Chainalysis investigation targeted 7700 accounts involved in child abuse cases

Blockchain analytics company Chainalysis said a global operation it helped lead discovered more than 7700 suspicious accounts linked to child sexual abuse material (CSAM).

The work, disclosed in a press release on Tuesday, targets encryption activity related to more than 100 CSAM platforms, forums and distribution networks active on the surface and dark networks. The multi-day intensive operation, known as Operation Lighthouse, focuses on tracking on-chain and related identifiers to build investigative leads designed to support arrests, prosecutions and account-level crackdowns. The operation also involved exchanges and payment services and flagged suspects in 125 countries, including 16 registered sex offenders.

Core Points

Operation Lighthouse allegedly investigated 29120 encrypted addresses and digital identifiers associated with more than 100 CSAM-related platforms and forums. Chainalysis said the operation generated 14300 investigative leads across 11 exchanges and payment services. The tagged suspects are located in 125 countries, including 16 registered sex offenders, as well as individuals who may have direct contact with children. Chainalysis sees this operation as a collaborative model that connects on-chain intelligence with subsequent legal processes. The action further furthers extensive efforts by exchanges and law enforcement agencies to improve intelligence sharing on crypto-related exploitation.

Operation Lighthouse: The scale of tracking and clue generation

According to Chainalysis, Operation Lighthouse investigated 29120 encrypted addresses and digital identifiers associated with more than 100 CSAM platforms, forums and distribution networks. These sources span the surface and dark networks, a distinction that is important to investigators because the way illegal content is organized and marketed varies, and financial models and infrastructure can also vary. The company said the action generated 14300 investigative leads and identified activity involving 11 crypto exchanges and payment services, indicating that the initiative aims to go beyond mapping and link tracking results to potential points of intervention within a regulated or semi-regulated track. Chainalysis further reported that suspects were flagged in 125 countries. Among the people identified were 16 registered sex offenders, and Chainalysis said the suspect group also includes military personnel, law enforcement officials, medical professionals and educators-groups that may be at higher risk due to access to authority, trust or institutional authority in the context of child exploitation.

How to use chain intelligence in investigations

Chainalysis said the operation was conducted in the form of a concentrated operation for several days at the National Alliance for Cyberforensics and Training in New York. The action was "held" here after months of fleshing out data, suggesting that the work relied on a previous analytical basis rather than starting from scratch. Participants allegedly used on-chain intelligence to develop clues to support subsequent legal proceedings and case development. Chainalysis said it expected the results to lead to arrests, prosecutions and account-level crackdowns. From an investor and compliance perspective, the practical value of such efforts is that they transform otherwise abstract blockchain analysis into actionable investigation paths. Address clustering, transaction attribution, and cross-references between payments and identifiable actors can help authorities focus scarce law enforcement resources on evidence-related targets, rather than treating illegal activity as an unstructured network of addresses.

Participants: Law enforcement agencies, exchanges and professional non-profit organizations

Chainalysis said Operation Lighthouse brought together law enforcement agencies, private sector partners and professional non-profit organizations. According to reports, participants include Europol, the UK's National Crime Agency, Binance, Coinbase, Block and the Internet Watch Foundation. Binance also emphasized intelligence sharing related to human trafficking and child exploitation. In July, the exchange announced a partnership with the nonprofit organization Stop The Traffik, saying the group would provide intelligence, training and insights aimed at improving the detection and investigation of crypto activities related to trafficking and child exploitation. More broadly, Europol believes joint operations are crucial because criminals use financial services, payment systems and online platforms as part of their operating models. This logic is consistent with Chainalysis's description of the operation's structure: investigators and partners use shared intelligence, escalation and law enforcement channels.

Background: Blockchain tracking has assisted previous CSAM crackdowns

Operation Lighthouse follows previous law enforcement cases in which blockchain tracing helped authorities link crypto payments to operating infrastructure and individual suspects. In 2019, the U.S. Department of Justice announced the ban on "Welcome to Video," which was then described as the largest dark web market for child sexual exploitation by content volume. According to a Justice Department announcement, authorities tracked Bitcoin payments to locate the website's server in South Korea and identified its administrator. The investigation resulted in the arrest and prosecution of 337 users, at least 23 victims were rescued and approximately 8TB of material seized. The Justice Department's statement also described how investigators used the clues to disrupt all aspects of the platform's ecosystem. Chainalysis said its software is used to analyze transactions and map the site's users and contributors. Compared with previous cases, Operation Lighthouse reflects a pattern that has become more evident over time: the focus shifts from tracking as a one-time investigative tool to a more continuous intelligence cycle-with analysis results quickly shared with exchanges and law enforcement partners, with account-level strikes as clear targets alongside arrests.

Why is this important for the crypto ecosystem

Actions like Operation Lighthouse highlight the operational reality that crypto platforms increasingly face: CSAM investigations increasingly rely on data integration across multiple entities, including exchanges, payment services, professional NGOs, and international law enforcement agencies. For the industry, the impact lies less in public announcements than in the availability of detection systems, upgrade channels and investigation preparation capabilities that can transform on-chain signals into timely action. Still, observers have key questions. Chainalysis did not provide the identity of the marked suspects or say what specific results the resulting clues would bring. Readers should pay attention to subsequent enforcement announcements and how participating platforms report improvements in monitoring and investigation workflows related to child exploitation and trafficking risks.