TRM Labs

TRM's Threat Graph draws attribution from 180-plus blockchains and the largest set of commercial intelligence sources in the industry. On-chain heuristics are combined with off-chain data — sanctions lists, dark-web scraping, and cyber-threat reporting — to identify wallets and transaction clusters tied to more than 40 categories of illicit activity. The firm refreshes this graph continuously, which allows analysts to trace a suspect's on-chain footprint even when funds move across chains or through obfuscation layers.

Orion is trained on real investigative workflows, not generic search. Embedded inside TRM Forensics, it reasons across blockchain records, known threat-actor intelligence, and victim reports to cluster related wallets, surface the entity behind an address, and generate freeze packages or tipline summaries in minutes. The output is built to support evidentiary standards — TRM states the tool has been used on complex cases and proven in court, which is a higher bar than cluster labels from open-source explorers.

TRM Labs is a software company that sells blockchain-intelligence subscriptions to government agencies and financial institutions. It does not custody assets, execute trades, or offer investigative services directly. Its clients use TRM's platform to run their own investigations, compliance checks, and risk assessments, with TRM's AI agents accelerating each step.

Beacon Network connects over 70 financial institutions — crypto exchanges and other platforms that collectively handle roughly 75 percent of global crypto volume — with law-enforcement flaggers in more than 21 countries. When a flagger identifies a suspect wallet, the network's participants receive an alert and can choose to freeze linked funds. TRM reports that hundreds of millions of dollars in illicit crypto have been frozen through the network, which operates as the largest public-private partnership of its kind.

National-security and defense agencies use TRM's platform on classified networks to track adversary financing, attribute cyber infrastructure, and support counter-terror and counter-proliferation missions. The firm's own disclosure confirms that the software is deployed in classified environments, enabling intelligence analysts and special agents to trace sanctions-evasion networks and state-backed threats without moving sensitive data to commercial clouds.

TRM's primary focus is crypto-native crime and the laundering pipelines that move illicit proceeds into and across digital assets. However, because many schemes — investment fraud, pig butchering, sanctions evasion — involve interactions between crypto rails and fiat banking, the platform's tracing capabilities are used to support broader financial-crime investigations that span both worlds. The firm does not claim to provide traditional anti-money-laundering monitoring for fiat-only transactions.

The firm competes directly with other blockchain-analytics providers, most notably Chainalysis and Elliptic. All three sell investigation and compliance software to the same buyer set of public-sector agencies, crypto exchanges, and financial institutions. Differentiation tends to turn on data coverage (number of chains and assets mapped), the sophistication of automated tracing, and the depth of relationships inside the law-enforcement community.