Inc. and two individuals |
| 29 June 2026 | SEC announces it (Litigation Release No. 26576) |
NanoBit owes $532,649 in disgorgement, a $1,182,251 penalty and $81,957 in interest. Radiant Horizons, Sweet Karma and Zhao Tropical Deli each owe a $1,182,251 penalty. The two individuals owe smaller sums and may now trade only in their own accounts. The people who actually ran the WhatsApp personas weren't named in the case.
The SEC published an investor alert with this case, alongside the CFTC, FINRA and NASAA:
See also pig butchering and the Austin DAIQ case.
A pig butchering scheme in which fake finance professionals in WhatsApp groups steered US investors to NanoBit, a crypto platform that made no real trades.
The SEC alleged at least 18 investors lost about $967,835 combined.
A default judgment on 16 June 2026 ordering $5,518,902 in disgorgement, interest and penalties against six defendants. No collection has been reported.
Strangers add you, "experts" vouch for a platform, the broker isn't on Investor.gov, and withdrawals suddenly need fees.
Social Engineering Examples. “WhatsApp pig butchering scam: SEC v. NanoBit (2023 to 2026)”. Accessed 3 November 2026. https://socialengineeringexamples.com/whatsapp-pig-butchering-nanobit-sec-2024
Scheme participants likely registered shell companies (e.g. Sweet Karma Fashion Inc., Zhao Tropical Deli Inc.) to serve as fiat mule accounts, stood up the fake NanoBit trading platform and dashboard, prepared counterfeit ICO whitepapers, and sourced WhatsApp numbers, consistent with the infrastructure named in the SEC complaint.
Shell-company formation and fake trading-platform builds are hard to intercept pre-launch; the realistic control sits with banks screening newly formed small-business accounts for mule-like deposit/withdrawal patterns once money starts moving, addressed at Stage 7.
Per the SEC complaint, at least one persona ('Pseudo-Director A') borrowed the name and title of a real managing director at a legitimate global investment firm, indicating some OSINT on real financial-industry professionals to make the impersonation credible.
Public professional profiles used for persona-borrowing are difficult to lock down at scale; the more effective control is verifying any individual's registration and firm affiliation directly on Investor.gov/SEC EDGAR rather than trusting the name and title as presented in a chat.
Scheme participants added or drew targets into private WhatsApp 'VIP' investment groups, with the SEC noting some investors were first solicited via other social media apps before being funneled into the groups.
Treat unsolicited additions to investment-themed WhatsApp/Telegram groups by strangers as a default red flag, and decline to engage rather than waiting to see where the group leads.
Impersonated senior professionals, backed by planted fake assistants and other fabricated group members, gave real-sounding investment commentary over an extended period to build rapport and the appearance of a thriving trading community before ever discussing money.
Recognize patient, no-pitch rapport-building in an investment-themed group chat as a known pig-butchering pattern in itself, per the SEC's investor alert, and avoid making investment decisions based on group-chat relationships regardless of how genuine they feel.
The group steered members toward the NanoBit platform, falsely claiming its affiliate 'NanobitUS Securities' was an SEC-registered broker-dealer tied to reputable firms, to defeat the skepticism a cold pitch would normally trigger.
Independently verify any broker-dealer's registration status on Investor.gov/SEC EDGAR before funding an account; this single check would have exposed NanobitUS Securities as unregistered.
In-group 'professionals' touted fake initial coin offerings (named in reporting as 'Cosmic Energy' and 'VTrade'), backed by counterfeit whitepapers, to induce larger investments beyond the initial deposit.
Apply the same registration/legitimacy check to any touted ICO or token before investing further, and treat a slick whitepaper alone as no substitute for verifiable registration or an independently confirmed trading history.
Victims wired fiat and transferred crypto into the scheme; funds were routed through the shell 'mule' entities to bank accounts in Hong Kong and into unhosted crypto wallets rather than any real trading activity.
Banks and crypto platforms can flag newly opened small-business accounts receiving many unrelated incoming wires followed quickly by large outbound transfers to overseas accounts, a recognizable mule-account signature.
When victims tried to cash out, they were charged undisclosed fees invented on the spot (e.g. one investor was told he owed $10,692 in 'Ghana miners fees') and told other members had only succeeded after paying similar fees.
Treat any new or undisclosed fee demanded to unlock a withdrawal as a hard stop rather than a cost of doing business, per SEC/CFTC/FINRA/NASAA guidance issued alongside this case.
Investors who pushed back or called the platform fraudulent were removed from the WhatsApp group, cutting off further contact. The complaint alleges that diverted funds were spent in the United States or wired to Hong Kong.
Being removed from a group chat for questioning legitimacy is itself a fraud indicator that should trigger an immediate report to the SEC, FINRA, or state regulators; the complaint alleges transfers to Hong Kong accounts and unhosted wallets, while the judgment establishes payment obligations without reporting a recovery amount.
Browse by what this case has in common with others in the library.
A fake IT text and phone call got a Retool employee's MFA codes in 2023. Google Authenticator sync did the…
A Lapsus$ affiliate used a contractor's stolen Uber password, likely bought on the dark web, flooded them with MFA push…
Texts about unpaid tolls copied E-ZPass, SunPass and more to steal card details across the US in 2024 and 2025.…
A fraudster spoofed Wells Fargo's real 800 number nine minutes after a legitimate advisor call, phished a 2FA code from…
The CEO of a UK energy firm was tricked into wiring €220,000 (~$243,000) to a Hungarian account in March 2019…
A phone-record pretexting incident involving a retired U.S. Army general was followed by FTC enforcement and broader privacy-policy scrutiny.
DOJ prosecutions of FIN7 members Fedir Hladyr, Andrii Kolpakov, and Denys Iarmak produced guilty pleas and prison sentences. The records…
A Houston- and California-based ring spoofed or compromised business emails to trick four companies and one New Jersey township into…
A respected Kansas bank CEO was groomed on WhatsApp into a crypto scam, wired $47.1M of bank funds in 11…
In August 2023, Clorox says, someone phoned its outsourced Cognizant help desk pretending to be two different employees. Agents reset…
Binance's comms chief said scammers used an AI "hologram" of him on Zoom calls. The impersonation is real; the deepfake…
A Singapore businessman sent at least S$4.9M after a fake Zoom "government meeting" built from real footage of PM Lawrence…
Two New Jersey men ran US "laptop farms" and shell companies that let North Korean IT workers use the stolen…
eSentire's Threat Response Unit says it shut down 10 attacks on six unnamed law firms across January and February 2023,…
MGM Resorts, September 2023. A caller reportedly talked the IT help desk into resetting an employee's access, and the shutdown…
In June 2025 the DOJ filed to forfeit $225.3M in USDT tied to pig butchering scams, after Tether and OKX…
Noma Security hid a prompt injection in a Salesforce web form and made Agentforce leak CRM data to a $5…
A Chicago hairstylist lost $20,000 to a Phantom Hacker scam. A caller claiming to be Bank of America said a…
GootLoader operators hijacked Google search rankings for legal-agreement phrases, luring law firm staff to fake forum "direct download" pages that…
Gootloader went quiet in the spring of 2025, the tracking researcher telling BleepingComputer his abuse reports caused the operation to…
Between 2006 and 2008 the FTC pursued six civil cases covering 16 data-broker and private-investigation defendants after two dismissals, alleging…
Task scams start with a job text and end with crypto deposits to unlock fake earnings. FTC: reports rose from…
Posing as NatWest bank security, vishing criminals convinced a Surrey solicitor to transfer £734,000 of client money to "safe" accounts.…
A long-running, India-based network of call centres impersonated the Canada Revenue Agency and RCMP in mass vishing calls that threatened…
Social Engineering Examples