TRM Labs: How Blockchain Intelligence Fights Crypto Crime
Most people who use crypto have never heard of TRM Labs, and that is exactly how its customers like it. The company holds no coins and runs no exchange. What it sells is sight: the ability to look at a public blockchain and see who is probably moving money, where it came from, and whether anyone should worry about it. That quiet product turned out to be worth a lot. In February 2026, TRM Labs raised a $70 million round that valued it at $1 billion, making it the newest unicorn in a strange little industry that polices the one technology built to avoid being policed.
This guide explains what TRM Labs is, how blockchain intelligence actually works, and how banks, exchanges, and government agencies use it every day to meet their crypto compliance obligations. If you have ever wondered who watches the chain, this is one of the answers.
What TRM Labs Is and Why It Exists
Here is the bet TRM Labs made in 2018, and it sounds backwards until you sit with it: a public ledger that records every transaction forever is not a criminal's paradise. It is an investigator's dream. Cash leaves no trail. Bitcoin leaves nothing but trail. The trick is reading it.
Esteban Castaño and Rahul Raina founded the company in San Francisco on that idea, went through Y Combinator in 2019, and built software that turns raw blockchain data into something a compliance officer or a federal agent can act on. Castaño runs it as CEO. The stated mission is grand to the point of being a slogan: build a safer financial system for billions of people. Underneath the slogan is a narrower business. TRM is a blockchain intelligence firm, which means it does not move crypto or custody it. It watches the digital asset economy and tells paying clients what it sees.
The watching has become valuable. The $1 billion valuation, reported by Fortune in February 2026, arrived after roughly 50 percent annual revenue growth for four straight years, and the cap table now reads like a Wall Street guest list, with Goldman Sachs and Citi Ventures sitting alongside crypto-native funds. That mix tells you who the real customer is becoming.
How Blockchain Intelligence Actually Works
People get one thing backwards about crypto, and the entire blockchain intelligence industry is built in the gap. Public chains are not anonymous. They are pseudonymous, which is a very different word. Your name is not on the ledger, but a permanent address is, and every coin that address has ever touched is recorded for anyone to read. For want of one careless link between that address and your real identity, the whole chain of activity can come apart. TRM's job is finding that link and following it.
From pseudonymous to identified
The core technique is clustering. Software groups blockchain addresses that appear to belong to the same actor, using patterns in how transactions are structured and timed. On its own, a cluster is just math. It becomes intelligence when an identity gets attached to it, and identities leak constantly. An exchange collects your name and ID when you sign up, then sends coins to an address. A court seizes a wallet and publishes it. Someone posts a donation address on a forum. Each leak is a nail, and TRM hammers it into the cluster until a pseudonymous blob has a label.
Risk scoring across many chains
Once addresses are clustered and labeled, the platform scores them. TRM says it covers more than 184 blockchains and 1.9 billion assets, sorting wallet activity into over 150 risk categories that map to anti-money laundering standards. A wallet that received funds two hops from a sanctioned exchange gets flagged. A wallet that cashed out from a ransomware payment gets flagged harder. The output is a risk number a client can plug straight into a decision.
Cross-chain tracing and the bridge problem
The hard part is movement between chains. Criminals do not sit still on Bitcoin. They hop through bridges, swap into privacy coins, and run funds through mixers to break the trail. Following money as it crosses from one blockchain to another is the discipline that separates serious tools from toys, and it is where TRM placed its early bet. While larger rival Chainalysis focused first on Bitcoin, TRM built for many chains from the start, on the theory that on-chain crime would scatter across all of them. It did.
TRM Labs Products: Forensics to Wallet Screening
TRM does not sell one dashboard to everyone. It sells different tools to people with very different jobs, which is why the product line reads like three companies stapled together.
TRM Forensics is the deep investigation tool, built for analysts who need to trace a specific theft or build a case file that survives in court. Then there is the screening side, an API that lets a crypto business check a wallet or transaction in real time before it lets money through, the way a card network checks a payment in the half-second before approval. Beacon Network is the odd one out, a shared environment where law enforcement agencies from different countries can collaborate on the same cross-border case instead of working blind.
Layered across all of it now is AI. TRM has pushed AI agents into the workflow to handle investigations at what it calls machine speed, and the reason is defensive. Scammers automated first. The company has pointed to a roughly 500 percent jump in AI-enabled scam activity, and you cannot fight machine-speed fraud with humans reading spreadsheets.
TRM Labs Users: Government Agencies and Banks
The customer base splits in a way most software vendors never manage. About 40 percent of TRM's business is now private sector and growing, with the rest sitting in the public sector. That balance is unusual and deliberate.
On the government side, TRM works with agencies that investigate fraud and financial crime alongside national security threats, the kind of work where a traced wallet becomes a seizure warrant. Its credibility there rests on people as much as code. The global head of policy, Ari Redbord, is a former federal prosecutor, and the head of global investigations, Chris Janczewski, was an agent on the takedown of one of the largest darknet child-abuse sites ever prosecuted. That bench of ex-investigators is itself part of the product, because government buyers trust people who have sat in their chair.
On the commercial side, financial institutions and payment companies have moved from curious to committed. TRM has named PayPal and Visa among its users, and it claims more than 600 agency and institutional clients across 75 countries, though that figure is the company's own and worth treating as a marketing number rather than an audited one. The direction is clear regardless. Banks that once refused to touch crypto now need to see it clearly, and seeing clearly is the whole pitch.
Crypto Compliance: AML and Sanctions Screening
This is the part that stops being interesting and starts being mandatory. A crypto exchange that cannot screen a wallet against a sanctions list in real time has a legal problem, not a missing feature. Blockchain intelligence is the machinery that lets a crypto business stay on the right side of the law, and it breaks down into a few concrete duties.
AML transaction monitoring
Anti-money laundering rules require regulated firms to watch transactions continuously and report suspicious ones. For crypto, that means scoring wallets and flows against known typologies: pig butchering scams that drain victims slowly, ransomware payouts, darknet market settlements. When a pattern trips a threshold, it generates an alert a human reviews and, if warranted, escalates into a suspicious activity report. TRM supplies the scoring; the firm supplies the judgment.
OFAC sanctions screening
Sanctions are the sharpest edge. In the United States, transacting with a wallet on the OFAC sanctions list is a strict-liability violation, meaning intent does not save you. Firms screen every counterparty wallet against those lists before funds move. The stakes keep climbing: sanctioned entities received roughly $104 billion in crypto during 2025, a 694 percent surge over the prior year according to Chainalysis, much of it tied to states under heavy restriction. Miss one of those wallets and the penalty is not a stern letter.
Risk categories and onboarding
Underneath sit those 150-plus risk categories, which let a firm set its own appetite. A conservative bank might block any wallet within two hops of a mixer. A trading platform might allow it but flag it for review. The point is that risk-based onboarding replaces a blunt yes-or-no with a dial, and the dial is only as good as the intelligence feeding it.
The Travel Rule and Crypto Compliance Duties
If you want the single regulation that turned tools like TRM from nice-to-have into license condition, it is the Travel Rule. The concept is borrowed straight from traditional banking. When money moves, identifying information about the sender and receiver has to travel with it.
The global standard comes from the Financial Action Task Force, which recommends the rule apply to crypto transfers above a threshold, set at $1,000 in the United States. The European Union went further and removed the threshold entirely under Regulation 2023/1113, so even small transfers between regulated cryptocurrency firms must carry originator and beneficiary data. In practice, this means two exchanges sending crypto to each other must exchange customer information in the background, the same way correspondent banks always have. Blockchain intelligence does not satisfy the Travel Rule by itself, but it is the layer that tells a firm whether the wallet on the other side is one it can legally deal with at all.
TRM Labs vs Chainalysis and Elliptic
Three companies dominate the blockchain analytics market, and they are not copies of each other. They made different bets at different times, and the bets show.
| Company | Founded | Total raised | Latest valuation | Early focus |
|---|---|---|---|---|
| TRM Labs | 2018 | ~$220M | $1B (Feb 2026) | Many blockchains from day one |
| Chainalysis | 2014 | ~$537M | ~$2.5B | Bitcoin and government investigations |
| Elliptic | 2013 | ~$210M+ | ~$670M (May 2026) | Compliance and risk for institutions |
Chainalysis is the oldest and best capitalized, and it built its reputation tracing Bitcoin for US agencies before most banks knew what a blockchain was. Elliptic, founded in London, leaned earliest into compliance tooling for financial institutions and raised $120 million in May 2026. TRM is the youngest of the three and the newest unicorn, and its pitch is breadth: cover every chain, screen in real time, and pair it with a roster of former agents. None of the three has won outright. The market is still growing fast enough to feed all of them.
Why It Matters: $158B in Illicit Crypto
The reason this industry exists, and keeps raising money, is that illicit activity in crypto keeps growing, not shrinking. TRM's own 2026 crime report put illicit crypto volume for 2025 at roughly $158 billion. Chainalysis, using a different methodology, landed nearby at about $154 billion, a figure it flagged as up 162 percent year over year. The two firms rarely agree to the dollar because they attribute activity differently, but they agree on the direction, and the direction is up.
| Metric (2025) | Figure | Source |
|---|---|---|
| Illicit crypto volume (TRM estimate) | ~$158B | TRM Labs |
| Illicit crypto volume (Chainalysis estimate) | ~$154B | Chainalysis |
| Share of illicit volume in stablecoins | ~84% | Chainalysis |
| Value to sanctioned entities | ~$104B | Chainalysis |
One detail in that table reshapes the whole picture. The majority of illicit crypto volume now moves in stablecoins, not Bitcoin, which is why screening has to cover the chains where stablecoins live. The tools also produce results worth pointing at. The US Department of Justice announced one of its largest-ever seizures of crypto-fraud funds, around $225 million in USDT, in an investigation TRM supported in 2025.
The Limits of Blockchain Intelligence
I am not convinced this should all pass without a second look. Blockchain intelligence is probabilistic, not proof. A clustering heuristic can be wrong, and when it is, an innocent user's wallet gets flagged, frozen, or quietly de-banked with no clear way to appeal. The same software that catches a ransomware crew is, pointed slightly differently, a surveillance tool that watches lawful people spend lawful money. The industry's answer is that the alternative is worse, and most regulators agree. That does not make the tradeoff disappear. It just decides who gets to make it.
What TRM Labs Tells Us About Crypto
TRM Labs sells trust infrastructure for an economy that was designed to run without trusted intermediaries, and the irony is the entire point. Crypto promised money that needed no bank to vouch for it. What it got, at scale, was a new layer of watchers deciding which coins are clean. As more real value moves on-chain, the interesting question is no longer whether crypto gets monitored. It clearly does. The question is who holds the lens, how often they are right, and who is watching them back.
