A coordinated investigation between the United States, Germany and Brazil has led to the takedown of a longstanding global child sexual abuse material (CSAM) distribution network operating on the dark web. The investigation resulted in the seizure of multiple commercial websites and the arrest of the alleged administrator — a Peruvian national residing in Brazil — following successful tracing of their cryptocurrency transactions.
The alleged administrator was arrested by the Brazilian Federal Police (BFP) on September 2, and the BFP found CSAM content in his possession during the execution of the search warrant. Also in September, German authorities seized the servers hosting the two illicit websites – Videos Yad and Videos Sebick — and at the time of writing, the sites are closed and display official seizure notices from the Bavarian State Criminal Police Office.
Intensive on-chain analysis enabled TRM investigators, in support of Brazilian police, to link the alleged administrator to this CSAM network.
The alleged administrator used different websites under multiple pseudonyms, employing cryptocurrency mixers, numerous cryptocurrency wallets, and intermediary accounts to move the funds in an attempt to evade detection.
Deep on-chain analysis thwarted these obfuscation efforts, showing that the sites had clear commonalities, including a shared blockchain infrastructure and other similar characteristics. The necessity of this on-chain information to unmask the alleged administrator underscores the investigative value of TRM’s database of financial intelligence related to CSAM, which enabled the identification after years of uninterrupted activity.
Two of the platforms controlled by the now-defunct network had registered more than 350,000 users worldwide. Most users accessed only free material, while the paid sections contained 21,324 videos totaling about 660 hours of CSAM content, viewed nearly 900,000 times. The free samples served both to attract new users and to demonstrate that parts of the infrastructure were used as hosting environments. Some of these sites charged as little as USD 10 for membership. The scale of this activity reflects the reach of the network and the harm it undoubtedly caused. TRM continues to monitor possibly linked sites in the event parts of this network reemerge.
The dissolution of this network is evidence of the determination of investigators and authorities to stop the exploitation of children. Public-private partnerships and international coordination enabled authorities to overcome numerous technical and jurisdictional challenges.
TRM Labs is proud to support Brazilian and German authorities alongside other US and international law enforcement partners in their fight against online child exploitation.
Frequently Asked Questions
What is CSAM and why is it a focus for TRM?
Child sexual abuse material (CSAM) refers to any content that depicts the sexual abuse or exploitation of children. TRM Labs supports investigations that target CSAM networks by tracing illicit financial flows and identifying those who profit from these crimes.
How was cryptocurrency used by the Videos Yad and Videos Sebick network?
The alleged administrator of the network used cryptocurrency wallets, mixers, and intermediary accounts to obscure payments. However, TRM’s blockchain intelligence tools were able to trace these transactions and identify links across the network.
What role did TRM Labs play in the investigation into Videos Yad and Videos Sebick?
TRM investigators supported Brazilian Federal Police by conducting deep on-chain analysis. This analysis was key to identifying shared blockchain infrastructure across multiple CSAM websites and linking them to a single administrator.
What were the results of the CSAM network investigation?
Authorities arrested the alleged administrator in Brazil and seized infrastructure used to distribute CSAM. Two websites had more than 350,000 registered users and hosted thousands of illicit videos before being taken offline.
How does TRM help stop the reemergence of sites linked to Videos Yad and Videos Sebick?
TRM continues to monitor activity on-chain for potential signs that related infrastructure or tactics are being reused. Our investigators use behavioral intelligence and historical data to surface potential connections early.
Can blockchain intelligence really help combat child exploitation?
Yes. Blockchain records are permanent and traceable. With the right tools, investigators can uncover illicit activity that might otherwise remain hidden — even if actors use obfuscation tactics like mixers or cross-chain transfers.
Related posts
Access our coverage of TRON, Solana and 23 other blockchains
Fill out the form to speak with our team about investigative professional services.
