29,120 addresses in one sprint

Chainalysis published its account of Operation Lighthouse on 25 August. The format is worth describing precisely, because it is the finding: rather than a long investigation, it was a multi-day sprint that put law enforcement, exchanges and non-profits in one room and worked existing child sexual abuse material intelligence into actionable leads.

Who was in the room

• More than nine law enforcement agencies, including the Australian Federal Police, the Royal Canadian Mounted Police, the UK National Crime Agency and Europol.
• More than thirteen private sector partners, Binance, Coinbase and Block among them.
• Specialist non-profits including the Internet Watch Foundation.
• Hosted by the National Cyber-Forensics and Training Alliance in New York.

What came out

• 29,120 cryptocurrency addresses investigated.
• More than 100 distinct platforms, forums and distribution networks targeted.
• 14,300 investigative leads generated.
• More than 7,700 suspect accounts identified, across 125 countries.
• 16 registered sex offenders identified by private sector partners.

Why the format is the point

The intelligence in this operation largely existed already, distributed across agencies and exchanges that could not see each other's half of it. Chain analysis works across jurisdictions in a way that legal process does not, and the constraint on converting it into cases has been organisational rather than technical.

A concentrated sprint is a way of buying past that constraint for a few days. The measure of whether it worked is not the lead count but what happens to it: Chainalysis expects prosecutorial outcomes through 2027, and that is the number this desk will come back for.