Chainalysis has generated 14,300 investigative leads after tracing 29,120 cryptocurrency addresses and digital identifiers linked to more than 100 child sexual abuse material platforms, forums and distribution networks.
Operation Lighthouse
The multi-day operation was held at the National Cyber-Forensics and Training Alliance in New York and brought together investigators, cryptocurrency companies and specialist nonprofit organizations to examine financial activity connected with child sexual abuse material. Chainalysis said Operation Lighthouse identified more than 7,700 suspect accounts through cryptocurrency exchanges and payment platforms, including accounts associated with 16 registered sex offenders.
Suspects were identified across 125 countries, giving the operation a cross-border scope that involved law enforcement agencies from several continents. Months of data enrichment preceded the investigative sprint, allowing participants to work from existing crypto intelligence tied to suspected CSAM consumers, vendors, marketplace operators and administrators.
14,300 Investigative Leads
During the sprint, participants used blockchain records and information held by partner organizations to identify suspected activity and develop leads that could support account-level investigations, legal requests and future cases. The operation was structured around specific investigative targets instead of functioning as a general training event. Investigators worked on priority leads while companies and nonprofit groups contributed data and expertise.
The resulting leads were shared across 11 cryptocurrency exchanges and payment services for further investigation and possible legal action. Cryptocurrency accounts for only a small portion of activity associated with CSAM, according to Chainalysis, although the company said its use has increased in recent years. Public blockchain records can leave financial trails that investigators can follow when payments pass through identifiable services such as centralized exchanges.
Exchanges Identify 7,700 Suspect Accounts
Private-sector participants identified more than 7,700 suspect accounts across exchanges and payment platforms after reviewing the intelligence developed during the operation. Sixteen of the accounts were linked to registered sex offenders. Binance, Coinbase and Block participated alongside the Australian Federal Police, Royal Canadian Mounted Police, the United Kingdom's National Crime Agency and Europol. The Internet Watch Foundation also contributed specialist expertise.
Binance Senior Program Manager for Anti-Child Sexual Exploitation Gavin Sather said cooperation between private companies and public authorities was important when harmful activity intersects with illicit finance. Binance has separately increased spending on financial-crime controls, spending about $300 million annually on compliance and employing nearly 1,500 people in related roles. The exchange reported intercepting $10.53 billion in potential fraud, scams and unusual activity between 2025 and the first quarter of 2026.
Earlier Research on Crypto and Illicit Activity
Chainalysis research published in February found that cryptocurrency flows connected with suspected human trafficking services increased 85% during 2025. The firm tracked hundreds of millions of dollars in transactions across services tied to Telegram-based escort operations, labor recruiters connected with Southeast Asian scam compounds and CSAM vendors. CSAM-related transfers in the February dataset were smaller than transactions involving some other categories, with an average payment below $100.
Bitcoin had previously been common across the identified CSAM services, while some operators had increasingly used privacy-focused Monero to obscure proceeds. Chainalysis also identified instant exchangers without know-your-customer requirements as part of the laundering process used by some operators.
Tightening Compliance Standards
Monitoring standards across cryptocurrency businesses have tightened over recent years. A May monitoring study found that 47% of crypto businesses entering the market in 2026 already met alerting standards that would have ranked among the strictest 10% of settings used in 2020. Gaps remained around indirect exposure, with Chainalysis finding that exchanges sometimes set higher alert thresholds when illicit funds passed through intermediary wallets before reaching a platform. The distinction matters for investigations involving offenders who move funds through several addresses or services before reaching a centralized exchange.
