Chainalysis Probe Targets 7,700 Accounts in Child Abuse Case

Blockchain analytics firm Chainalysis says a global operation it helped lead uncovered more than 7,700 suspect accounts tied to child sexual abuse material (CSAM). The work—described in a Tuesday press release shared with Cointelegraph—targets crypto activity associated with more than 100 CSAM platforms, forums, and distribution networks operating across both the surface and dark web.

Chainalysis said the multi-day sprint, known as “Operation Lighthouse,” focused on tracing on-chain and related identifiers to build investigative leads intended to support arrests, prosecutions, and account-level disruption. The effort also involved exchanges and payment services and flagged suspects across 125 countries, including 16 registered sex offenders.

Key takeaways

• Operation Lighthouse reportedly investigated 29,120 crypto addresses and digital identifiers connected to over 100 CSAM-related platforms and forums.
• Chainalysis says the operation generated 14,300 investigative leads across 11 exchanges and payment services.
• Suspects flagged spanned 125 countries, including 16 registered sex offenders, and potentially individuals with direct access to children.
• Chainalysis framed the effort as a collaboration model connecting on-chain intelligence to follow-on legal processes.
• The operation adds to a broader push by exchanges and law enforcement agencies to improve intelligence sharing around crypto-linked exploitation.

Operation Lighthouse: scale of the tracing and lead generation

According to Chainalysis, Operation Lighthouse investigated 29,120 crypto addresses and digital identifiers connected to over 100 CSAM platforms, forums, and distribution networks. These sources span both the surface web and the dark web, a distinction that matters for investigators because financial patterns and infrastructure can differ depending on how illicit content is organized and marketed.

The firm said the operation produced 14,300 investigative leads. It also identified activity involving 11 crypto exchanges and payment services, indicating that the initiative aimed to go beyond mapping and instead connect tracing results to potential points of intervention within regulated or semi-regulated rails.

Chainalysis further reported that suspects were flagged across 125 countries. Among those identified were 16 registered sex offenders, and Chainalysis said the suspect pool also included military personnel, law enforcement officers, medical professionals, and educators—groups that, in the context of child exploitation, can carry heightened risk due to access, trust, or institutional authority.

“Behind every lead is a real child at risk,” Chainalysis senior intelligence analyst Tom McLouth told Cointelegraph.

How on-chain intelligence was used in the investigation

Chainalysis said the operation ran as a multi-day sprint at the National Cyber-Forensics and Training Alliance in New York. It was “hosted” there after months of data enrichment, suggesting the work relied on prior analytical groundwork rather than starting cold.

Participants reportedly used on-chain intelligence to develop leads intended for follow-on legal processes and case development. Chainalysis said results were expected to lead to arrests, prosecutions, and account-level disruption.

From an investor and compliance perspective, the practical value of efforts like this is that they convert otherwise abstract blockchain analytics into actionable investigative pathways. Address clustering, transaction attribution, and cross-referencing between payments and identifiable actors can help authorities focus scarce enforcement resources on targets with evidentiary links—rather than treating illicit activity as an unstructured web of addresses.

Who joined: law enforcement, exchanges, and specialized nonprofits

Chainalysis said Operation Lighthouse brought together law enforcement agencies, private-sector partners, and specialized nonprofits. Reported participants included Europol, the UK National Crime Agency, Binance, Coinbase, Block, and the Internet Watch Foundation.

Binance, for its part, has also highlighted intelligence-sharing efforts tied to human trafficking and child exploitation. In July, the exchange announced a partnership with nonprofit Stop The Traffik, stating that the organization would provide intelligence, training, and insights designed to improve detection and investigation of crypto activity linked to trafficking and child exploitation. (Earlier coverage from Cointelegraph noted this partnership in a dedicated report: “Binance, Stop The Traffik anti-human trafficking”.)

More broadly, Europol has argued that joint action is essential because perpetrators use financial services, payment systems, and online platforms as part of their operating model. That logic aligns with Chainalysis’ description of the operation’s structure: investigators and partners using a shared pipeline for intelligence, escalation, and enforcement.

Context: blockchain tracing has supported earlier CSAM takedowns

Operation Lighthouse comes after previous enforcement cases where blockchain tracing helped authorities tie crypto payments to operational infrastructure and individual suspects. In 2019, the US Department of Justice announced the takedown of “Welcome to Video,” described at the time as the largest darknet child sexual exploitation market by content volume.

According to the DOJ announcement, authorities traced Bitcoin payments to locate the website server in South Korea and identify its administrator. The investigation reportedly resulted in 337 users being arrested and charged, the rescue of at least 23 victims, and the seizure of about eight terabytes of material. The DOJ’s statement also described how investigators used those leads to dismantle aspects of the platform’s ecosystem.

Chainalysis said its software was used to analyze transactions and map the site’s users and contributors, referencing its own write-up of the analysis involved in the Welcome to Video shutdown: “Chainalysis: DOJ Welcome to Video shutdown”. (The DOJ press release is available at this page.)

Compared with that earlier case, Operation Lighthouse reflects a pattern that has become more pronounced over time: the emphasis is shifting from tracing as a one-off investigative tool toward a more continuous intelligence loop—where analytics outputs are shared quickly with exchanges and law enforcement partners, and where account-level disruption becomes a stated end goal alongside arrests.

Why this matters for the crypto ecosystem

Operations like Lighthouse underline a growing operational reality for crypto platforms: CSAM investigations increasingly rely on data integration across multiple entities, including exchanges, payment services, specialized NGOs, and international law enforcement. For the sector, the implication is less about public-facing statements and more about the availability of detection systems, escalation channels, and investigative readiness that can translate on-chain signals into timely action.

Still, key questions remain for observers. Chainalysis did not provide details on the identities of the flagged suspects or the specific outcomes that will follow from the leads generated. Readers should watch for subsequent enforcement announcements and for how participating platforms report improvements in monitoring and investigation workflows tied to child exploitation and trafficking risks.