trm

A report released by the blockchain intelligence company TRM Labs shows that most of the transaction volume on the x402 payment protocol launched by Coinbase does not come from AI agents. The report analyzed 198.9 million settlements processed by known x402 facilitators on Base, Solana, and Polygon since May 2025, involving an amount of approximately $52.7 million.After excluding self-payments and other anomalous fund flows, about $25.62 million was identified as potential commercial transactions, of which only 0.6% to 7.5% by amount came from AI agents. TRM pointed out that ordinary scripts, scheduled tasks, and self-trading can also generate the same on-chain records, so the total transaction volume of the protocol is insufficient to measure agent commerce; their model identifies addresses that repeatedly pay for the same service as scripts, which may underestimate the actual scale of single-use agents. During the reporting period, USDC accounted for 99.6% of the settlement value, approximately $52.47 million.Meanwhile, Binance's Agent OS launched in August has integrated the x402 payment layer, Coinbase's Base supports agents and payment startups through a $1 million accelerator, and Amazon also launched AgentCore Payments in May in collaboration with Coinbase and Stripe. TRM recommends improving the on-chain agent registration mechanism, establishing a verifiable counterparty reputation system for agents, and building a monitoring framework suitable for small, high-frequency payments, stating that "agent commerce requires agent compliance."

According to Fortune, the San Francisco-based cryptocurrency crime tracking company TRM Labs completed a $70 million Series C funding round in September 2025, achieving a valuation of $1 billion. Just six months later, it received additional investment from existing investors, doubling its valuation to $2 billion.CEO Esteban Castano stated that the company's mission has expanded from blockchain forensics to a broader mapping of cybercrime, with AI becoming a second growth engine rather than a transformation, while the core cryptocurrency business remains strong. The company is set to launch a new investigation platform specifically targeting AI-driven deepfake scams, extortion related to pornography, and child sexual abuse crimes.Castano noted that the widespread adoption of cryptocurrency has made it possible to comprehensively map crime networks, and the company is expected to reach a $100 million annual recurring revenue milestone in the coming weeks. Currently, it has about 500 employees and has offices in London, Singapore, and Washington.

Blockchain analysis company Chainalysis has filed a lawsuit in the U.S. Federal Claims Court, accusing the U.S. Immigration and Customs Enforcement (ICE) of illegally awarding a $94.6 million exclusive contract to competitor TRM Labs. This contract provides forensic software and support services for investigations by the Department of Homeland Security's task force, with a performance period from July 1, 2026, to June 30, 2027. Chainalysis claims this is the largest blockchain analysis contract awarded by the U.S. government to date.In the complaint, Chainalysis pointed out that ICE issued a Request for Information (RFI) on May 28, which included 18 questions regarding capabilities such as a proprietary fraud victim database, AI agent data retrieval, automatic notifications for virtual asset service providers (VASP) to execute voluntary freezes, and collaboration with stablecoin issuers. However, many of the RFI requests did not appear in the final Statement of Need released less than two weeks later, while ICE's market research determined that Chainalysis could not meet the needs based on RFI standards. Chainalysis also noted that "sexual extortion," which was not mentioned in the RFI, became one of the three main task areas in the Statement of Need, and some requirements closely matched TRM's proprietary product architecture.Chainalysis claims it was the only company to submit a capability statement, but ICE completed its market research the next day, determining that TRM was the only vendor capable of meeting all the requirements, and did not pose any follow-up questions to it.

According to The Block, TRM Labs' latest report shows that the application of artificial intelligence in crypto crime has increased by 40% year-on-year over the past year, primarily driven by fraud activities. The report states that crypto hackers are increasingly using artificial intelligence for vulnerability analysis, social engineering attacks, and penetration.In the first half of 2026, there were 201 digital asset hacking incidents, a record high, with approximately 75% of the losses stemming from 4% of the incidents. North Korea-related activities caused about $600 million in losses, accounting for 61% of the losses in the first half of the year. TRM Labs stated that artificial intelligence has not created new types of crime but has significantly lowered the barriers to crime and expanded the scale of attacks.

According to Decrypt, blockchain forensics company Chainalysis Government Solutions filed a procurement protest on July 27 in the U.S. Federal Claims Court, opposing the U.S. Immigration and Customs Enforcement (ICE) awarding a contract worth approximately $94.6 million to competitor TRM Labs through a sole-source method.The contract period is from July 1, 2026, to June 30, 2027, involving blockchain forensics software and support services for Homeland Security Investigations into fraud, cybercrime, and sexual extortion cases. Chainalysis believes that ICE's decision is arbitrary and unreasonable. TRM Labs joined the case as an intervenor defendant on July 28, defending the contract alongside the U.S. government.The court allowed Chainalysis to temporarily seal the complaint, with oral arguments scheduled for September 2; ICE stated that after approximately 6 days of market research, it determined that none of the 8 responding companies could meet the requirements.

Chainalysis Government Solutions has sued the U.S. government in the U.S. Court of Federal Claims over an exclusive contract. Chainalysis claims that the Department of Homeland Security/Immigration and Customs Enforcement (DHS/ICE) bypassed the normal competitive process and directly awarded the work to TRM Labs. They are requesting the court to stop this action.TRM Labs has joined the lawsuit as an intervenor, defending the award of the contract, with oral arguments scheduled for September 2. The U.S. Court of Federal Claims is responsible for hearing nationwide claims against the U.S. government, typically involving contract disputes and bid protests. Both Chainalysis and TRM Labs sell blockchain analysis tools for government agencies to track cryptocurrency transactions, and they are now competing for government business in court.

The latest report from blockchain intelligence agency TRM Labs shows that approximately 76% of global cryptocurrency hacking losses are related to organizations associated with North Korea, with a total stolen amount of about $577 million.North Korea's share of global crypto theft continues to rise: 22% in 2022, 37% in 2023, 39% in 2024, rising to 64% in 2025, and further increasing to 76% in 2026. Since 2017, the total illegal profits have exceeded $6 billion. The report points out that these losses mainly stem from two major incidents in April: a $292 million attack on KelpDAO and a $285 million theft from Drift Protocol, with the two attacks accounting for about 3% of all hacking incidents during the same period.

According to CoinDesk, blockchain analytics company TRM Labs has launched an AI agent tool for law enforcement agencies, embedded in its TRM Forensics service, which can convert natural language instructions into complex investigative operations, helping investigators track illegal cryptocurrency transactions.Users do not need to have a high technical threshold to query fund flow information, speeding up the pursuit of criminals.

TRM Labs released a report indicating that artificial intelligence is profoundly changing the landscape of digital financial transactions, with illicit cryptocurrency flows reaching $158 billion by 2025, and AI-driven fraud activities growing at an annual rate of approximately 500%.The report highlights that autonomous AI agents have significantly compressed the time required for money laundering and cross-chain asset transfers. By automating the splitting of funds, selecting optimal bridging paths, and executing exchanges on decentralized platforms, these agents can obscure the trail of funds in just seconds.Overall, the 150 hacking incidents that occurred in 2025 resulted in losses of $2.87 billion, with the speed of fund dispersal playing a crucial role in the outcome of a $1.46 billion theft from a major exchange.

According to Fortune magazine, cryptocurrency compliance and investigation startup TRM Labs has announced the completion of a $70 million Series C funding round, achieving a valuation of $1 billion and becoming a newly minted "crypto unicorn."This round of financing was led by early investor Blockchain Capital, with traditional institutions such as Goldman Sachs, Bessemer, Brevan Howard, Thoma Bravo, and Citi Ventures participating. TRM Labs was founded in 2018 by Esteban Castaño and Rahul Raina, and its blockchain analysis software is widely adopted by global law enforcement agencies and an increasing number of private companies using cryptocurrency for fund transfers.Currently, about 40% of TRM's clients come from the private sector, and this proportion is growing as financial institutions explore tokenized deposits, equity, and other assets. The company's team has rapidly expanded to 350 people and is leveraging AI technology to combat the evolving tactics of crime.

Web3 asset data platform RootData published a daily transparency alert on Twitter (X), stating that projects such as CureX, Blocktrade, BETRMINT, ABCC, TradeOgre, and Bilaxy are missing core information. It calls on project teams to submit/update their information on RootData to improve their transparency scores. Additionally, RootData stated that it will continue to monitor and expose "black box" projects that lack core information.It is reported that the RootData transparency score is used to measure the integrity and timeliness of projects, aiming to reflect the information disclosure status of the projects. The transparency score is divided into 5 levels from A to F, with lower scores indicating that the project's information disclosure is less complete and the risk of malfeasance is higher, requiring investors to exercise heightened caution.

According to a report by The Block, a recent analysis by TRM Labs shows that since 2023, the Islamic Revolutionary Guard Corps (IRGC) of Iran has transferred approximately $1 billion using two UK-registered cryptocurrency exchanges, Zedcex and Zedxion, to evade international sanctions.From 2023 to 2025, transactions related to the Islamic Revolutionary Guard Corps (IRGC) accounted for 56% of the total trading volume on the exchanges, with the vast majority of transactions conducted in USDT on Tron.

According to Crowdfund Insider, TRM Labs stated that it has traced stolen crypto assets from the 2022 LastPass vulnerability incident on-chain, with on-chain indicators suggesting the involvement of Russian cybercrime groups in the laundering process.TRM noted that although hackers used mixing tools like CoinJoin, they were still able to associate the flow of funds before and after the mixing back to the same group of attackers through de-mixing and behavioral continuity analysis. The related funds ultimately flowed into high-risk Russian exchanges Cryptex and Audi6, with the total amount involved estimated to exceed $28 million.

ChainCatcher news, according to Cointelegraph, blockchain intelligence company TRM Labs stated that a ransomware group named Embargo has transferred over $34 million in ransom-related cryptocurrency since April. Embargo currently has approximately $18.8 million in cryptocurrency stored in non-affiliated wallets, and experts believe this strategy may be aimed at delaying detection or taking advantage of better money laundering conditions in the future. Embargo operates under a ransomware-as-a-service (RaaS) model, primarily targeting industries with high downtime costs, including healthcare, business services, and manufacturing, and tends to attack victims within the United States, possibly due to their stronger payment capabilities.TRM's investigation suggests that Embargo may be a rebranded version of the notorious BlackCat (ALPHV) group, which disappeared earlier this year amid allegations of an exit scam. Although Embargo is not as overtly aggressive as LockBit or Cl0p, it employs a double extortion strategy: encrypting systems and threatening victims with the release of sensitive data if they do not pay. In some cases, the group publicly names victims or leaks data on its website to increase pressure.

According to ChainCatcher, The Block reported that the crypto analytics platform TRM Labs stated that Israel recently arrested three individuals suspected of engaging in espionage activities for Iran, two of whom were compensated with cryptocurrency, marking a rare public case involving government agents using digital assets.TRM noted that on June 18, Iran's largest crypto exchange, Nobitex, suffered a hack resulting in losses exceeding $90 million, with the attackers being the pro-Israel organization Gonjeshke Darande. TRM's analysis indicated that, although there is no direct evidence, Israel may have used internal data obtained from Nobitex during this attack (such as wallet and message records) to identify suspects, a tactic consistent with past Israeli behavior. Chainalysis further pointed out that Nobitex is a key node in Iran's crypto system under sanctions and has had on-chain connections with groups related to the Iranian Revolutionary Guard.

ChainCatcher news, according to Cointelegraph, the blockchain intelligence company TRM Labs stated that in the first half of 2025, cryptocurrency losses due to attacks could reach as high as $2.1 billion, most of which are caused by the leakage of crypto private keys and front-end intrusions.TRM Labs released a report on Thursday indicating that of the 75 cryptocurrency hacking incidents that have occurred so far this year, over 80% of the stolen funds came from so-called infrastructure attacks. These types of attacks, on average, siphon off 10 times more funds than other types of attacks.Infrastructure attacks target the technical backbone of systems, aiming to gain unauthorized control, mislead users, or redirect assets. They include hijacking the private key mnemonic phrases of crypto wallets or exploiting the user interface components of crypto protocols (i.e., the front end).

ChainCatcher news, according to CoinDesk, former FBI agent Christopher Wong, who previously led investigations into the Bitfinex hack and the Axie Infinity attack, has joined blockchain intelligence company TRM Labs as a global investigator to assist in combating illegal financial activities in the crypto space.

ChainCatcher news, on-chain detective ZachXBT responded to the community on platform X, stating that he is not interested in investigating Pulsechain because the community has not prioritized building analytical tools or paying integration fees. Without the Etherscan block explorer product, blockchain analysis on EVM chains would be very difficult; without Chainalysis or TRM integration, complex investigations would require ten times the workload; and without Arkham/Nansen integration, ordinary traders have almost no way to read/interpret trading activities. Previously, Interpol had issued a "Red Notice" on behalf of Finland to its member countries, seeking the founder of Hex and PulseChain, Richard James Schueler.