On the Frontlines of Financial Crime Disruption at Block by TRM

Last week, nearly 300 crypto investigators, compliance professionals, national security analysts, and regulators gathered in Washington, D.C. for the first-ever Block by TRM — TRM’s inaugural user conference, dedicated to the future of financial crime disruption.

The tone of the day was clear as soon as attendees stepped through the door: this was not a typical blockchain conference. Block by TRM was designed to be hands-on. Collaborative. Forward-looking. As TRM’s Co-founder and CEO Esteban Castaño noted in his opening remarks, "We're not here to talk about public-private partnerships. We're here to drive public-private disruption."

In this post, we’ll take a look back at the major themes from the day, including highlights from our core "Blocks," or learning tracks.

Why this moment matters

Esteban Castaño opened the day by underscoring the historic stakes facing the community working to protect the integrity of our financial systems.

The threat landscape, Castaño argued, is entering a new era. AI agents, tokenized assets, and real-time payments are expanding the playing field by orders of magnitude. With more transactions, more traceable data, and more bad actors — human and machine — entering the ecosystem, disruption will require more than just new tools. It will require a new kind of team with a focus on public-private disruption.

Castaño previewed how TRM is building the connective tissue between public and private sectors to enable faster, more proactive interventions and disruptions:

• Beacon Network — the industry's first real-time tracking and enforcement network — has already enabled the freezing of more than USD 75 million in illicit funds, across dozens of major exchanges and law enforcement agencies, since its launch in August 2025.
• TRM Deconflict — announced at Block — is a free deconfliction platform that enables verified law enforcement agencies to coordinate cryptocurrency investigations, check wallets and transactions against TRM's proprietary intelligence, and connect with expert investigators across jurisdictions. The launch of TRM Deconflict builds on TRM's proven Interested Investigator deconfliction network (launched in 2023), now accessible to verified law enforcement agencies globally.
• T3 Financial Crime Unit — built in partnership with Tether and TRON — has helped freeze more than USD 339 million in illicit crypto to date, a model now being expanded across additional stablecoins.
  

These tools are already enabling a shift from reactive investigations to collaborative disruption. As Castaño put it: "Crypto is where we figured out how to fight global, 24/7 crime. Now we take that model and scale it." 

He also challenged the audience to stay focused on the mission. "This is a civilization-level threat," he said, referencing the rise of AI-powered fraud and ransomware. "But I look around this room, and I'm not afraid. I'm fired up. Because the way we win is together."

Victims, criminal networks, and the human cost of fraud

The next two keynotes honed in on one of the most urgent challenges facing us today: the industrialization of online scams. TRM welcomed Jacob Sims (Harvard Asia Center Fellow and expert on pig butchering networks) and Debby Montgomery Johnson (a scam survivor-turned-advocate) to underscore the devastating human cost of fraud and bring home the “why” behind attendees’ shared mission of financial crime disruption.

Sims unpacked the ecosystem behind the rise of "scam compounds" — industrial-scale fraud centers across Southeast Asia that traffic vulnerable workers to perpetrate romance scams, investment fraud, and other AI-augmented social engineering campaigns. He explained how these networks are enabled by authoritarian regimes leveraging crypto rails and exploiting gaps in public-private coordination models. As he put it: "This is not petty crime. This is multinational, organized, industrial fraud at a scale we’ve never seen."

Montgomery Johnson followed with a raw, powerful account of how she lost over USD 1 million to a romance scam following the sudden death of her husband. "I was a well-educated businesswoman," she said. "This shouldn’t have happened. But it did. And it happens to people every day." Her message to the room: support victims, act early, and treat scam response as a collective mission. "If you’re working on tools that stop this," she said, "I want you to know: you’re saving lives."

Lessons in leadership

The morning closed on an energizing note with a keynote from Duke University head softball coach Marissa Young, who shared her story of building a national championship program from scratch while navigating personal tragedy. Her message: culture is the competitive advantage, and pressure is a privilege. "What you’re doing here," she told the audience, "is the equivalent of building a championship team with no playbook. But you’re doing it."

Key takeaways from our learning “Blocks”

For the rest of the day, Block by TRM attendees got hands-on — learning and collaborating with peers — in their respective tracks, or “Blocks.”

• Investigator Block
• Compliance Block
• Regulator Block
• NatSec Block
• Command Block

1. Investigator Block: Driving investigations from signal to seizure

Investigators spent the day running end-to-end crypto cases — from first signal to seizure — with a focus on transforming leads into defensible, courtroom-ready traces. They kicked off cases from a mix of high-signal, actionable sources (e.g. well-documented victim reports and SARs) to some less-obvious leads; triaged evidence to validate balances, exposure, and typology; and escalated to full tracing in TRM Forensics. 

These hands-on sessions reinforced verification-first workflows: confirming cross-chain swaps with TRM Signatures®; integrating digital forensics; and building transparent, entity-aware graphs that enable timely virtual asset service provider (VASP) pivots. The capstone moved from attribution to action, applying Seed Analysis for technical seizures, and understanding how to coordinate real-time disruption through the Beacon Network and T3 Financial Crime Unit.

A consistent theme across the Investigator Block was “evidence before inference” and “context makes traces defensible,” with instructors highlighting three major takeaways:

• Document assumptions
• Preserve chain of custody
• Make results reproducible so case files stand up in court

Participants also drilled critical cautions: avoiding traces through services or bridges, verifying cross-chain movements, following the right assets, and distinguishing deposits from hot wallets. And they learned the importance of early engagement with prosecutors and developing accurate requests to VASPs to accelerate freezes and seizures. The mindset was all about driving investigations and disruption in tandem.

2. Compliance Block: Bringing together on- and off-chain intelligence

Compliance practitioners spent the day working through intricate money laundering scenarios — from hands-on exercises to validate exposure to high-risk facilitators, to real-world case studies and threat briefings. 

The sessions reinforced a critical shift that’s underway: behavioral intelligence needs to be a primary lens for identifying risk. From developing profiles and controls to detect professional money launderers, to uncovering emerging typologies missed by traditional monitoring, the underlying theme was combining on- and off-chain intelligence to understand behavioral context.

Throughout the day, participants came back to the core idea that no single control is enough anymore. Screening alone is insufficient, exposure rules alone are insufficient, and even behavioral detection alone is insufficient. Compliance teams need layered, holistic control design built on strong processes, credible intelligence, and multiple data sources working together. 

Compliance Block made the message clear: the future of crypto compliance belongs to teams who understand the full complexity of the threat landscape and leverage intelligence and technology to stay ahead of it.

3. Regulator Block: Scaling resources and strengthening supervision

Regulators across agencies spent the day digging into how blockchain intelligence strengthens licensing, supervision, and enforcement. Through hands-on exercises and case studies, they saw how combining on- and off-chain data can expose industrial-scale fraud networks, surface jurisdictional risk, reveal the presence of nested or parasite exchanges operating inside legitimate VASPs, and highlight behavioral patterns that are missed through routine monitoring. 

Throughout the day, regulators articulated clear priorities for strengthening their own oversight models. They emphasized the need for more actionable and consistent entity risk scoring, better visibility into VASP Know Your Customer (KYC) controls, stronger guidance on interpreting indirect risk, and more effective cross-agency collaboration. 

A recurring theme from the day: regulatory teams that incorporate blockchain intelligence into their workflows are better positioned to scale their limited resources and stay ahead of threat actors who actively probe and exploit gaps in existing control frameworks.

4. National Security Block: Analyzing evidence to enable action

National security analysts spent the day applying blockchain intelligence to real-world threat scenarios — from sanctions evasion and foreign-state revenue generation to cross-border laundering and illicit procurement of AI hardware. 

Starting from core selectors such as addresses, wallets, and transaction patterns, attendees practiced converting raw on-chain activity into mission-aligned intelligence by integrating insights from open-source intelligence (OSINT) and existing reporting. Hands-on modules reinforced repeatable tradecraft: validating attribution assumptions; mapping financial and logistical infrastructure; and building clear, defensible graphs that support targeting, disruption planning, and interagency coordination.

A consistent theme across the NatSec Block: disciplined, evidence-led analysis — capturing hashes and timestamps accurately, separating fact from assessment, and producing “bottom line up front” (BLUF)-driven situational reports (SITREPs) that translate technical findings into actionable intelligence. The capstone exercise required analysts to distill blockchain activity into intelligence products that surfaced threat networks and outlined next steps for disruption.

5. Command Block: Sharing intelligence to accelerate mission outcomes

Command Block — a closed-door, half-day learning track — was reserved for senior leaders in public sector agencies. Throughout the afternoon, participants got a first look at new product developments on TRM’s roadmap, learned about recent disruptions made possible by public-private initiatives like Beacon Network and the T3 Financial Crime Unit, and discussed how blockchain intelligence can be used in court to affect disruptions. 

Command Block participants also heard intelligence briefings on today’s most pressing threat categories — including terrorism financing; Chinese transnational crime; and North Korean hackers, IT workers, and OTC brokers — and the role of blockchain intelligence in disrupting these illicit activities.  

Continuing the conversation to drive disruption

We closed out the day with an informal reception — the BlockParty — to bring all of our attendees and instructors back together to share learnings and continue the conversation. It was the perfect way to celebrate the new skills our first class of Block learners were taking home with them.

If there was one takeaway from Block by TRM, it’s that the industry is ready to move beyond awareness, reporting, and coordination. The goal is now disruption. Disruption that is global, real-time, and scalable. Disruption that prevents victimization. Disruption that brings law enforcement and private sector teams together in the same room — and gives them the tools to act.

As TRM’s emcee for Block and Head of TRM Academy, Taylor Windemuth, said in her opening remarks: "Each of you carries insight and experience that becomes more powerful when we put the blocks together." The work is just beginning. 

‍

{{horizontal-line}}

‍

If you attended Block by TRM, thank you. 

Thank you for diving headfirst into a full day of learning and being part of the community that’s protecting the integrity of our financial systems.

If you weren’t able to attend this year, we hope you’ll join us for Block 2026. Join the Block 2026 interest list here.