TRM Labs Rolls Out ‘Kill Chain’ to Automatically Flag Dirty Crypto

Blockchain forensics firm TRM Labs has launched a new real-time intelligence system called Beacon Network, designed to detect fraud-linked cryptocurrency before it can be converted into cash.

The project brings together exchanges, custodians, stablecoin issuers, law enforcement agencies, and security researchers onto a shared alarm system, the New York-headquartered firm said in a blog post on Wednesday.

TRM Labs noted that more than $47 billion has been sent to fraud-related addresses since 2023. Blockchain firms that track stolen value report that 2025 has already seen more than $2 billion taken from crypto services, with a single Bybit incident accounting for roughly $1.5 billion.

And for quite a long time, coordination between investigators and crypto platforms has lagged. Law enforcement typically works in isolation, chasing funds long after they have left blockchains, while exchanges receive incomplete or delayed alerts about illicit wallets.

In September 2020, North Korean Lazarus Group hackers began trading $5.4 million within nine minutes after breaching Eterbase, a Slovakian exchange, while it took them just a few months to launder over $1.2 billion stolen from Bybit.

Beacon Network, backed by a group of crypto-heavyweights like Coinbase, Binance, Robinhood, and Stripe, among others, aims to close that gap.

Automated Crime Watch

In the Beacon Network, verified investigators, including ZachXBT, Security Alliance (SEAL), and zeroShadow, flag blockchain addresses tied to hacks and scams, and the system then traces related wallets automatically and distributes alerts across participating platforms, TRM Labs explained.

If stolen funds arrive at a member exchange or payment provider, the network triggers an instant notification, allowing the platform to freeze or review the deposit before withdrawal.

In a commentary for The Defiant, Ari Redbord, global head of policy and government affairs at TRM Labs, said that the network covers more than 90 blockchains — both L1s and L2s — with that coverage “expanding constantly.”

“When an illicit wallet is flagged, Beacon auto-traces those funds downstream and intelligently propagates the flag — sometimes to tens of thousands of new addresses — so investigators and exchanges see the full flow rather than a single stale wallet,” Redbord explained.

Beacon Chain, described by TRM Labs as a “kill chain,” will target key areas including North Korean hack funds, ransomware payments, terrorism financing, scam victim recovery, and CSAM-related flows.

If funds land on a sanctioned or non-cooperative platform, Redbord said the network “will still trace them on-chain, but, of course, without legal authority and cooperation, those funds can’t be frozen.”

Vetted law enforcement agencies participating in the network are based in Canada, the U.S., the U.K., Ireland, Germany, the Netherlands, Switzerland, Spain, Portugal, Australia, South Korea, and other countries.