Product & Blockchain Intelligence Releases · October 2026

Real-time Cross-chain Tracing

New releases across the TRM platform and blockchain intelligence — real-time cross-chain swaps in TRM Forensics, behavioral Signatures® in TRM Transaction Monitoring and TRM Wallet Screening, TRM MCP in Claude Desktop, Co-Case Agent™ sessions in parallel, and expanded attribution across the largest crypto theft on record, darknet markets, drug-precursor suppliers, and sanctions

0
EVM chains with real-time cross-chain swap matching
$0
Stolen in the largest crypto theft on record, traced and labeled
0
Chinese drug-precursor manufacturers identified
0
Darknet marketplace address labels added
Scroll to explore
NEW Real-time cross-chain swap matching
NEW Counterparty Signature alerts in Transaction Monitoring
NEW Behavioral Signatures in Wallet Screening
NEW TRM MCP in Claude Desktop
NEW Machine-to-machine access to TRM MCP
NEW Co-Case Agent sessions in parallel
~$6.36B largest crypto theft on record traced and labeled
+10M address labels across three darknet marketplaces
+80 Chinese drug-precursor manufacturers
+3.6M TRON addresses attributed
+6M DEX liquidity pools labeled
NEW Real-time cross-chain swap matching
NEW Counterparty Signature alerts in Transaction Monitoring
NEW Behavioral Signatures in Wallet Screening
NEW TRM MCP in Claude Desktop
NEW Machine-to-machine access to TRM MCP
NEW Co-Case Agent sessions in parallel
~$6.36B largest crypto theft on record traced and labeled
+10M address labels across three darknet marketplaces
+80 Chinese drug-precursor manufacturers
+3.6M TRON addresses attributed
+6M DEX liquidity pools labeled
This Month’s Highlights

The two releases you should know about

Real-time cross-chain swap matches accelerate investigations

TRM Forensics enables real-time cross-chain swaps on 36 EVM blockchains and through 21 bridge services, with more blockchains and bridges being added.

Tracing funds through cross-chain swaps as they happen is critical for investigations. For example, TRM investigators traced the Binance theft proceeds through cross-chain swaps chained simultaneously through two bridges. Freezes depend on how fast an issuer or exchange learns an address is tainted.

TRM traced and labeled the attacker addresses in the largest crypto theft on record

On October 29, an attacker moved about $6.36 billion out of Binance wallets across ten blockchains. TRM attributed the theft to North Korea’s TraderTraitor, traced the transfers from Binance’s wallets to the attacker addresses on all ten chains, and labeled those addresses.

Learn More
Product Releases

What we shipped across the platform

TRM customers can work alerts from Claude Desktop or an automated agent, run Co-Case Agent sessions in parallel, and alert on behavioral Signatures in Transaction Monitoring and Wallet Screening.

TRM Transaction Monitoring

Alert on how a counterparty moves funds

Create alert rules using Signatures to detect suspicious patterns beyond a single transaction

TRM Wallet Screening

See how an address moves funds and where its user is

Behavioral Signatures and observed country are included in Wallet Screening results

Behavioral Signatures in Wallet Screening
Wallet Screening results now include behavioral Signatures detected on a screened address: Cross-chain Swap, Demix, Web Flow, Mass Registration, CoinJoin Transaction, Peeling Chain, and Pass-through Chain. The risk score shows how exposed an address is, and Signatures show how it moves funds.
Observed country in Wallet Screening responses
Wallet Screening responses can now include an observedCountry field listing the ISO country codes where an address’s user is likely located, based on TRM’s proprietary intelligence.
TRM MCP

Work alerts from Claude Desktop or an automated agent

New Claude Desktop connector, alert review from the MCP, and machine-to-machine access

Access TRM MCP as a custom connector in Claude Desktop
Add TRM MCP as a custom connector in Claude Desktop to investigate Transaction Monitoring alerts and review Wallet Screening results without a command line. Reach out to your account team for access to TRM MCP.
Learn More
Move Transaction Monitoring alerts to “in review” from TRM MCP
The TRM MCP server can now move a Transaction Monitoring alert into the in review state, in addition to closing and reopening alerts. Each change goes through the standard human-confirmation step and is recorded in the audit trail.
Machine-to-machine access to TRM MCP
AI agents and automated workflows can now connect to the TRM MCP without a human login, so scheduled and backend agents can investigate alerts, review Wallet Screening results, and pull exposure context. Each credential is tied to one organization, rate-limited, and audited. Reach out to your account team for access.
TRM Forensics

Investigate in parallel and trace across chains in real time

Multiple Co-Case Agent sessions and real-time cross-chain swap matching

Run multiple Co-Case Agent sessions in Graph Visualizer
Agent Sessions in Graph Visualizer lets investigators run Co-Case Agent sessions in parallel. Each session has its own graph and its own run, and keeps running in the background when you switch to another one.
Learn More
36
EVM chains with real-time cross-chain swap matching
Cross-chain swaps across 36 EVM chains and 21 bridges now match in real time, enabling investigators to trace faster when funds cross chains.
Blockchain Intelligence Releases

Coverage that keeps pace with the threat

TRM labeled the attacker addresses in the largest crypto theft on record, added millions of address and liquidity pool labels, and labeled sanctions exposure as OFAC, FinCEN, and the UK took action.

Counter Narcotics

More suppliers and darknet markets now visible

Additional drug-precursor manufacturers and more than 10 million new darknet marketplace address labels

80+
Chinese drug-precursor manufacturers identified
TRM identified more than 80 additional Chinese drug-precursor manufacturers since the last release, following the 68 added in August. These suppliers provide the chemical inputs for fentanyl and other synthetic opioids. Each one now has an entity profile in TRM. Investigators can look up a precursor supplier and see it identified as one, which gives them a starting point for tracing fentanyl networks back to their chemical sources.
Learn More
10M+
Address labels added across three darknet marketplaces
TRM added more than 10 million address labels across three darknet marketplaces on Bitcoin and Litecoin. Investigators and compliance teams can see more of the flows that reach darknet marketplaces and the vendors that sell on them.
Facilitation & Money Laundering

Tracing the largest crypto theft on record

Attacker addresses labeled across ten blockchains, plus millions more TRON addresses and DEX liquidity pools attributed

+3.6M
TRON addresses attributed across roughly 1,250 entities
TRM attributed about 3.6 million more TRON addresses across roughly 1,250 entities. Funds that move through these services on TRON now trace to a named entity.
+6M
Decentralized exchange liquidity pools labeled this month
TRM labeled about 6 million more decentralized exchange liquidity pools across EVM chains this month. Investigators and compliance teams can see when funds move through a decentralized exchange pool.
Sanctions

Screen for exposure to three new sanctions actions

OFAC and FinCEN action on the A7 Network, UK designations of three exchanges, and an OFAC action against a Hamas financing network

3
UK designates Cryptomus, Heleket, and TokenSpot, and TRM labels all three as sanctions
On October 8, the UK Foreign, Commonwealth and Development Office (FCDO) designated three cryptocurrency exchanges, Cryptomus, Heleket, and TokenSpot, in a Russia sanctions package. The designation listed no cryptocurrency addresses. All TRM attribution associated with the three entities is now labeled as sanctions, and TRM adds addresses as it finds them. Compliance teams screening against UK sanctions can see exposure to these exchanges flagged as sanctions without waiting for a published address list.
Learn More
$2M+
Hamas financing network designated by OFAC, with the primary target’s address already attributed in TRM
On October 2, OFAC designated three individuals and two entities in a network that used sham charities and cryptocurrency to raise funds for Hamas. OFAC states the network collected more than $2 million between 2020 and 2026. The designation listed no cryptocurrency addresses. TRM had already attributed an address to the primary target, and all attribution associated with the primary target is now labeled as sanctions. Compliance teams can screen for exposure to this network under the sanctions category, and investigators can follow funds sent to the attributed address.
Learn More
Related Resources

Keep exploring