Skip to content

Company

TRM Labs

TRM Labs is a blockchain intelligence firm that traces crypto transactions to help detect fraud and sanctions evasion.

Known aliases

  • TRM
  • TRM Lab
  • TRM Labs

Current stories

investOne report1 publisher

Siluanov, Tsivilev and Manturov take A7 board seats two weeks after its OFAC designation

Three senior Russian officials, including the finance minister, joined A7's board two weeks after OFAC's criminal designation, Cryptopolitan reports. The seats confirm a state link A7 already had, so open exposure sits with the intermediaries around it.

Reality

Evidence50
Adoption60
Hype gap+15
Incentives
Not scored
Confidence50
investConfirmed6 publishers

Bitquery counts $102 million drained from 324 Ledger-linked wallets across six chains

Bitquery estimates $102 million was drained from 324 Ledger-linked wallets on six chains, up from about $86 million earlier. Ledger says its chips, software and servers were not breached and calls it a distribution-channel attack.

Perspective Coverage

6 publishers
Builder
Builder 23%
Operator
Operator 44%
Investor
Investor 33%

Reality

Evidence55
Adoption
Not scored
Hype gap+12
Incentives55
Confidence60
securityConfirmed14 publishers

Civil suit lets Microsoft and Health-ISAC seize domains behind more than 1 billion phishing messages

Microsoft and Health-ISAC seized domains behind YAM Store, CoGUI and Iron Man, phishing services tied to more than 1 billion messages since January. Microsoft's Steven Masada wrote that the three are only part of a larger criminal network.

Perspective Coverage

14 publishers
Builder
Builder 11%
Operator
Operator 68%
Investor
Investor 21%

Reality

Evidence70
Adoption70
Hype gap+15
Incentives55
Confidence74
investConfirmed6 publishers

Chainalysis counts 138 million x402 agent payments, most of them worth 10 cents or less

Chainalysis counted more than 138 million agent payments through x402 on Base, over 87% of them worth 10 cents or less. CoinDesk noted that transaction counts alone do not establish how much is genuine commercial demand.

Perspective Coverage

7 publishers
Builder
Builder 33%
Operator
Operator 25%
Investor
Investor 42%

Reality

Evidence55
Adoption38
Hype gap+30
Incentives
Not scored
Confidence62
securityOne report1 publisher

UK sanctions Cryptomus, VexPay, TokenSpot and Tsunami Payments over Russia-linked payment flows

Britain sanctioned Cryptomus, also operating as Heleket, on October 8, freezing its assets at UK banks and barring British firms from dealing with it. Canada's CAD $176 million fine did not stop the platform; analyst Richard Sanders says sanctions do.

Reality

Evidence58
Adoption
Not scored
Hype gap+15
Incentives
Not scored
Confidence60
investConfirmed6 publishers

Treasury sanctions the company that built BitBank's exchange software

OFAC's Sept. 17 action covers the Tehran exchange, its developer Pishtaz Simorgh and three Dot One executives, over hundreds of millions of dollars in Bitcoin that Treasury says moved to the IRGC in June and July.

Perspective Coverage

6 publishers
Builder
Builder 18%
Operator
Operator 52%
Investor
Investor 30%

Reality

Evidence55
Adoption
Not scored
Hype gap+20
Incentives60
Confidence60
investOne report1 publisher

Suspect in Ledger reseller breach routes $1.34 million through Tornado Cash and Binance

Onchain Lens traced 430.2 ETH, about $1.07 million, from a suspect in the Ledger CryptoBilis reseller breach into Tornado Cash, plus $270,280 into Binance. The flows are under 2% of the $70.6 million TokenPost valued in the suspect's wallets, so most of what the suspect holds has not been traced to a mixer or exchange as Ledger investigates.

Reality

Evidence45
Adoption
Not scored
Hype gap+10
Incentives
Not scored
Confidence40
investConfirmed7 publishers

Britain sanctions five crypto platforms a week after Washington blacklisted Russia's A7 network

Britain sanctioned three crypto exchanges and two payment platforms on Oct. 8, two of them suspected of handling transactions for Russia's A7 network. Washington blocked A7 a week earlier and Brussels barred dealings with 14 crypto platforms in July, so firms near these rails now answer to three overlapping regimes.

Perspective Coverage

7 publishers
Builder
Builder 19%
Operator
Operator 55%
Investor
Investor 26%

Reality

Evidence72
Adoption
Not scored
Hype gap+15
Incentives40
Confidence68
investConfirmed7 publishers

4,200 BTC walked off Liquid behind an on-chain note claiming white-hat intent

Blockstream has not said whether its 11-of-15 federation was bypassed or complied. Until someone publishes what share of Liquid's reserves left on September 6, an L-BTC balance is an unverified claim.

Perspective Coverage

7 publishers
Builder
Builder 30%
Operator
Operator 40%
Investor
Investor 30%

Reality

Evidence62
Adoption
Not scored
Hype gap+25
Incentives60
Confidence58
investConfirmed5 publishers

Japan's Garantex freeze lands 19 months after police seized the exchange's servers

Japan froze the assets of Garantex, a Moscow crypto exchange that processed at least $96 billion, in Russia sanctions that took effect on October 2. Any exchange or payment firm that touches Garantex now carries Japanese legal risk on top of its US and EU exposure.

Perspective Coverage

5 publishers
Builder
Builder 12%
Operator
Operator 60%
Investor
Investor 28%

Reality

Evidence76
Adoption
Not scored
Hype gap+20
Incentives
Not scored
Confidence72
investConfirmed4 publishers

MetaMask's Sept. 30 breach idles its staking clients' ETH for roughly 90 days

MetaMask's validator key rotation after its Sept. 30 breach sends clients' staked ETH through exit and re-entry queues of about 45 days each. Joseph Lubin says self-custodied wallets were never within the attackers' reach, so the cost of the incident lands on staking clients.

Perspective Coverage

4 publishers
Builder
Builder 28%
Operator
Operator 40%
Investor
Investor 32%

Reality

Evidence62
Adoption40
Hype gap+35
Incentives55
Confidence58
investOne report1 publisher

Ethereum Foundation's answer to Bybit-style theft waits until 2027 at the earliest

Ethereum Foundation says EIP-7906, a check that could have reverted the $1.5 billion Bybit theft, will not ship before 2027. Its own post concedes the check cannot stop the stolen-key and social-engineering attacks behind most of 2026's losses.

Reality

Evidence45
Adoption2
Hype gap+10
Incentives55
Confidence50
investConfirmed3 publishers

Issuers and protocols have frozen about 0.2% of the $387 million taken from Bitget

Chainalysis tied the $387 million Bitget hack to North Korea-linked hackers, saying it pushed their 2026 crypto theft past $1 billion. Its AI cut more than 20 hours of tracing to minutes, while the bill falls on a Bitget user fund the exchange puts above $464 million.

Perspective Coverage

3 publishers
Builder
Builder 32%
Operator
Operator 41%
Investor
Investor 27%

Reality

Evidence70
Adoption25
Hype gap+35
Incentives60
Confidence65
securityConfirmed5 publishers

Treasury sanctions 10 over Ploutus ATM jackpotting it ties to Tren de Aragua

Treasury's OFAC sanctioned 10 people over Ploutus ATM jackpotting, a scheme US officials tie to at least 1,500 attacks and $40.7 million in losses. Treasury calls the thefts a key revenue source for the Venezuelan criminal group Tren de Aragua.

Perspective Coverage

5 publishers
Builder
Builder 19%
Operator
Operator 56%
Investor
Investor 25%

Reality

Evidence70
Adoption
Not scored
Hype gap+20
Incentives55
Confidence68
investConfirmed6 publishers

Treasury designates Russia-linked A7 payments network a transnational criminal organization

OFAC designated A7, a Russia-linked payments network that reportedly settled over $86 billion in its first year, a transnational criminal organization. FinCEN's same-day proposal to bar transfers through A7's sub-agents gives banks and crypto firms a new screening job aimed at intermediaries.

Perspective Coverage

6 publishers
Builder
Builder 17%
Operator
Operator 47%
Investor
Investor 36%

Reality

Evidence70
Adoption62
Hype gap+15
Incentives55
Confidence70
investOne report1 publisher

After a $23.75 million oracle-credential drain, Ostium rebuilds its trading stack around Gateway

Ostium is rebuilding its trading stack around Gateway, three months after an attacker holding legitimate oracle-signer credentials drained $23.75 million. The new system has to keep execution fast enough for institutional hedging and also show that stolen credentials can no longer push a false price through.

Reality

Evidence55
Adoption
Not scored
Hype gap+35
Incentives65
Confidence45
investOne report1 publisher

ESMA would license the exchanges and wallets that route EU users into DeFi

ESMA proposed a new regulated MiCA service for firms that give users access to DeFi, a sector the EBA and ESMA put at about 4% of global crypto value. Exchanges and wallet apps serving EU users would carry the compliance cost, while the protocol code itself stays outside the regime.

Reality

Evidence45
Adoption
Not scored
Hype gap+20
Incentives
Not scored
Confidence40
investConfirmed2 publishers

Senate staff say $34.6 million left Hezbollah-linked wallets while Tether took nine months to freeze them

Senate staff say Tether froze 5 of 39 Hezbollah-linked wallets Israel named in 2023 while $34.6 million left the rest. Treasury and the Justice Department can act on that freeze record more readily than on the report's 84% USDT share when they answer Blumenthal by Oct. 9.

Reality

Evidence55
Adoption
Not scored
Hype gap+20
Incentives60
Confidence55

Earlier coverage

  1. Bitget presses THORChain to cut off the wallets holding its stolen $387.5 million

    Invest · September 26, 2026 · Confirmed3 publishers

  2. Bitget's own approval process moved out $388 million on spoofed transaction data

    Product · September 25, 2026 · Confirmed3 publishers

  3. Chainalysis sues DHS and ICE, and the real target is sole-source procurement

    Invest · August 16, 2026 · Confirmed4 publishers

  4. Five new Iran determinations widen the sanctions perimeter to eight lines of business

    Security · August 25, 2026 · Confirmed6 publishers

  5. Cronos validators halted the chain to strand $68m of a $74m Tectonic borrow

    Security · August 31, 2026 · Confirmed3 publishers

  6. A fake Google and Gemini call delivered 94% of the thefts named in Malone Lam's plea

    Invest · September 8, 2026 · Confirmed5 publishers

  7. OFAC sanctions Xinbi Guarantee, the marketplace that absorbed Huione's scam-center trade

    Security · September 10, 2026 · Confirmed3 publishers

  8. Hackers priced 680 Revolut customer files at roughly $4,300 each

    Invest · September 17, 2026 · Confirmed3 publishers

  9. Binance's 97.3% Iran cleanup figure starts from a $4.19 million base

    Invest · September 22, 2026 · Confirmed3 publishers

  10. EvilTokens rented an AI-powered inbox-scanning tool and a device-code MFA bypass for a $1,500 fee plus $500 a month

    Security · September 22, 2026 · Confirmed8 publishers

  11. TRM sizes this year's AI agent payments on x402 at $4 million at the outside

    Invest · September 23, 2026 · Confirmed3 publishers

  12. South Korea built its Polymarket gambling case out of public blockchain records

    Invest · September 17, 2026 · Confirmed3 publishers

  13. CoinEx gives customers 98 days to empty a solvent exchange

    Invest · September 16, 2026 · Confirmed3 publishers

  14. Screening Xinbi's 52 blocked addresses catches about 35% of the $24bn Treasury counted

    Invest · September 11, 2026 · Confirmed2 publishers

  15. Harmony offers validators nine times its DeFi TVL to switch off its own chain

    Invest · September 7, 2026 · Confirmed3 publishers

  16. Symbiosis's attacker turned 2^62 fake syBTC into 4.39 real WBTC

    Invest · September 11, 2026 · One report1 publisher

  17. The $24M "AI mining" Ponzi: the wrapper was new, the payment schedule was not

    Invest · August 25, 2026 · Confirmed3 publishers

  18. Singapore's exchange raids stop looking like incident response

    Invest · August 15, 2026 · Confirmed2 publishers