Law Enforcement Using Blockchain Intelligence to Disrupt CSAM Networks

Key takeaways

• The Carlsbad arrest highlights the disturbing emergence of cases in which trusted community figures, including educators, are allegedly using cryptocurrency to procure child sexual abuse material, and the growing role of blockchain intelligence in bringing these offenders to justice.
• When cryptocurrency is used as a payment rail in CSAM-related commerce, investigators can often begin with financial traces, follow transactions back from known seller infrastructure, and build the evidentiary foundation needed for search warrants, device seizures, and arrests.
• The Wachner probable cause affidavit provides a clear example of how blockchain tracing, combined with compliance reporting and exchange records, can help law enforcement identify alleged CSAM purchasers and accelerate investigative disruptions.

‍

{{horizontal-line}}

‍

On January 28, 2026, California Attorney General Rob Bonta announced the arrest of a teacher at La Costa Canyon High School in Carlsbad, California, on charges related to the possession and attempted possession of child sexual abuse material (CSAM). According to the California Department of Justice, the defendant attempted to purchase CSAM online, which led to a search warrant, seizure of electronic devices, and multiple criminal counts. The Attorney General’s Office emphasized the importance of strong interagency partnerships in keeping communities safe.

TRM Labs is proud to support the California Department of Justice and its law enforcement partners in this investigation and in their ongoing efforts to disrupt the production, distribution, and financing of child exploitation material. This investigation, which included tracing blockchain transactions to and from known CSAM sellers, is a powerful example of law enforcement leveraging blockchain intelligence to identify and disrupt individuals engaged in the purchase, sale, and distribution of CSAM.

Why blockchain intelligence matters In CSAM investigations

Historically, CSAM investigations are among the most difficult and resource-intensive cases in law enforcement. They often require investigators to infiltrate encrypted forums, rely on confidential sources, and spend extensive time and resources identifying offenders and safeguarding victims. Blockchain intelligence can change the starting point and accelerate the identification of perpetrators. When cryptocurrency is used as a payment rail, investigators can begin with financial traces, build an evidentiary path from known seller infrastructure to suspected purchasers, and use that financial trail to support lawful process, including search warrants and device seizures.

The Carlsbad arrest is the second such case in just the last few weeks involving an educator allegedly using cryptocurrency to procure CSAM online. Earlier this month, Indianapolis Police arrested Julian Wachner on similar allegations. The probable cause affidavit filed in the Wachner matter provides a clear, step-by-step blueprint for how blockchain tracing is operationalized in CSAM investigations when digital assets are used.

How tracing works in practice: A probable cause framework

The entry point is frequently a compliance-driven signal rather than a purely undercover discovery. In the Wachner matter, the investigation began with a CyberTip, triggered by a virtual asset service provider report indicating suspected use of cryptocurrency to purchase CSAM. That matters because it underscores a key reality: regulated platforms, when they detect patterns or exposure consistent with CSAM-related typologies, can generate actionable leads that allow investigators to move quickly.

From there, the tracing flow is typically built in layers.

First, investigators learn the beneficial person behind a cryptocurrency transaction through an exchange’s records and ‘Know-Your-Customer’ details. That provides a lawful anchor for the analysis: the suspect is not identified by a wallet address alone, but through records tying account activity to an individual.

Next, investigators identify the on-chain transfers from the subject’s account to the illicit CSAM seller’s address. In the Wachner affidavit, investigators describe transfers from a custodial exchange, across multiple intermediary hops, and ultimately to a CSAM seller’s address:

The affidavit describes how TRM documented the CSAM’s seller’s address as CSAM; in this case, backed up by screenshots, on-chain patterns, and transactions consistent with obfuscation techniques. 

What this means for investigators and for the broader ecosystem

These cases illustrate a growing intersection of child exploitation investigations and financial technology. For law enforcement, the practical implication is that blockchain intelligence can help identify suspects, map networks, and accelerate investigative disruptions more efficiently, particularly when investigators already have exposure points to known seller infrastructure. For the financial and compliance ecosystem, the implication is that platform monitoring and alerting can serve as a critical early warning system, surfacing activity that may otherwise remain buried behind encrypted channels.

Cryptocurrency as a common thread across cases

While the two arrests occurred in different jurisdictions and involved different circumstances, the shared thread described by authorities is the use of cryptocurrency as a payment method to access CSAM online.

That overlap matters for two reasons. First, it suggests certain seller ecosystems have normalized crypto as a payment mechanism, sometimes relying on token-based purchasing and deposit-address structures. Second, it shows why the crypto angle is not simply that digital assets can be used in crimes. It is that the public, immutable nature of many blockchains can produce investigative advantages when paired with compliance monitoring, lawful process, and expert analysis.

Broader implications

Officials emphasize that educators and other trusted community figures are not immune from scrutiny when evidence points to online abuse material, and that cryptocurrency is not beyond the reach of law enforcement. In cases where digital assets are used, tracing and analytics can help connect the dots between pseudonymous transactions and real-world actors, supporting interagency investigations and enabling timely action to disrupt exploitation networks.

‍

{{horizontal-line}}

Frequently asked questions (FAQs)

1. Why are cryptocurrency payments appearing in CSAM cases involving teachers

Some CSAM sellers use digital assets because they believe crypto provides anonymity, and recent arrests suggest that even trusted community figures, including educators, have allegedly exploited these payment methods to access abuse material online.

2. How does blockchain intelligence help law enforcement in CSAM investigations

Blockchain intelligence allows investigators to trace immutable transactions between suspected purchasers and known CSAM seller infrastructure, map networks, identify patterns, and generate financial evidence that supports lawful process.

3. What role do exchanges and compliance alerts play

Regulated platforms can generate CyberTips or suspicious activity reports when CSAM-related typologies are detected, providing investigators an early entry point and tying blockchain activity to real-world identities through KYC records.

4. Why are these investigations historically so difficult

CSAM investigations often involve encrypted forums, anonymous networks, and horrific content, requiring intensive investigative resources. Blockchain tracing can help shift the starting point from hidden communications to financial evidence.

5. What does the Wachner affidavit illustrate

The Wachner probable cause affidavit provides a real-world blueprint of how investigators traced funds from an exchange through intermediary hops to addresses linked to CSAM sellers, using blockchain analytics to support attribution, warrants, and enforcement action.

6. What broader trend do the Carlsbad and Wachner cases reflect

Together, these cases highlight both the continued use of cryptocurrency in facilitating CSAM-related commerce and the increasing ability of law enforcement, using blockchain intelligence and interagency collaboration, to identify perpetrators and disrupt exploitation networks.