Chainalysis identifies 7,700 suspect accounts in CSAM crypto operation

Chainalysis has generated 14,300 investigative leads after tracing 29,120 cryptocurrency addresses and digital identifiers linked to more than 100 child sexual abuse material platforms, forums and distribution networks.
Summary

• Operation Lighthouse generated 14,300 investigative leads after tracing 29,120 crypto addresses and digital identifiers.
• More than 7,700 suspect accounts were identified across exchanges and payment platforms, including 16 linked to registered sex offenders.
• Suspects were identified across 125 countries as investigators targeted more than 100 CSAM platforms, forums and distribution networks.
• Eleven cryptocurrency exchanges and payment services were involved in the investigative leads generated during the operation.

Chainalysis said Operation Lighthouse identified more than 7,700 suspect accounts through cryptocurrency exchanges and payment platforms, including accounts associated with 16 registered sex offenders, while the suspects uncovered through the operation were spread across 125 countries.

The multi-day operation was held at the National Cyber-Forensics and Training Alliance in New York and brought together investigators, cryptocurrency companies and specialist nonprofit organizations to examine financial activity connected with child sexual abuse material, or CSAM.

Months of data enrichment preceded the investigative sprint, allowing participants to work from existing crypto intelligence tied to suspected CSAM consumers, vendors, marketplace operators and administrators. The resulting leads were shared across 11 cryptocurrency exchanges and payment services for further investigation and possible legal action.

Operation Lighthouse has produced 14,300 investigative leads

During the sprint, participants used blockchain records and information held by partner organizations to identify suspected activity and develop leads that could support account-level investigations, legal requests and future cases.

The operation was structured around specific investigative targets instead of functioning as a general training event. Investigators worked on priority leads while companies and nonprofit groups contributed data and expertise within their respective authorities.

Cryptocurrency accounts for only a small portion of activity associated with CSAM, according to Chainalysis, although the company said its use has increased in recent years. Public blockchain records can leave financial trails that investigators can follow when payments pass through identifiable services such as centralized exchanges.
You might also like: Chainalysis sues U.S. over $94.7M TRM Labs contract

Related Chainalysis research published in February found that cryptocurrency flows connected with suspected human trafficking services increased 85% during 2025. As crypto.news reported in February, the firm tracked hundreds of millions of dollars in transactions across services tied to Telegram-based escort operations, labor recruiters connected with Southeast Asian scam compounds and CSAM vendors.

CSAM-related transfers in the February dataset were smaller than transactions involving some other categories, with an average payment below $100. One platform analyzed by Chainalysis had used more than 5,800 cryptocurrency addresses and received over $530,000 since July 2022.

Bitcoin had previously been common across the identified CSAM services, while some operators had increasingly used privacy-focused Monero to obscure proceeds. Chainalysis also identified instant exchangers without know-your-customer requirements as part of the laundering process used by some operators.

Exchanges identified more than 7,700 suspect accounts

Private-sector participants in Operation Lighthouse identified more than 7,700 suspect accounts across exchanges and payment platforms after reviewing the intelligence developed during the operation.

Sixteen of the accounts were linked to registered sex offenders, according to the report. Investigators also identified suspects across 125 countries, giving the operation a cross-border scope that involved law enforcement agencies from several continents.

Binance, Coinbase and Block participated alongside the Australian Federal Police, Royal Canadian Mounted Police, the United Kingdom's National Crime Agency and Europol. The Internet Watch Foundation also contributed specialist expertise to the sprint.

Binance Senior Program Manager for Anti-Child Sexual Exploitation Gavin Sather said cooperation between private companies and public authorities was important when harmful activity intersects with illicit finance.

"The sprint also highlights how on-chain intelligence is a powerful tool that enables quick response actions collectively," Sather said, adding that blockchain transparency can make it difficult for offenders to keep their financial activity hidden for long.

Binance has separately increased spending on financial-crime controls and cooperation with authorities. A June compliance update said the exchange spends about $300 million annually on compliance and employs nearly 1,500 people in related roles.

The exchange said it had supported 313,653 law-enforcement requests globally by late June, including 72,632 requests during 2025 and another 36,235 by June 2026. Binance also reported intercepting $10.53 billion in potential fraud, scams and unusual activity between 2025 and the first quarter of 2026.

Coinbase said Operation Lighthouse demonstrated how blockchain transparency can help companies and investigators convert transaction data into information that can be acted upon.

"At Coinbase, we believe the transparency of crypto is a powerful tool for protecting people and disrupting abuse," the company said.

Blockchain records can connect payments with identifiable services

Operation Lighthouse combined on-chain transaction histories with information available to exchanges, payment companies, investigators and organizations specializing in child exploitation cases.

Once investigators identify a cryptocurrency address, blockchain analysis can map transactions involving other wallets and services. Exchanges participating in an investigation can then examine relevant activity against account records when the necessary legal and compliance requirements are met.

Monitoring standards across cryptocurrency businesses have tightened over recent years, according to separate Chainalysis research. A May monitoring study found that 47% of crypto businesses entering the market in 2026 already met alerting standards that would have ranked among the strictest 10% of settings used in 2020.

Gaps remained around indirect exposure, however, with Chainalysis finding that cryptocurrency exchanges sometimes set higher alert thresholds when illicit funds passed through intermediary wallets before reaching a platform.

The distinction matters for investigations involving offenders who move funds through several addresses or services before reaching a centralized platform where an account can potentially be identified.

Lawmakers have previously raised similar concerns about the use of cryptocurrency in payments tied to child exploitation. In April 2024, U.S. Senators Elizabeth Warren and Bill Cassidy pressed federal agencies for information about their ability to identify cryptocurrency transactions connected with CSAM.

Their letter to the Department of Justice and Department of Homeland Security asked the agencies to explain their technical capabilities and whether additional tools were needed to identify buyers and sellers.

The lawmakers cited earlier Chainalysis research that found increased cryptocurrency use in CSAM transactions and pointed to the use of privacy coins and cryptocurrency mixers to obscure financial trails.

Operation Lighthouse brought agencies together across continents

Europol Team Leader Danny van Althuis said offenders can use financial services, payment systems, social media and internet platforms to commit or facilitate online child sexual abuse, making cooperation across the sectors necessary.

"Law enforcement agencies around the world, including Europol, are ready to contribute to this coordinated effort," van Althuis said.

Internet Watch Foundation Hotline Manager Tamsin McNally said the organization contributed its expertise and intelligence to the operation as participants worked to disrupt criminal distribution networks.

McNally said victims and survivors can continue to be affected when material documenting their abuse remains in circulation online, making efforts to reduce its distribution important.

Block Chief Compliance Officer Tyler Hand said the collaboration allowed investigators, private companies and nonprofit organizations to combine their expertise while identifying activity even when illegal material itself was not located on financial platforms.

NCFTA Director of Operations Tim Lucey described the protection of vulnerable people as a priority for the organization and said effective disruption depends on cooperation between public authorities and private-sector participants.

Chainalysis said information generated through Operation Lighthouse will continue moving through investigative channels as authorities and participating companies develop cases, pursue account-level disruptions and assess leads that could result in arrests or prosecutions.
Read more: Hyperliquid price eyes $97 as HYPE holds above $80