MetaMask launched a feature designed to detect investment and romance scams known as “pig butchering” before users send crypto. When the app detects signs of potential risk, it warns the user and prompts them to review the circumstances of the transfer.
MetaMask, the developer of the cryptocurrency wallet, introduced a new security mechanism targeting schemes in which scammers persuade victims to voluntarily transfer funds under the guise of investments or through personal relationships built over an extended period. The system analyzes transactions as users prepare to send assets and intervenes before confirmation if it detects suspicious signals.
The new feature targets schemes that are difficult for traditional crypto wallet security tools to detect. “Pig butchering” scams often don’t involve malicious code, vulnerable smart contracts, or other technical tools used to carry out attacks. Instead, scammers may spend weeks or months building trust with a potential victim before persuading them to send cryptocurrency themselves or invest funds in what appears to be a lucrative investment opportunity.
According to data from the FBI’s Internet Crime Complaint Center (IC3), losses from cryptocurrency investment fraud in the U.S. alone reached $7.2 billion in 2025. Because users initiate these transfers themselves, standard mechanisms for detecting malicious contracts and technical attacks may not identify such transactions as dangerous.
MetaMask analyzes signs of potential “pig butchering” scams immediately before funds are sent. The screening process also uses security infrastructure from Blockaid, whose system determines whether the recipient’s address was previously flagged as malicious.
If a transaction appears suspicious, the app asks the user several questions, including:
- whether the user has met the person receiving the funds in real life;
- whether the recipient promised guaranteed returns;
- whether the recipient is demanding that the transfer be completed within a short period or pressuring the user to speed up the transaction.
The answers are intended to help identify signs of social engineering before the transfer is finally confirmed. MetaMask doesn’t automatically block a suspicious transaction. After receiving the warning, the wallet owner still decides whether to proceed.
The new functionality is already available in MetaMask Mobile starting with version 8.11 and in the MetaMask Extension starting with version 13.48. The feature works across all supported EVM networks.
Previously, analysts found that malicious DeFi applications were increasingly being used in “pig butchering” scams, making it easier for scammers to extract funds from inexperienced users.
