Last week, the Royal Canadian Mounted Police (RCMP) announced the largest cryptocurrency seizure in Canadian history, dismantling the offshore exchange TradeOgre and taking control of more than USD 40 million (CAD 56 million) in digital assets. Investigators leveraged blockchain intelligence and digital forensics to identify illicit flows and recover wallets holding criminal proceeds—turning what many considered “unrecoverable” assets into evidence and restitution potential.
TRM Labs is proud to have supported the RCMP in this and other investigations.
For years, TradeOgre operated in the shadows—unregistered with FINTRAC, offering anonymous trading with no meaningful KYC—and became a magnet for illicit finance. Investigators believe the majority of flows through the platform were criminal in origin. On-chain analysis showed millions moving between TradeOgre and darknet markets, ransomware programs, hacked and exploited funds, fraud schemes, mixers, and other high-risk counterparties, with the exchange functioning as a hub to aggregate, obfuscate, and off-ramp proceeds.
The case began in June 2024, when Europol tipped Canadian authorities to suspicious activity. From there, the RCMP’s Money Laundering Investigative Team, supported by C Division and NC3, mapped the exchange’s infrastructure and transaction graph. Using blockchain intelligence, they analyzed platform-controlled wallets, traced cross-asset movements and identified choke points where criminal funds exited to services with weaker compliance controls. While TradeOgre was especially popular among privacy-coin users like Monero, it also processed significant volumes in traceable assets like Bitcoin—and those transactions ultimately became the evidentiary backbone of the case.
RCMP analysts examined familiar laundering typologies: chain-hopping between transparent and privacy assets, peel chains and layering to fragment flows, mixers to obscure provenance, and rapid cycling through high-risk services to frustrate compliance checks. By correlating deposit and withdrawal patterns, timing, and counterparties, investigators linked proceeds from fraud and organized crime directly to TradeOgre-controlled wallets. That evidence supported judicially authorized seizure orders and allowed investigators to recover access to wallets holding illicit funds—a watershed moment demonstrating that even obfuscated assets can be brought under law enforcement control with the right tools and authorities.
In addition, RCMP leveraged TRM’s Seed Analysis tool that allows investigators to convert a recovered seed phrase (the 12-24 word mnemonic that can recreate a wallet) into corresponding public keys, wallet addresses, balances, and transaction histories.
Today, anyone visiting TradeOgre’s website sees a seizure notice posted by the RCMP. While no arrests have yet been announced, investigators continue to analyze records and historical transaction data, with charges expected as wallet identities and infrastructure operators are unmasked. The focus is shifting from seizure to attribution, forfeiture, and prosecution.
The implications extend well beyond one exchange. For platforms, the message is clear: compliance—registration and robust AML—is not optional. For criminals, the myth that anonymity equals impunity is once again shattered; even platforms designed for secrecy leave forensic trails on public ledgers. And for regulators, this case highlights the importance of international collaboration: Europol’s intelligence, RCMP’s enforcement, and TRM’s blockchain intelligence tools combined to achieve a historic outcome.
Related posts
Access our coverage of TRON, Solana and 23 other blockchains
Fill out the form to speak with our team about investigative professional services.
