Identify the people behind the abuse.
Connect case intake, financial activity, attribution, and lawful identity records to identify offenders and support action that protects children.
Problem
The financial signal is narrow and fleeting.
A payment can expose the network.
Child exploitation often operates in hidden online spaces. When money changes hands, the payment can connect an address, account, service, or transaction path to the people and infrastructure behind the abuse.
Operators rotate addresses and sites.
Wallet and infrastructure changes can break a direct link unless attribution follows the operation through each move.
New material defeats known-content matching.
Newly generated material has no existing hash, which makes behavior and payment patterns more important investigative signals.
130%
Observed transaction-volume increase
Increase in crypto transaction volume linked to TRM-attributed child sexual abuse material (CSAM) addresses between 2022 and 2024.
2 min
Observed payment frequency
At least one transaction reached a TRM-attributed CSAM address every two minutes over the two years to March 2025.
What is Ardence?
Ardence is an AI investigation platform built for all-source intelligence. For child exploitation investigations, teams can connect referrals, identities, online infrastructure, and financial evidence in one source-linked case.
How it works
Turn a referral into an actionable case.
Triage
Start with the report. Identify time-sensitive leads about suspected perpetrators and indicators of immediate risk to children. Pull the usable identifiers into one case before the trail changes.
- Preserve the referral, reported conduct, victim context, and timeline
- Extract accounts, handles, domains, payment addresses, and other identifiers
- Prioritize cases using victim risk, active distribution, and time-sensitive leads
Connect
Compare portal records, accounts, infrastructure, and payment activity. Shared signals can show when separate cases are part of the same operation.
- Link reports that share accounts, domains, hosting, or communication channels
- Follow rotated payment addresses to common transaction behavior and consolidation points
- Connect related cases using shared accounts, infrastructure, and payment activity
Identify
Follow the financial and infrastructure trail to the services that may hold identity records. Combine those leads with evidence obtained through lawful process.
- Trace payments to receiving entities and service accounts
- Identify the providers positioned to respond to lawful requests
- Connect service records, account details, and case evidence to the suspected operator
Act
Keep the referral, attribution basis, transaction records, and reasoning together. The team needs a reviewable record before it seeks records, makes an arrest, or hands the case to prosecutors.
- Tie each finding to its original source and review history
- Prepare the transaction and infrastructure record for lawful process
- Organize the evidence for investigative review and prosecution
Triage
Start with the report. Identify time-sensitive leads about suspected perpetrators and indicators of immediate risk to children. Pull the usable identifiers into one case before the trail changes.
- Preserve the referral, reported conduct, victim context, and timeline
- Extract accounts, handles, domains, payment addresses, and other identifiers
- Prioritize cases using victim risk, active distribution, and time-sensitive leads
Connect
Compare portal records, accounts, infrastructure, and payment activity. Shared signals can show when separate cases are part of the same operation.
- Link reports that share accounts, domains, hosting, or communication channels
- Follow rotated payment addresses to common transaction behavior and consolidation points
- Connect related cases using shared accounts, infrastructure, and payment activity
Identify
Follow the financial and infrastructure trail to the services that may hold identity records. Combine those leads with evidence obtained through lawful process.
- Trace payments to receiving entities and service accounts
- Identify the providers positioned to respond to lawful requests
- Connect service records, account details, and case evidence to the suspected operator
Act
Keep the referral, attribution basis, transaction records, and reasoning together. The team needs a reviewable record before it seeks records, makes an arrest, or hands the case to prosecutors.
- Tie each finding to its original source and review history
- Prepare the transaction and infrastructure record for lawful process
- Organize the evidence for investigative review and prosecution
Proof
Child exploitation investigations.
Shared payment infrastructure led investigators to the operator.
Police of the Czech Republic used TRM Forensics and TRM analyst support to follow rotating wallets and map cash-out infrastructure. The operator was prosecuted and imprisoned, and investigators referred hundreds of consumers to Europol AP Twins.
Financial tracing supported a cross-border platform takedown.
TRM investigators supported Brazilian police by linking an alleged administrator to the network. Brazilian authorities arrested the alleged administrator, and German authorities seized servers.
Payment traces helped investigators identify suspected CSAM purchasers.
TRM supported California law enforcement in tracing transactions connected to known CSAM sellers. In a separate Indianapolis case, blockchain tracing, compliance reporting, and exchange records helped establish the evidentiary path for a search warrant and arrest.
Intelligence
Intelligence built for child exploitation investigations.
TRM proprietary intelligence
Connect the payment activity to the case.
Link receiving addresses, wallet rotation, consolidation, services, and known CSAM entities while keeping the attribution basis available for review.
Case and identity context
Connect intelligence on the people behind the abuse.
Connect online identities, accounts, and infrastructure to investigate suspected perpetrators and their networks.
All-source intelligence
Dozens of data partners. One investigation platform.
Ardence brings intelligence from TRM and specialized data providers into one investigation under a single Ardence contract.¹
Use Ardence to analyse online identities, domains and infrastructure alongside lawfully obtained referrals and case records. Commercial partner intelligence and open-source information help teams identify connections beyond the initial report, subject to each source’s permitted-use and disclosure restrictions.
¹ Provider availability varies by customer and jurisdiction. Supplemental terms may apply.
Services
Training and specialist support for child exploitation investigators.
- Learn more
Investigative support
Work with TRM specialists to connect referrals, online identifiers, and financial evidence, identify investigative leads, and prepare findings for action that protects children.
- Learn more
CSAM Investigator Journey
A free, self-paced learning path for vetted investigators and prosecutors working these cases.
- Request the guide
ICAC Investigators Quick Reference Guide
Request practical guidance for child exploitation investigations. Available only to verified law enforcement.
Community
Build shared skill around the evidence.
- Learn more
Resolve: CSAM & Exploitation
Get hands-on training and connect with fellow investigators at Resolve: CSAM & Exploitation, a dedicated mission track focused on the challenges your team faces.
- Learn more (opens in a new tab)
Ask The Investigator: CSAM & Crypto
A TRM specialist explains how cryptocurrency appears in child-exploitation investigations.
Disruption Sprints
Recurring events that bring investigators and partners together to work live cases and carry out coordinated disruptions against child exploitation networks.
Questions
FAQ
Start with a complaint, tip, or report. Add whatever identifiers are available, including usernames, email addresses, domains, IP addresses, phone numbers, accounts, wallet addresses, and transactions. Ardence helps connect those signals, preserve their source, and identify the next investigative step.
Changing a wallet, username, domain, or account does not necessarily break the lead. Ardence can connect new and prior identifiers through shared infrastructure, behavior, attribution, and source-linked evidence. When cryptocurrency is involved, Forensics adds wallet clustering and transaction context. An investigator reviews each connection before using it.
Ardence brings blockchain intelligence from Forensics into a broader investigation alongside other evidence. Forensics provides a dedicated platform for deeper crypto tracing and analysis.
TRM helps participating teams build a source-linked understanding of the entities, infrastructure, transactions, and findings relevant to their investigation, using information each team is permitted to access and use. That record can support referrals and coordination across agencies and jurisdictions, and help investigators prepare evidence for arrests, searches, seizures, or other action within their authority.
Insights
Combatting child exploitation.
The evolving CSAM landscape
Insights on paid marketplaces, address rotation, AI-generated material, and the return to dark-web infrastructure.
Using blockchain intelligence in CSAM cases
How a case can move from a report and payment trace to lawful identity records and an affidavit.
The Rise of AI-Enabled Crime
Insights on how AI changes criminal activity, including the detection problem created by newly generated material.
