Product & Blockchain Intelligence Releases · September 2026

Earlier Detection.Faster Disruption.

New releases across the TRM platform and blockchain intelligence — transaction velocity rules, Detect on every Standard and Enhanced blockchain, TRM MCP for Gemini CLI and OpenAI Codex CLI, and expanded attribution across fraud, narcotics, sanctions, and exchange coverage

+$0

Scam funds attributed before losses were final

+$0

Newly visible narcotics proceeds

Addresses attributed to a fiat on-ramp

OFAC-named Xinbi addresses

Scroll to explore

NEW Transaction velocity rules

NEW Detect on all Standard & Enhanced blockchains

NEW TRM MCP for Gemini CLI & OpenAI Codex CLI

NEW Saved Prompts in Co-Case Agent

NEW Pattern-of-life heatmap in Graph Visualizer

+$300M scam funds attributed before losses were final

+$258M newly visible narcotics proceeds

+28.2M addresses attributed to a fiat on-ramp

+68 Chinese drug-precursor manufacturers

~200K counterfeit tokens flagged

NEW TRM Academy in Brazilian Portuguese

NEW Transaction velocity rules

NEW Detect on all Standard & Enhanced blockchains

NEW TRM MCP for Gemini CLI & OpenAI Codex CLI

NEW Saved Prompts in Co-Case Agent

NEW Pattern-of-life heatmap in Graph Visualizer

+$300M scam funds attributed before losses were final

+$258M newly visible narcotics proceeds

+28.2M addresses attributed to a fiat on-ramp

+68 Chinese drug-precursor manufacturers

~200K counterfeit tokens flagged

NEW TRM Academy in Brazilian Portuguese

This Month’s Highlights

The two releases you should know about

Product

Behavioral monitoring catches high-volume activity with velocity rules

Transaction velocity rules are a new behavioral rule condition in TRM Transaction Monitoring. They flag alerts when an account’s total transfers exceed a dollar threshold within a 24-hour period, independent of risk category exposure.

Blockchain Intelligence

The US follows the UK in sanctioning Xinbi Guarantee

OFAC designated Xinbi Guarantee, a Chinese-language escrow marketplace serving Southeast Asian scam syndicates, on September 9. The UK sanctioned Xinbi in March 2026, and TRM has carried it under the sanctions category since then, so the 52 TRON addresses named by OFAC were already attributed to Xinbi in TRM when the US designation was announced.

Learn More

Product Releases

What we shipped across the platform

TRM customers can catch high-volume activity with velocity rules in Transaction Monitoring, work alerts from more AI agents, and investigate faster in TRM Forensics — with Detect now on every Standard and Enhanced blockchain.

TRM Transaction Monitoring

Velocity rules and agent-ready API docs

Detect suspicious transaction patterns and connect your coding agent to TRM API Docs

New Rule Condition

Transaction velocity rules

TRM Transaction Monitoring now supports transaction velocity rules, a new behavioral rule condition that triggers an alert when an account’s total transfer volume exceeds a dollar threshold within a 24-hour period. No risk category filter is required, so the rule triggers on the amount itself rather than the counterparty.

For compliance teams:

Catch high-volume activity that single-transaction rules miss, including bursts of transfers each kept just under a threshold
Flag on the amount rather than the counterparty, extending the volume-based controls of fiat AML programs to crypto

New

Connect your coding agent to TRM API Docs

The TRM Docs MCP gives Claude, Cursor, Codex, VS Code, and other MCP clients authenticated access to current TRM API documentation — so your agent can find API contracts, answer implementation questions, and help build TRM integrations in your workspace.

Learn More

For developers:

Ground answers and generated code in current request schemas, responses, authentication, and errors
Use the built-in Compliance API integration skill to build multi-step workflows, such as withdrawal flows and webhook integrations
Your agent sees only the documentation available to your TRM Docs account

TRM MCP

Work alerts from the agent you prefer

TRM MCP now supports Google Gemini CLI and OpenAI Codex CLI, alongside Claude Code

New Clients

TRM MCP supports Gemini CLI and OpenAI Codex CLI

TRM MCP now connects with the Google Gemini CLI and the OpenAI Codex (ChatGPT) CLI, in addition to Claude Code. Analysts can investigate Transaction Monitoring alerts and Wallet Screening results from their preferred AI agent using their own TRM credentials. Reach out to your account team for access to TRM MCP.

Learn More

TRM Forensics

Investigate faster, monitor more blockchains

Shareable Co-Case Agent prompts, a pattern-of-life heatmap, Detect on every Standard and Enhanced blockchain, and group escalation from TRM Triage

New

Saved Prompts in Co-Case Agent™

Investigative teams can save their most effective Co-Case Agent prompts and share them with specific users, groups, or the whole organization. Analysts can reuse a saved prompt in any investigation, helping teams apply consistent methods across cases.

Learn More

New

Pattern-of-life heatmap in Graph Visualizer

A new pattern-of-life heatmap shows an address’s outgoing transactions by day of week and hour of day, helping investigators identify when an address is typically active. The color scale is fixed, so activity levels can be compared across addresses.

Expanded

Detect on every Standard and Enhanced blockchain

Detect now monitors transfers on every Standard and Enhanced blockchain TRM supports, including Solana. New Standard and Enhanced blockchains are added to Detect automatically, so investigators can track watched funds across more of the ecosystem.

New

Group escalation from TRM Triage

Analysts can now escalate an address from TRM Triage to a group as well as to individual users. Each group member receives an email notification and edit access to the case, and access updates automatically as group membership changes.

Learn More

TRM Academy

TRM Academy in Brazilian Portuguese

Eight courses and certifications now available in Brazilian Portuguese

New Language

Courses and certifications in Brazilian Portuguese

Current learners can enroll in non-certification courses from the TRM Academy catalog. For new learners or certification enrollment, contact your TRM account team.

Learn More

Now available:

TRM Forensics Orientation
TRM Forensics Mastery
Transitioning to TRM Forensics
Investigating TRON
TRM-CFC, TRM-CI, TRM-ACI, and TRM-CCS certifications

Blockchain Intelligence Releases

Attribution that lands before it’s needed

TRM customers were already covered when new designations landed, can act on scam funds while they’re still moving, and can trace more activity to the drug suppliers, exchanges, and on-ramps behind it.

Counter Narcotics

A fourth straight month above $200M

New visibility into narcotics proceeds and the earliest stage of the fentanyl supply chain

+ Expanded

+$258M

Newly visible narcotics proceeds

TRM added about $258M in newly visible narcotics proceeds, up 21% from the previous month and the fourth straight month above $200M. Most came from deeper coverage of large darknet marketplaces, plus new attribution of a shared payment platform that darknet vendors use to run their shops — so when a vendor rebrands or opens a new shop, the attribution carries over.

+ New Attribution

+68

Chinese drug-precursor manufacturers attributed

TRM attributed 68 more Chinese drug-precursor manufacturers, which supply the chemical inputs used to make fentanyl and other synthetic opioids. Compliance teams can flag payments to these suppliers, and investigators can trace fentanyl networks back to where their chemicals come from.

Facilitation & Money Laundering

Separating real transfers from counterfeit ones

New detection flags counterfeit tokens that imitate major assets

New Detection

~200K

Counterfeit tokens flagged as spam

TRM now labels counterfeit tokens that copy the ticker of a major asset, such as USDT or ETH, or imitate it with look-alike characters — about 200,000 flagged so far across Ethereum, BNB Chain, Polygon, and other blockchains. Filtering them out also let TRM attribute about 5 million more real addresses.

For investigators:

Counterfeit tokens stand out in a wallet’s history and don’t affect risk scores
Separate real payments from fake ones scammers use to make a wallet look legitimate

Exchange & Service Coverage

Named services in place of unknown counterparties

A major fiat on-ramp and 50 more exchanges now attributed

+ New Attribution

+28.2M

Addresses attributed to a fiat on-ramp

TRM added attribution for a fiat on-ramp covering about 28.2 million addresses across Polygon and Base. For many wallets, the on-ramp is the first source of funds. Investigators can now see where those funds came from, and compliance teams can treat the deposits as a known service.

+ Expanded

More exchanges covered

TRM added infrastructure coverage for 50 more exchanges, which moved roughly $1.13B in outflows over the past 90 days. Funds moving into and out of these exchanges now trace to a named service.

Fraud

Labeled while there’s still time to act

Scam funds attributed before losses were final, plus coverage of major 2026 hacks

+ New Attribution

+$300M

Scam funds attributed before losses were final

TRM attributed about $300M more in scam-linked funds before the losses were final. The earlier scam funds are labeled, the more time exchanges and investigators have to freeze or recover them.

Coverage

2026

Major 2026 hacks attributed

TRM has attributed the major crypto hacks of 2026, including five since our last update, and typically labels exploiter addresses within hours of an attack. That helps exchanges screen deposits from exploiters before funds are cashed out.

Sanctions

Covered before the designations landed

OFAC’s Xinbi Guarantee designation and Treasury’s Operation Economic Outcast

New Designation

$36B+

OFAC designates Xinbi Guarantee, following the UK

OFAC designated Xinbi Guarantee on September 9 as a significant transnational criminal organization, along with the developers of its wallet and messaging app. Xinbi is a Chinese-language escrow marketplace where Southeast Asian scam syndicates buy stolen data, fake identity documents, and cash-out services. TRM’s published analysis places its throughput at more than $36B since around 2022.

Learn More

For compliance teams:

The US is the second jurisdiction to sanction Xinbi, after the UK in March 2026
Xinbi has been under the sanctions category in TRM since the UK designation, so the 52 TRON addresses named by OFAC were already attributed
TRM has attributed additional Xinbi addresses beyond those named, through onchain analysis
US persons are now generally prohibited from dealing with Xinbi

New Coverage

Operation Economic Outcast: 30 designated Iran-linked addresses live in TRM

Treasury launched Operation Economic Outcast on August 24, designating nearly 60 Iran-linked entities, individuals, and vessels, and naming digital assets a sanctionable sector of Iran’s economy. The designations include members of the Mabna Institute, an Iran-based hacking-for-hire group, and 30 of their addresses across Bitcoin, Ethereum, and TRON.

Learn More

For customers with Iran exposure:

All 30 addresses are live in TRM under the sanctions category
The addresses have received about $16.8M since 2018, 92% through one individual’s addresses
Under the new sectoral determination, significant transactions for Iranian digital-asset businesses risk secondary sanctions

Related Resources

Keep exploring

Product & Blockchain Intelligence Releases - August 2026

Product & Blockchain Intelligence Releases - July 2026

TRM MCP Day 1: Resolve Alerts with Your AI Agent