There has never been a better time to work at the frontier of financial intelligence.

Not because of any single headline — because the technical problems in this space are some of the hardest and most consequential in all of technology — and the people solving them at TRM are doing work that stands alongside the best happening anywhere.

I wanted to start this blog so they could tell you about it themselves.

The problems are real

TRM traces illicit flows across more than 100 blockchains. That means our systems must ingest, normalize, and make queryable the entire transaction history of every major chain — in real time. When a law enforcement agent needs to know where stolen funds moved in the past hour, across three different blockchains, through a bridge, into a mixer, and out to an exchange, our graph has to already know.

That is not a simple data pipeline. It is a distributed systems problem, a graph problem, and a machine learning problem — all at once, all at production scale, all with zero tolerance for error because real investigations depend on the answer.

The stakes are concrete. The Bitfinex recovery — $3.5 billion in Bitcoin seized in 2022 — required tracing funds through hundreds of thousands of transaction hops, across years. Identifying North Korea's Lazarus Group as the actor behind billions in stolen digital assets meant resolving the same entities operating across Bitcoin, Ethereum, and other chains simultaneously, under different identities. These are not benchmark problems. They are real investigations with real consequences at the end.

The impact is disproportionate

The adversaries using blockchain infrastructure to move money are not amateurs. They are state-sponsored hacking groups, ransomware operators, and sanctions evaders — often running complex laundering operations spanning multiple chains, jurisdictions, and years. Stopping them requires building systems that are faster, smarter, and more precise than the methods they use to hide.

Law enforcement agencies, regulators, and financial institutions across dozens of countries rely on TRM's intelligence every day to trace funds, identify actors, and build cases that hold up in court. Most startups measure impact in product metrics. Here, the unit of impact is an investigation closed, a seizure made, a sanctions violation caught before it clears. The engineering, the science, and the intelligence work are inseparable from those outcomes.

What the team built this year

In the past year alone, this team has:

• Built a real-time blockchain ingestion system that processes new chain data as blocks are confirmed, not hours later — the infrastructure that makes any downstream intelligence possible at all
• Built probabilistic entity clustering that groups blockchain addresses belonging to the same real-world actor across 100+ chains — replacing brittle deterministic rules with models that handle ambiguity at the scale of global illicit finance
• Traced billions in illicit flows back to the actors behind them — state-sponsored hackers, ransomware groups, darknet operators — producing attribution that has informed seizures, sanctions designations, and criminal prosecutions

None of this was done for a demo. All of it is in production, handling real data, supporting real investigations.

Why this blog exists

I have spent enough time around teams doing serious, consequential work to know that what is happening here is special. The combination of the problem space — financial intelligence at global scale — with the caliber of people working on it creates something rare: a place where the work is both technically deep and genuinely matters.

The nature of our work means most of it happens behind the scenes. Investigators use our tools to trace funds and build cases. Compliance teams use our APIs to screen transactions. The craft that makes all of that possible is largely invisible.

This blog changes that.

The problems here live in production, in real investigations, where a wrong answer has consequences. That is what makes the work worth publishing.

In the coming posts, you will hear directly from the engineers, scientists, and analysts who build and power these systems. How we handle real-time detection across 100 blockchains. How we approach entity resolution when the same actor operates across multiple chains under different identities. How we think about confidence scoring when the stakes of a wrong attribution are real. How we use AI — not as a marketing term, but as a tool that makes our analysts and investigators faster and more accurate.

The intelligence compounds — every chain covered, every entity resolved, every method understood makes the next one sharper. We'd like this blog to compound too.

Who this is for

If you find hard problems more interesting than easy ones, this blog is for you. If you are curious about what financial intelligence actually looks like under the hood, this blog is for you. If you want to work somewhere that the work is as serious as the mission — we're hiring, and this blog will show you what it looks like.

Welcome. First up: how we built real-time ingestion across 100 blockchains.