December 2025 Product Highlights: Broader Coverage, Benchmarking Risk

Key takeaways

• Chainabuse now connects victim reports across jurisdictions. The new feature automatically links related reports, allowing investigators to turn single tips into coordinated, multi-victim cases.
• Risk benchmarking brings immediate context to investigations. A new comparison view lets teams measure entity risk against industry standards like trusted and high-risk exchanges.
• Legal process exports accelerate the path to action. Subpoena-ready CSVs can now be generated directly from Graph Visualizer, eliminating manual formatting delays.
• Real-time data and new chains expand operational visibility. Support for dYdX, X Layer, and real-time Solana ingestion ensures coverage of fast-moving assets and high-volume networks

{{horizontal-line}}

As the year draws to a close, the complexity of crypto-related crime continues to demand faster, more collaborative tools for investigators. This month’s releases focus on connecting the dots across jurisdictions, bringing immediate context to risk assessments, and accelerating the time from analysis to legal action. From instant victim report correlation to real-time Solana data, we are equipping teams to close cases with greater speed and confidence in 2026.

View related victim reports across the same jurisdiction

Illicit actors often target victims across multiple regions, leaving investigators with fragmented pieces of a larger puzzle. To bridge these gaps, Chainabuse now automatically identifies victim reports in your jurisdiction that are linked by counterparty or indirect exposure.

This update transforms a single tip into a potential multi-victim case instantly. Instead of manually stitching together unconnected reports, investigators can now see the broader scope of a scam or fraud ring immediately. By identifying these hidden connections, agencies can consolidate evidence, coordinate resources, and build stronger cases against repeat offenders who might otherwise fly under the radar.

Benchmarking entity risk for better decision-making

Understanding an entity's risk profile often requires more than just a raw score — it requires comparison. A new risk benchmarking view on entity pages now allows compliance teams and investigators to measure an entity’s activity against relevant peers.

Users can view daily counterparty risk as a percentage of total volume alongside key benchmarks, including "high risk exchanges" (non-KYC services with elevated risk) and "trusted exchanges" (established industry players). By visualizing how a subject compares to these standards — or to other custom entities — analysts can distinguish between typical market behavior and true outliers, enabling more defensible and context-rich risk decisions.

Accelerating legal process with subpoena-ready exports

Turning on-chain analysis into courtroom-ready evidence has traditionally been a time-consuming process of manual reformatting. With the new "legal process" export in Graph Visualizer, investigators can now generate subpoena-ready CSV files directly from their investigation graph.

These structured exports automatically format deposit and withdrawal data for Virtual Asset Service Providers (VASPs), ensuring accuracy and eliminating hours of administrative work. This allows investigators to move immediately from tracing funds to issuing legal requests, keeping the momentum on critical cases.

Expanding coverage with dYdx, X Layer, and Solana

Staying ahead of crypto crime means keeping pace with the newest and fastest ecosystems. TRM’s industry-leading blockchain coverage has expanded to include dYdX and X Layer, ensuring visibility into these high-volume ecosystems and Layer 2 networks.

Additionally, our coverage of Solana has moved to real-time ingestion. Transfers and transactions now appear in Block Explorer and Graph Visualizer within approximately one minute of block creation. This shift from hourly to real-time updates is critical for tracking fast-moving assets and intervening before funds can be cashed out or bridged.

Deepening attribution and forensic capabilities

This month’s updates also introduce powerful new heuristics to identify wallet owners even when traditional signals are missing:

• Bitcoin unhosted wallet clusters: Identifying wallets on Bitcoin often relies on co-spend heuristics, which aren't always present. New proprietary wallet intelligence allows users to visualize clusters of addresses belonging to the same unhosted wallet even without these standard patterns.
• Exodus self-custody on TRON: TRM can now attribute Exodus unhosted wallets on the TRON network based on distinctive activation patterns. This covers approximately 700,000 addresses, helping investigators distinguish between self-custody flows and hosted service transfers.
• Seed Analysis hash grouping: For technical investigations, Seed Analysis now supports downloading and grouping results by seed phrase hash. This allows forensic teams to quickly organize findings from batch uploads or wildcard cracking workflows, streamlining the review of thousands of potential leads.

‍

{{horizontal-line}}

Frequently asked questions (FAQs)

1. How does the new Chainabuse update help with jurisdiction issues?

‍Chainabuse now automatically highlights other victim reports within your jurisdiction that are linked to your current case. This helps investigators realize when they are dealing with a serial offender affecting multiple local victims, facilitating joined-up investigations.

2. What is the benefit of the "legal process" export in Graph Visualizer?

‍It automates the creation of VASP subpoena requests. Instead of manually copying transaction hashes and formatting spreadsheets, investigators get a clean, structured CSV file ready to be attached to legal requests, saving significant time.

3. Which new blockchains are supported this month?

‍TRM has added standard support for dYdX and X Layer, expanding coverage for tracing and screening in these growing ecosystems.

4. How fast is the new Solana data?

‍Solana data is now real-time, with visibility appearing in the platform within roughly one minute of block creation, compared to the previous hourly refresh rate.

5. What is the new risk benchmarking feature?

‍It allows users to compare an entity's risky volume against industry benchmarks — like trusted exchanges or high-risk exchanges — to better understand the severity and context of their risk profile.

{{horizontal-line}}

Want to see these features in action? Request a demo today to learn how TRM can enhance your blockchain intelligence capabilities.