TRM Labs

🚨 Introducing Beacon Network: The first real-time crypto crime response network. Exchanges, issuers, and law enforcement can now trace funds instantly — and act before criminals cash out. Learn more: trmlink.info/41fyPXw #BeaconNetwork #TRMLabs

As a money services business serving institutional clients, HIFI's risk profile looks different from a retail platform's. Beyond checking whether a wallet is directly tied to illicit activity, HIFI's compliance team watches for behavior inconsistent with what's expected, flagging patterns like repeated bridge activity in a short timespan or recurring exposure to gambling wallets. That approach was tested early: shortly after launch, HIFI identified and blocked a wave of suspicious businesses attempting to onboard, and fraudulent attempts dropped off sharply afterward. 📄 Read the full case study: trmlink.info/3PifqCl

400 TB of blockchain transaction data, 30+ API routes, a deadline of 1.5 quarters, and no industry playbook. In our latest post on the TRM Tech Blog, Engineering Manager Amit Plaha writes about how his team migrated Address Transfers against those very odds. Hear about the five execution principles his team followed, and the leadership lessons that came with them ➡️ trmlink.info/3SFTHWB

Regulators in D.C., Brussels, Singapore, Dubai, the UK, and beyond are writing the playbooks for crypto right now — and compliance teams are working to keep up in real time. On July 14, TRM Labs' @ARedbord and @ChaseFinCrim break it down with David Katz (@Circle) in our 𝗤𝟮 𝗖𝗿𝘆𝗽𝘁𝗼 𝗣𝗼𝗹𝗶𝗰𝘆 𝗥𝗼𝘂𝗻𝗱𝘁𝗮𝗯𝗹𝗲 — covering what’s happening across the Americas, EMEA, APAC, AI/Cyber, and DeFi. Register now ➡️ bigmarker.com/series/quarter…

On this week's #TRMTalks, @ARedbord and the @Unchained_pod’s @DEXintheCityPod — @kkirkbos, Jessi Brooks (@RibbitCapital), and @TuongvyLe12 (@veda_labs) — talk about going on offense against North Korea instead of just blaming protocols. Catch the full episode 👉 trmlink.info/4oVTCd8

New on the TRM Tech Blog, Staff Software Engineer Andrew Fisher writes about migrating 500 billion rows of blockchain data and why time partitioning failed. With extreme address-level skew, queries were scanning ~25,000 Iceberg files per lookup. But bucket partitioning by address brought that down to ~300, landing P95 under 2.5s. Read his post here 👉 trmlink.info/3SCxpF8

Introducing TRM MCP 🎉 Your transaction monitoring alerts didn’t pause over the weekend. Now your agents can work them from triage to disposition, all while keeping you in control of the decision. ▪️ Triage alerts in seconds ▪️ Investigate exposure paths with prompts ▪️ Document every decision Learn more: trmlink.info/4govpKm

Most companies 𝘴𝘢𝘺 they want people to speak up. But few build disagreement into how decisions actually get made. At TRM, challenging ideas before a decision is final is a named, expected practice: farming for dissent. New on the TRM blog, Devin Blase (our SVP of People) writes about what it looks like in practice and what it signals about who thrives here. Read the post here 👉 trmlink.info/4vIBPsu

TRM Labs is hiring a Senior Cloud Security Engineer to own GCP IAM, lead TRM's FedRAMP 20x expansion, and drive the organization toward continuous, agentic cloud security posture management. If you have knowledge in Deep GCP, Terraform, and IAM experience, apply here 👉 trmlink.info/3Fdug8p #TRMCareers #TRMLabs

Stablecoin rules are going live. DeFi is getting tested. And AI is rewriting compliance. Q2 didn't hold back. Join TRM Labs' @ARedbord, @ChaseFinCrim, and special guest David Katz (@Circle) for our Quarterly Crypto Policy Roundtable covering the Americas, EMEA, APAC, AI/Cyber, and DeFi. Register now ➡️ bigmarker.com/series/quarter…

Attackers carried out 207 crypto hacks in H1 2026 — a record for any six-month period — but total losses fell to USD 972 million, less than half of the USD 2.3 billion stolen in H1 2025. Two distinct patterns explain the divergence. 🔹 Infrastructure compromises made up roughly 15% of incidents but drove approximately 76% of losses, concentrated in two North Korea-linked operations against Drift Protocol and KelpDAO totaling USD 577 million. 🔹 Smart contract exploits accounted for most incidents but a far smaller share of stolen value, with a median loss of about USD 219,000. The lower total reflects the absence of another record-setting theft, not a reduction in attacker capability. Read our full analysis here ➡️ trmlink.info/4v8cp6z

TRM Labs is proud to be a blockchain intelligence partner for Robinhood Chain, the new Ethereum Layer 2 from @RobinhoodCrypto designed to support real-world assets. For builders on Robinhood Chain, that means screening for sanctions and AML risk is enabled at the infrastructure layer -- and scalable as the ecosystem grows. Read more about the launch here: x.com/RobinhoodCrypt…

🚨 OFAC just sanctioned 134 crypto addresses tied to ISKP (ISIS's Afghanistan affiliate) that moved over USD 2 million. TRM has tracked this network since 2022 — including tracing funds from the 2024 Moscow attack to an ISKP wallet within hours. Read our full breakdown ➡️ trmlink.info/4vIMVOr

New #TRMTalks: Join @ARedbord and the @Unchained_pod’s @DEXintheCityPod crew — @TuongvyLe12 (@veda_labs), Jessi Brooks (@RibbitCapital), and @kkirkbos — for a conversation on why the CFTC suddenly matters, why North Korea's USD 600 million in hacks is a national security story, and why privacy brings institutions on-chain. Tune in now 👉 trmlink.info/4oVTCd8

TRM MCP is now live! Connect your AI agents to TRM’s blockchain intelligence to work every transaction monitoring alert from triage to disposition, all while keeping you in control of the decision. ▪️ Triage alerts in seconds ▪️ Investigate exposure paths with prompts ▪️ Document every decision Learn more ➡️ trmlink.info/4oYmPnS

Coming Wednesday on #TRMTalks: A crossover with the lawyers behind @Unchained_pod’s @DEXintheCityPod. @ARedbord speaks with @TuongvyLe12 (@veda_labs), Jessi Brooks (@RibbitCapital), and @kkirkbos on the CFTC's rise, North Korea, and privacy as crypto's real unlock. Follow TRM Talks on Spotify to be the first to tune in 👉 open.spotify.com/show/2f9v6MaVk…

Wildlife trafficking generates up to USD 281 billion annually, with financial enforcement almost entirely absent from efforts to combat it. TRM Labs is partnering with @united4wildlife, founded by Prince William and The Royal Foundation, to map and disrupt the financial networks behind the trade through financial intelligence analysis; an extension of the Beacon Network to cover wildlife trafficking proceeds; and Project Pangolin, a free intelligence-sharing platform open to governments, companies, and nonprofits. Learn more about the scale of the wildlife trafficking problem, and the role of these initiatives in tackling it, in our latest blog post ➡️ trmlink.info/4oPckD9

An AI agent that holds an API key is one prompt injection away from using it. Hardening the sandbox raises the cost of escape — but it doesn't change what's inside. New on the TRM Tech Blog, Preet Bhinder digs into the credential broker pattern that keeps secrets out of agents' hands entirely, and the four-part process for shipping security-critical code with AI in the loop. Read the post here 👉 trmlink.info/4uUDNF6

TRM Labs traced more than USD 3.84 billion in blockchain-verified flows between CoinEx and sanctioned Iranian entities over seven years — spanning 50+ platforms, with exposure to Nobitex, the IRGC, Palestinian Islamic Jihad, and Hezbollah. CoinEx was Nobitex's single largest external counterparty by 2025, by nearly nine times over the next largest named exchange. Every major Iranian exchange routes approximately 5–10% of its volume through CoinEx — a statistical clustering inconsistent with independent market behavior. TRM also traced USD 67 million in Central Bank of Iran funds through CoinEx infrastructure, and identified CoinEx's affiliated mining pool, ViaBTC, as a liquidity recovery mechanism for Nobitex following a 2025 cyber attack. 🔗 Read TRM’s full analysis: trmlink.info/4eHiLU9

Since 2019, Iran-linked wallets have moved over USD 3.84 billion in transactions through crypto exchange CoinEx, according to TRM Labs research cited in a new @WSJ investigation. By 2024, CoinEx had replaced Binance as the largest foreign counterparty to Iran's Nobitex exchange, with over USD 763 million moving between the two in 2025. TRM also traced funds from wallets attributed to Iran's central bank — including amounts linked to Bybit theft proceeds — through CoinEx. Read the full piece from WSJ here 👉 wsj.com/finance/curren…

TRM and Cursor are hosting a developer fireside chat in San Francisco on June 29. TRM Co-Founder and CTO Rahul Raina will walk through how TRM rebuilt its SDLC around AI. He and David Pan, field CTO at @cursor_ai, will then cover the economics of AI tooling spend, how to structure an AI-native development workflow, and what software engineering looks like as these tools mature. TRM Co-Founder and CTO Rahul Raina will walk through how TRM rebuilt its SDLC around AI. David Pan (Field CTO at Cursor) will also join him to cover the economics of AI tooling spend, how to structure an AI-native development workflow, and what software engineering looks like as these tools mature. Registration closes at 4:00pm PT on June 29, and spots are limited! Save your spot: luma.com/n56uhlnx