2025 TRM Wrapped: Celebrating a Year of Private-Public Disruption

As 2025 comes to a close, we’re taking time for holiday traditions with friends and family, giving hot takes on holiday foods, and drafting our new year’s resolutions. In looking ahead, we’re also reflecting on the incredible impact our customers have had — from exposing exploitation and fraud, to dismantling violent criminal networks, to disrupting money laundering networks, to recovering stolen funds for victims.

In our year-end review, we highlight customer wins, major product releases, key policy updates, and must-read content. Get ready to relive 2025’s greatest hits and stay tuned for what we’re looking ahead to in 2026.

2025 by the numbers

USD 330M in illicit assets frozen by T3 FCU
USD 50M in assets disrupted by Beacon Network
93,000 deconfliction signals
4,300 training credentials earned
120+ product releases
23 new blockchains supported
1 epic BlockParty

2025 saw major customer wins and disruptions

Every day, our customers work to protect their organizations, customers, and communities — from uncovering online exploitation, to dismantling violent criminal networks, to returning stolen funds to victims.

Exposing a crypto-enabled CSAM scam network

Investigators from The National Organized Crime Agency (NCOZ), a specialized branch of the Police of the Czech Republic, uncovered a coordinated scam network of fraudulent dark web portals that took cryptocurrency payments from users seeking child sexual abuse material (CSAM). Radek Matějka, a senior cryptocurrency investigator, found dozens of sites routing payments into shared wallets, exposing a clear financial trail. Matějka’s unit traced funds through Bitcoin ATM cash-outs, worked with ATM operators and exchanges, and identified and arrested the primary suspect while linking a second individual to the scheme. The investigation also generated intelligence on hundreds of would-be consumers who sent crypto to the scam wallets — information that was shared with Europol to support broader cross-border disruption.

Combating physical crypto robberies

Coinbase partnered with law enforcement on two cases involving violent crypto theft. In the US, the global intelligence team worked with the FBI to dismantle a nationwide organized crime group that was robbing high-net-worth individuals through violent home invasions. Kristen Spaeth (Global Intelligence Manager at Coinbase) and her team traced over USD 3.5 million in stolen funds across complex laundering paths and linked them to real-world identities. The investigation led to the arrest of 14 suspects and convictions, with the ringleader, Remy St. Felix, receiving a 47-year prison sentence — one of the longest ever for a crypto-related crime.

In the UK, Coinbase’s Global Intelligence team partnered with West Midlands Police to find on-chain evidence against a violent gang that had used fake Grindr profiles to lure victims and assault and rob them. Investigators traced the stolen funds — linking them to the suspects. The combined evidence strengthened the prosecution’s case, leading to convictions of all five attackers and a combined sentence of over 78 years in prison.

In Arizona, Scottsdale PD investigated a series of crypto robberies in which a scammer posed as a rideshare driver and tricked and coerced victims into handing over their phones — draining more than USD 300,000 from their crypto wallets. By combining traditional investigative methods with blockchain intelligence, detectives identified and arrested the primary suspect.

Recovering stolen funds in a crypto rental scam

In Marion County, Florida, a pregnant homeowner searching for a place to live wired bitcoin for a rental she found on Facebook, only to realize the listing was fake and that her deposit was gone. Deputies from the Marion County Sheriff’s Office quickly collected Bitcoin ATM receipts at the scene, giving them on-chain starting points to trace the victim’s funds. Detective Richard Truman traced the funds from the ATM deposits into a suspect-controlled wallet and then into a Binance account, where the funds were frozen before they could be withdrawn. Through rapid action and cooperation with Binance, the victim’s stolen funds were fully recovered and returned.

Fighting for victims of crypto investment fraud

A Massachusetts resident fell victim to a sophisticated crypto investment scam, where scammers posed as representatives of an investment platform called SpireBit. Lilia DuBois and her team at the Massachusetts Attorney General’s Office stepped in — already investigating SpireBit’s operations. Using blockchain intelligence, her team traced the victim’s funds through over 700 addresses and transactions, identified the operators behind SpireBit, and secured restitution for four Massachusetts victims of SpireBit, totalling USD 217,000.

Securing Australia’s first major crypto laundering convictions

When the Australian Transaction Reports and Analysis Centre (AUSTRAC) flagged unusually high ATM cash deposits in Melbourne, Victoria Police uncovered a sophisticated Chinese organized crime syndicate operating an illicit money laundering service for criminal groups across Melbourne. Investigators traced the illicit funds; seized cash, vehicles, and devices; and worked with partners to provide expert testimony and analysis on the case. Each of the three accused pleaded guilty to laundering more than AUD 30 million worth of money and received lengthy prison sentences. 

Turning scam reports into victim restitution

Operation Shamrock is proof that public-private collaboration works, especially when it comes to helping law enforcement agencies be more effective in helping victims. When a victim lost hundreds of thousands of dollars to a sophisticated pig butchering scam, Detective Scott Simons of Greenfield Police Department and an Operation Shamrock investigator took action. Using blockchain intelligence and scam reports in Chainabuse, the team rapidly traced the laundered funds across blockchains. Within 24 hours, they linked the stolen assets to a USD 70 million seizure, successfully placing the victim's funds in the federal queue for return.

See how other organizations are disrupting crypto crime with blockchain intelligence

This year, we released over 120 new features and enhancements. We focused on rapidly adding new blockchain and asset support, reducing the time from data to decision, and enabling better coordination between private and public sector. 

Standardizing and expanding blockchain support

This year, we launched support for 23 blockchains, including Canton Network, Hyperliquid, Hedera, Zksync, Sui, Sei, XDC, and XRPL EVM. 

We’re rapidly adding new blockchain coverage — averaging over two blockchains per month in the latter half of 2025 — enabled by standardizing support for every new chain. TRM’s Standard support includes:

• Automatic support for all native assets, including all derivative assets on EVM chains
• Full capabilities in TRM Wallet Screening and TRM Transaction Monitoring
• Entity and address-level analytics in TRM Forensics, like counterparty volumes and risk indicators
• Automatic cross-chain tracing through 640+ attributed bridges
• Ownership and counterparty exposure for all risk categories
• Indirect exposure for severe and high-risk categories
• Real-time transaction data freshness

Standard support ensures every chain we launch enables customer outcomes and includes consistent functionality, so you don’t have to guess what’s supported from chain to chain.

Enabling public-private disruption with Beacon Network

In August, TRM Labs launched Beacon Network, the first real-time crypto crime response network that helps law enforcement, crypto exchanges, DeFi services, and stablecoin issuers stop illicit funds before they’re cashed out. Beacon enables verified investigators to flag suspicious addresses and automatically propagate those signals across participating exchanges and service providers, triggering instant alerts when flagged assets reach on-ramps. By reducing the window between detection and action from days to minutes, Beacon supports rapid public-private coordination to block cash-outs.

Accelerating law enforcement disruption with TRM Deconflict

Building on our proven deconfliction network, TRM Deconflict provides a free solution that enables verified law enforcement agencies to surface blockchain insights, then collaborate and deconflict cryptocurrency investigations and drive faster disruption. Using TRM Deconflict, investigators can look up an address or transaction that returns blockchain intelligence and attribution — powered by TRM’s industry‑leading cross‑chain analytics and clustering heuristics — and quickly assess context before taking action. Then they can leverage TRM’s secure, verified deconfliction network where agencies can deconflict specific wallet addresses, discover peers working related cases, and coordinate efforts. 

Enabling faster decision-making with advanced entity insights

For compliance teams and regulators, entity due diligence requires assessing risk in the moment and monitoring how risk changes over time. TRM’s entity profiles aggregate on- and off-chain risk signals — enabling faster, confident decision-making. Users can quickly identify the biggest contributors to risky exposure and benchmark that exposure against other similar entities. From there, we’ve made it easy to proactively monitor entities of interest, with detailed insights into how much an entity’s risk score has changed over different time periods. 

Accelerating wallet identification with Seed Analysis

When law enforcement discovers seed phrases during investigations, it’s critical to quickly identify and move any assets to police-controlled wallets before evidence is lost. In April, TRM launched Seed Analysis to enable rapid, high-confidence identification of associated wallets and balances — empowering officers to act decisively to seize crypto. Since then, we’ve released major enhancements, like:

• Expanding coverage to 33+ blockchains, including Tezos, Stellar, Aptos, Binance Beacon Chain, as well as custom derivation strategies for Atomic LTC, and BitGet BTC
• Two analysis modes: Fast scan delivers results in minutes by scanning hundreds of thousands of addresses to quickly surface likely targets, while full analysis runs a deeper search across billions of wallets and addresses for maximum coverage
• Enhanced capabilities to identify likely word matches when a typo is detected
• Support for wildcards in SLIP39 shares to recover a missing word
• Test permutations of entered words to reconstruct mnemonic phrases
• Identifying likely wallet providers for each derived address, helping investigators understand which wallet tools could access related funds

Expanding analysis with your own data

Investigators, compliance teams, regulators, and national security analysts can bring their own ground truth data to TRM Forensics — combining our industry-leading intelligence to generate new insights and investigative leads. In February, TRM launched custom ledgers to enable investigators to ingest thousands of transaction records from subpoena returns. 

Throughout 2025, we enhanced custom entities, enabling users to cluster addresses, entities, and other custom entities to get aggregated insights. 

• Combine insights across hundreds of thousands of addresses and tens of millions of transactions, including aggregating results from Seed Analysis
• Streamline workflows by creating custom entities from CSV files, sharing them with other users, and adding them to cases and your entity monitoring dashboard
• Instantly plot a user’s exchange account to a graph to analyze counterparty exposure and trace deposits and withdrawals from the transaction history
• Analyze 25x more addresses, 10x more transactions, and plot multiple elements to accelerate on-chain investigations

Creating complete solutions tailored to our customers

TRM is more than just products, it’s our data, experts, training, and partners that work within your systems and workflows to help you make defensible decisions, faster.

• TRM Compliance360 enables compliance teams stay ahead of emerging threats with complete visibility into entity, address, and asset risk
• TRM Investigation360 gives law enforcement agencies a clear path from the first clue to a court-ready case
• TRM Seizure360 enables law enforcement to freeze and seize illicit assets
• TRM NatSec360 fuses blockchain and behavioral intelligence to accelerate national security targeting‍
• TRM Supervision360 enables regulators to to strengthen licensing, monitoring, and enforcement with comprehensive data from the jurisdiction to transaction level

2025 was a busy year for global crypto policy

2025 was the year regulatory clarity met market momentum. The US, under the Trump administration, reshaped the global policy tone as crypto regulation entered a period of accelerating implementation and growing maturity. In our annual Global Crypto Policy Review & Outlook report, we reviewed crypto policy developments in 30 jurisdictions, representing over 70% of global crypto exposure. 

• Stablecoins moved to the center of global crypto policy, with over 70% of jurisdictions advancing new frameworks to support payments and institutional use
• Clearer regulation unlocked broader institutional adoption, with roughly 80% of jurisdictions seeing banks and financial institutions expand digital asset activity
• Regulation began to show measurable impact on risk, as regulated VASPs continued to account for significantly less illicit activity, reinforcing the value of coordinated oversight and information sharing

2025 laid the groundwork for 2026 by turning theoretical frameworks into real regulatory action, centering stablecoins in global policy, and bringing traditional finance deeper into digital assets.

{{blogad-globalcryptopolicyreview2025-report-1}}

The content you kept on repeat

1. 2025 Crypto Adoption and Stablecoin Usage Report to deep dive digital asset adoption across global jurisdictions in the first half of 2025
2. Banking on Stablecoins for a risk mitigation blueprint for financial institutions
3. Identifying Crypto Artifacts in the Field as a guide to to help law enforcement officers and  investigators identify, assess, and act on potential crypto-related threats
4. Shadow Bankers report to understand how Chinese underground networks function and strategies to disrupt their operations
5. Investigating Crypto Scams as a field guide for law enforcement professionals to disrupt scams and fraud
6. Become a GENIUS webinar recap to playback key insights on stablecoin risk and compliance

{{TRMTalks-MostStreamedEpisodes2025}}

“This year, we saw global private sector organizations and law enforcement agencies join forces to launch Beacon Network, the first real-time crypto crime response network. I’m inspired by our customers — who are on the frontlines every day disrupting global criminal and money laundering networks, recovering stolen funds, and helping victims rebuild trust in the financial system. Looking ahead to 2026, I’m encouraged by the continued impacts from private-public disruptions, as well as the industry’s use of AI as another tool in our arsenal to combat AI-enabled crime.”
-Esteban Castaño, CEO and co-founder of TRM Labs

‍