TRM Labs

Grinex — the sanctioned Russian cryptocurrency exchange widely assessed as a successor to Garantex — lost approximately USD 15 million in a cyberattack on April 16, 2026. TRM on-chain analysis identified around 70 attacker-linked addresses, 16 more than Grinex publicly disclosed, and tied a second exchange to the same operation. What we found: 🔹 All known stolen funds were converted from USDT on TRON to TRX then consolidated at a single TRON address (~45.9 million TRX, or ~USD 14.98 million). 🔹 TokenSpot — a Kyrgyzstani exchange TRM assesses as a likely Garantex front company — had funds sent from two of its addresses to the same consolidation address. Both were out of service on April 15, consistent with being hit by the same attacker. 🔹 Grinex claims the attack was carried out by "the special services of unfriendly states." TRM has not independently verified that attribution. The two exchanges sit at the center of a broader Russian sanctions evasion network that has collectively processed hundreds of billions of dollars in state-adjacent financial activity. Read the full analysis ➡️ https://lnkd.in/eabTD6sK

March was a big month for TRM's blockchain intelligence. Sanctions coverage for A7 expanded by USD 16.3 billion, new attribution approaches unlocked USD 26 billion+ across major VASPs and DeFi protocols, and TRM's fraud intelligence powered Operation Atlantic, freezing USD 12 million and identifying 20,000+ victims. Here are some of the highlights from our March 2026 blockchain intelligence releases: ✅ 𝗦𝗮𝗻𝗰𝘁𝗶𝗼𝗻𝘀 𝗲𝘃𝗮𝘀𝗶𝗼𝗻 𝗰𝗼𝘃𝗲𝗿𝗮𝗴𝗲: A7 detection grew by USD 16.3 billion to USD 53.3 billion total, with a new EU-only sanctions category and expanded Iran coverage ✅ 𝗙𝗲𝗻𝘁𝗮𝗻𝘆𝗹 𝗮𝘁𝘁𝗿𝗶𝗯𝘂𝘁𝗶𝗼𝗻: USD 210 million in new fentanyl-linked coverage added, with a DOJ indictment validating attribution TRM had over a year in advance ✅ 𝗢𝗽𝗲𝗿𝗮𝘁𝗶𝗼𝗻 𝗔𝘁𝗹𝗮𝗻𝘁𝗶𝗰: TRM powered a multi-agency crackdown that froze USD 12 million and identified 20,000+ victims of crypto scams ✅ 𝗩𝗔𝗦𝗣 𝗮𝗻𝗱 𝗗𝗲𝗙𝗶 𝗰𝗼𝘃𝗲𝗿𝗮𝗴𝗲: New attribution approaches identified USD 26 billion+ in VASP infrastructure and 575 high-confidence DeFi addresses carrying USD 474 billion in volume Read the full release roundup here 👉 https://lnkd.in/g4hD-puB

💐 The Roundup team is in Paris this week for 𝗣𝗮𝗿𝗶𝘀 𝗕𝗹𝗼𝗰𝗸𝗰𝗵𝗮𝗶𝗻 𝗪𝗲𝗲𝗸 — and the timing couldn’t be more fitting. Spring in Paris has a way of bringing clarity, even to the most complex policy questions. Back in Washington, the past week has felt like a kind of regulatory spring awakening. The 𝗚𝗘𝗡𝗜𝗨𝗦 𝗔𝗰𝘁 is already reshaping the #stablecoin landscape as Treasury unveiled a sweeping NPRM on sanctions compliance, the FDIC advanced a framework for bank-issued payment stablecoins, and the SEC delivered its most detailed guidance yet on DeFi infrastructure. Spring has sprung — and crypto policy is moving just as fast, and just as globally. This week, Ari Redbord, Isabella Chase, and Angela Ang cover: 🇺🇸 SEC issues staff statement clarifying broker-dealer registration for DeFi user interface providers 🏦 FDIC proposes supervisory framework for payment stablecoin issuance through bank subsidiaries implementing the GENIUS Act 🇺🇸 Treasury drops landmark GENIUS Act NPRM — first codified OFAC sanctions compliance program requirement for a specific class of financial institution 🇮🇷 Iran deploys cryptocurrency for Strait of Hormuz transit tolls — first sovereign use of crypto as a revenue mechanism at a major maritime chokepoint 🇰🇷 South Korea's Bank of Korea governor nominee backs CBDC-led digital currency system, sees limited role for stablecoins 🇬🇧 UK's FCA opens consultation on crypto perimeter guidance as authorization window approaches Click in to read the stories 👇

TRM's data engineering team ran a controlled experiment to quantify something most data teams sense intuitively but rarely measure — the impact of data documentation on AI-powered analytics. The results were stark: 🔹 When 100 independent AI agents were given the same analytics question against a documented dataset, 99% returned the same answer. 🔹 Against an undocumented dataset? Just 36%. The practical takeaway: data documentation isn't a nice-to-have for onboarding analysts. It's a prerequisite for reliable AI analytics. 👉 Read the full methodology and findings of this experiment — now live on the tech blog: https://lnkd.in/eiNgHZpd

Big news for compliance teams and regulators: We’ve now expanded 𝐂𝐨-𝐂𝐚𝐬𝐞 𝐀𝐠𝐞𝐧𝐭™ to Block Explorer — enabling you to accelerate VASP due diligence. You can ask natural language questions to: ✅ Drill into on-chain data to quickly understand what exposure is driving a VASP’s risk score ✅ Evaluate KYC details and where the VASP is licensed to operate ✅ Zero in on any regulatory actions and adverse media With Co-Case Agent as your AI-assistant, organizations can assess and monitor entity risk with speed and precision. Learn more: https://lnkd.in/euzFkXyw

⏰ One week to go! Investigators in APAC timezones: Don't miss our next 𝐀𝐬𝐤 𝐭𝐡𝐞 𝐈𝐧𝐯𝐞𝐬𝐭𝐢𝐠𝐚𝐭𝐨𝐫 webinar with Tasmania Police. Detective Senior Constable Declan Gillett from Tasmania Police will explain how his team proactively targets high-risk crypto wallets using risk scoring, indicator analysis, and more. This is a rare look at how law enforcement methodology is applied, direct from the investigator building it. Secure your spot now 👇 🗓️ April 21, 2026 at 1:00pm AEDT | 10:00am GMT+8 🔗 Register now: https://lnkd.in/e3KbyHrw

Haven’t tuned into the latest #TRMTalks yet? Ari Redbord sat down for a chat with DC Anoop “Snoop” Dattani of the West Midlands Police Regional Organised Crime Unit — and it’s one of the most grounded, practical conversations about crypto investigations we’ve had on the show. Snoop has been doing this work for over 20 years. What comes through in the conversation is not just his expertise, but his genuine belief in what he’s protecting. For anyone working in crypto compliance, law enforcement, or the broader ecosystem — this is worth your time. 🎧 https://lnkd.in/erfPhAap

Paris Blockchain Week is about to begin. TRM's Alex Kopferschmitt Ari Redbord Clara Caizergues Guillaume Rodenas Heloisa Schäffer Guarezi Luke DufourRichard Mutabazi will be on the ground throughout — and we’d love to connect on what’s top of mind in compliance, investigations, and risk as institutional adoption accelerates. A few easy ways to meet up: 📍 Visit us at Booth 19B 🏛️ Catch Ari Redbord at The Odds: Prediction Markets Live (Louvre, Paris) — April 15 🏃♀️ Join the official #TRMRunClub at Paris Blockchain Week — April 16 🥂 Hypernative x TRM Labs Soirée dinner — April 16 Sign up for the run club: https://luma.com/sm6tpyme

We are hiring! Join our mission of building a safer world for billions of people!

We are hiring! Join our mission of building a safer world for billions of people!