Product & Blockchain Intelligence Releases · August 2026

More Intelligence for Your Agents.Deeper Attribution Across Every Category.

New releases across the TRM platform and blockchain intelligence — behavioral rules and TRM MCP enhancements, platform-wide dark mode, Co-Case Agent court-ready reports, new chain coverage, and expanded attribution across sanctions, narcotics, and fraud

$0
Traced through a newly designated Iran-linked exchange
+$0
New fentanyl-linked attribution
+$0
New scam-activity leads
+$0
Newly detected A7 sanctions-evasion volume
Scroll to explore
NEW Behavioral rules in Transaction Monitoring
NEW TRM MCP: Wallet Screening & behavioral alerts
NEW Platform-wide dark mode
NEW Co-Case Agent court-ready reports
NEW Seed Analysis adds Polkadot, NEAR, Injective & Bittensor
NEW Midnight (NIGHT) chain support
+$6.3B traced through a newly designated Iran-linked exchange
+$349M new fentanyl-linked attribution
+$215M new darknet-market visibility
+$281M new scam-activity leads
+$2B A7 sanctions-evasion network
NEW TRM Academy: 20 Intel Insights modules & updated TRM-ACI
NEW Behavioral rules in Transaction Monitoring
NEW TRM MCP: Wallet Screening & behavioral alerts
NEW Platform-wide dark mode
NEW Co-Case Agent court-ready reports
NEW Seed Analysis adds Polkadot, NEAR, Injective & Bittensor
NEW Midnight (NIGHT) chain support
+$6.3B traced through a newly designated Iran-linked exchange
+$349M new fentanyl-linked attribution
+$215M new darknet-market visibility
+$281M new scam-activity leads
+$2B A7 sanctions-evasion network
NEW TRM Academy: 20 Intel Insights modules & updated TRM-ACI
This Month’s Highlights

The two releases you should know about

Product

Your AI agents now work Wallet Screening results and behavioral alerts

TRM MCP now connects to Wallet Screening, so your agents can analyze screening results — risk indicators, how risk changed over time, ownership attribution, and full indirect exposure paths. It also surfaces behavioral alerts alongside transfer alerts, so an agent can pull context and evidence, then dismiss, escalate, or reopen them without leaving the conversation.

Blockchain Intelligence

A cross-chain swap service with almost no public footprint, now traceable

TRM attributed a cross-chain swap service that had almost no public footprint, with coverage now spanning $130.6M in volume through its main Ethereum contract and its Bitcoin deposit infrastructure. Because the service sits behind several mainstream wallet and swap interfaces, funds routed through it weren’t obviously identifiable as having used it — and can now be followed end to end.

Product Releases

What we shipped across the platform

TRM’s customers can do more by connecting their agents to Wallet Screening results and behavioral alerts, catching risk earlier with new behavioral rules in Transaction Monitoring, and investigating faster across new chains, all while using TRM’s new dark mode.

Transaction Monitoring

Detect risk across transactions

Behavioral rules flag aggregate activity above a threshold over a rolling window

New Rule Type
Behavioral rules in TRM Transaction Monitoring
GA
Behavioral rules are a new rule type in Transaction Monitoring that flag accounts on aggregate activity patterns over a 24-hour period, rather than one transaction at a time. For example, trigger an alert when over $10,000 goes to a gambling service in a 24-hour period.
For compliance teams:
  • Alert on aggregate activity to a risk category or entity over a rolling window versus monitoring individual transfers
  • Create velocity-based rules for deposits and/or withdrawals that exceed a threshold in a 24-hour period (not tied to a risk or entity category)
TRM MCP

Your agents work Wallet Screening and behavioral alerts

TRM MCP connects to Wallet Screening and surfaces behavioral alerts — now available to EU customers

Enhanced
TRM MCP: Wallet Screening results and behavioral alerts
TRM MCP now connects to Wallet Screening, so your agents can analyze and investigate screening results — and it surfaces behavioral alerts alongside transfer alerts, so an agent can pull full context and evidence, then dismiss, escalate, or reopen them without leaving the conversation.
For compliance teams:
  • View recent wallet screening results and drill into the full details for a screened address to analyze what risk indicators triggered and why
  • See how risk has changed over time for a given screened address
  • Understand ownership attribution sources
  • Investigate the onchain transfers behind counterparty risk exposure
  • View all indirect exposure paths for a screened address and trace the intermediary hops connecting the address to a risk category or entity
  • Triage and disposition behavioral alerts
Co-Case Agent™

Custom entity analysis and court-ready reports

Analyze the entities you build, and export editable investigation reports

Enhanced
Analyze your custom entities in Graph Visualizer
Ask Co-Case Agent to analyze any custom entities you build in Graph Visualizer, like its activity, risk, counterparties, transfers, and member addresses.
New
Generate court-ready investigation reports
Ask Co-Case Agent to generate an editable report from any graph investigation. Every export writes an audit-log entry with the user, environment, and time.
Seed Analysis

More chains from a seed phrase

Seed Analysis now extends recovery from seed phrases and private keys to four additional blockchains

New Chains
New blockchain support in Seed Analysis
Seed Analysis adds support for Polkadot, NEAR, Injective, and Bittensor, extending investigations from seed phrases and private keys to four additional blockchains.
Learn More
For investigators:
  • Derive addresses and detect on-chain activity on Polkadot, NEAR, Injective, and Bittensor
  • Extends recovery from seed phrases and private keys to four more chains
  • New chains are checked automatically alongside existing supported chains
Platform & Workflow

A cleaner platform to work in and administer

Platform-wide dark mode, a streamlined settings experience, audit-log export, case sorting, and recurring counterparty detection

New
Dark mode across the platform
The platform now has a full dark theme, a lower-light option for long investigation sessions. Dark mode covers investigation modules (Graph Visualizer, Triage, Cases, Deconflict), compliance modules (Transaction Monitoring, Entity Monitoring, Asset Monitoring, Wallet Screening, Entity Screening), and shared UI throughout. Toggle with the sun/moon in the header, or set Light, Dark, or System in Account Profile.
New
New user and environment management interface
A streamlined interface for environment and account settings, with simplified role types — Admins manage users and settings, Members access the products they hold a license for. New user groups let you segment by region, team, or business line and delegate membership management to group admins.
New
CSV export for audit logs
Admins can now download the audit log as a CSV at the organization, environment, and group level. The export respects the filters applied to the table, and every download is itself recorded in the audit log.
New
Sort cases by last-updated in Case Management
Case Management now shows each case’s last-updated time in the Cases table, My Work, and Case Properties, and lets investigators sort by it. The timestamp updates on any shared case activity — notes, sharing changes, or edits — so teams can see what changed most recently without opening each case.
New
Recurring counterparty detection for cross-chain swaps
Investigators can now see which counterparty addresses recur across an address’s cross-chain swaps, directly in the Behavioral Signature side panel — and plot a recurring counterparty as a single node instead of tracing through dozens or hundreds of individual swap instances one at a time.
For investigators:
  • See recurring counterparties in the Behavioral Signature side panel, ranked by swap count
  • Plot a recurring counterparty as a single node instead of tracing each swap instance
  • Currently covers cross-chain swaps
TRM Academy

New courses, threat modules, and a rebuilt certification

Self-paced training across typologies, AI fundamentals, and the updated Advanced Crypto Investigator certification

New
20
New Intel Insights modules
Twenty short, self-paced lessons on how a single typology moves money on-chain — and what an investigator can and cannot conclude from it.
Topics span:
  • Laundering & infrastructure — mixers, stablecoin laundering, cross-chain bridges, ransomware
  • Fraud & scams — pig butchering, scam compounds, AI-enabled crime
  • Cyber & theft — hacks and exploits, drainer malware
  • Sanctions & method — A7 Network sanctions evasion, on-chain attribution methods
New Course
AI Fundamentals course
A self-paced introduction to how AI actually works — from models and inference, prompting, capabilities and limits, and risk and oversight — ending in an applied assessment. This course is product-agnostic and requires no TRM platform access.
Updated Certification
Updated TRM Advanced Crypto Investigator (TRM-ACI)
The TRM-ACI certification has been rebuilt around how funds move today: account abstraction and the Pectra upgrade (including identifying the true sender behind a paymaster-funded transaction), a new NFT section, and a new bridges-and-cross-chain-swaps section, with Ethereum tracing logic applied across TRON and Solana.
Blockchain Intelligence Releases

New attribution, deeper coverage, faster designations

TRM customers keep pace with fast-moving enforcement — screening and tracing newly designated entities as sanctions land — while coverage deepens across narcotics, laundering infrastructure, and fraud.

Counter Narcotics

A third straight month near $200M on the drug economy

New darknet-market visibility plus a large retrospective fentanyl attribution

+ Expanded
+$215M
New darknet-market visibility
TRM added roughly $215M in newly visible narcotics proceeds — a 21% increase and the third consecutive month near $200M. New service heuristics covering marketplace deposit and escrow infrastructure contributed alongside deeper coverage of marketplaces already tracked; Western darknet markets alone added roughly $54M, up from about $12M the prior month.
+ New Attribution
+$349M
New fentanyl-linked attribution across the supply chain
TRM added $349M in newly attributed fentanyl-linked activity, driven almost entirely by retrospective attribution of laundering infrastructure that carries years of prior transaction history — so more of the fentanyl economy is traceable across the full history of the networks moving proceeds.
Facilitation & Money Laundering

Deeper coverage of the rails that move illicit funds

Daily attributed illicit volume up 40%, plus new cross-chain swap and payment-service coverage

+ Expanded
+40%
Daily attributed illicit volume up 40%
TRM increased daily attributed illicit volume by 40% month-over-month, reflecting both new entity attribution and deeper coverage of services already tracked.
For compliance teams:
  • A larger share of illicit flow is visible and attributable on any given day
  • Raises the odds suspicious activity surfaces during screening and monitoring
  • Less reconstruction after the fact, more caught in real time
+ New Attribution
$130.6M
New cross-chain swap service attributed
TRM attributed a cross-chain swap service with almost no public footprint, now covering $130.6M in volume through its main Ethereum contract along with its Bitcoin deposit infrastructure. The service sits behind several mainstream wallet and swap interfaces, so funds routed through it were not obviously identifiable as having used it.
+ Expanded
+103K
New payment-service deposit-address coverage
A new deposit-address heuristic for a payment service reached production, adding roughly 103,000 previously unlabeled deposit addresses. Deposits routed through the service are now attributable rather than appearing unlabeled.
Fraud

More scam-linked funds identified and traced

A record month of scam leads, plus published analysis of the year’s largest hardware-wallet exploit

+ New Leads
+$281M
New scam-activity leads
TRM added $281M in new scam-activity leads, expanding the pool of scam-linked funds that are identified and actionable.
For investigators and compliance teams:
  • $281M in new scam-linked funds identified and actionable
  • A larger pool of traceable leads to screen exposure against
  • Fresh coverage of the networks moving scam proceeds
Published Analysis
$116M
Analysis of the $116M Coldcard exploit
TRM published analysis of the largest hardware-wallet exploit of 2026, tracing $116M drained from Coldcard wallets — documenting the year’s largest hardware-wallet compromise and supporting exposure checks against the stolen funds.
Learn More
Published Research
H1 2026
H1 2026 hack analysis published
TRM published its H1 2026 hack analysis, finding that the number of crypto hacks reached a record high while total losses fell below $1B for the half — a threat shifting toward more frequent attacks with smaller average losses.
Learn More
Sanctions

Keeping pace with US enforcement

$6.3B traced through a newly designated Iran-linked exchange, plus A7, ISKP, and cybercrime-enabler coverage

External Validation
$6.3B
$6.3B traced through a newly designated Iran-linked exchange
OFAC designated Shelbit, an Iran-linked exchange, on 7 August. TRM published analysis tracing more than $6.3B in blockchain flows through Shelbit’s infrastructure between May 2024 and March 2026.
Learn More
For customers with Iran exposure:
  • Exposure to a newly designated exchange can be screened and traced immediately
  • Backed by 23 months of flow analysis, May 2024 through March 2026
  • On-chain context published alongside the designation
+ Expanded
+$2B
Expanded attribution of the A7 sanctions-evasion network
TRM added $2B in newly detected volume through A7, the Russia-linked sanctions-evasion network — giving customers roughly $2B more A7-linked flow to screen and trace that was previously not detectable.
External Validation
ISKP
Attribution behind OFAC’s ISKP terrorist-financing action
OFAC sanctioned 134 cryptocurrency addresses tied to roughly $2M in ISKP terrorist financing. TRM attributed the designated infrastructure and published analysis of how the group raises, moves, and conceals funds — building on tracking of the group’s crypto donations since 2022.
New Coverage
FirstVPN
New coverage of sanctioned cybercrime infrastructure
OFAC designated FirstVPN, a VPN provider that sold anonymizing infrastructure to cybercrime groups, along with a sanctioned individual supplying malware-obfuscation services. TRM covers the 20 newly listed addresses across eight blockchains — Bitcoin, Ethereum, Litecoin, Tron, Dogecoin, Dash, Zcash, and Solana.
Chain Releases

New blockchain support: Midnight

Standard support for Midnight (NIGHT) across screening, monitoring, and tracing

New Chain
New blockchain support: Midnight (NIGHT)
TRM added Standard support for Midnight (NIGHT), so customers can screen, monitor, and investigate activity across the network.
Support includes:
Related Resources

Keep exploring

Product & Blockchain Intelligence Releases - July 2026
TRM MCP Day 1: Resolve Alerts with Your AI Agent
Blockchain Intelligence Releases - May 2026