In one of the largest coordinated efforts of its kind, blockchain analytics firm Chainalysis has identified more than 7,700 cryptocurrency accounts suspected of being linked to the distribution and monetization of child sexual abuse material (CSAM). The findings come from a multi-day investigative sprint dubbed “Operation Lighthouse,” which brought together law enforcement agencies, crypto exchanges, and nonprofit organizations to trace illicit activity across the surface and dark web.
What Is Operation Lighthouse?
Operation Lighthouse was a focused, high-intensity investigation hosted at the National Cyber-Forensics and Training Alliance in New York. Over several days, participants analyzed more than 29,000 crypto addresses and digital identifiers tied to over 100 known CSAM platforms, forums, and distribution networks.
The goal was simple but urgent: turn blockchain data into actionable leads that could protect children and bring offenders to justice. Using on-chain intelligence, investigators mapped transaction flows, clustered related wallets, and flagged high-risk accounts for follow-up legal action.
Scale of the Problem
The numbers reveal just how widespread the issue has become:
- 7,700+ suspect accounts flagged across the crypto ecosystem
- 14,300 investigative leads generated and shared with 11 crypto exchanges and payment services
- 125 countries represented among the flagged suspects
- 16 registered sex offenders identified within the suspect pool
Perhaps most alarming, Chainalysis noted that the suspect pool included individuals in positions of trust—military personnel, law enforcement officers, medical professionals, and educators, some with direct access to children.
“Behind every lead is a real child at risk,” said Tom McLouth, senior intelligence analyst at Chainalysis.
Who Was Involved?
Operation Lighthouse was a true public–private partnership. Participants included:
- Law enforcement and intergovernmental bodies: Europol, UK National Crime Agency
- Crypto industry players: Binance, Coinbase, Block (formerly Square)
- Specialized nonprofits: Internet Watch Foundation and others
These groups worked side by side, combining blockchain forensics with traditional investigative methods to build cases that could lead to arrests, prosecutions, and account-level disruptions.
How Crypto Is Being Abused in CSAM Operations
Cryptocurrencies are attractive to criminals because they can move value quickly and, in some cases, with a degree of pseudonymity. In CSAM operations, crypto is often used to:
- Monetize access: Charge users in crypto to enter private forums or view illegal content
- Pay distributors: Compensate uploaders, moderators, and site operators
- Launder proceeds: Move funds through multiple wallets and exchanges to obscure origins
Chainalysis used its software to analyze transactions, map user networks, and link wallet addresses to real-world entities where possible. This kind of clustering and attribution is critical for turning anonymous blockchain activity into investigable leads.
Why This Matters for the Crypto Industry
The operation underscores a growing reality: crypto is not just a tool for innovation—it’s also a vector for serious crime if left unchecked. For the industry, the implications are clear:
- Exchanges must act on leads: The 14,300 investigative leads shared with 11 exchanges and payment services will need rapid follow-up, including account freezes, enhanced monitoring, and cooperation with law enforcement.
- Compliance is non-negotiable: Strong know-your-customer (KYC) and anti-money laundering (AML) programs are essential to detect and report suspicious activity.
- Reputation and trust: High-profile cases like this can shape public perception of crypto. Proactive cooperation with authorities helps demonstrate that the industry takes its responsibilities seriously.
What Happens Next?
Chainalysis expects the results of Operation Lighthouse to lead to:
- Arrests and prosecutions in multiple jurisdictions
- Disruption of accounts linked to CSAM monet
Global Crypto Investigation Flags 7,700 Accounts Linked to CSAM Networks
A global investigation supported by blockchain analytics firm Chainalysis has identified more than 7,700 cryptocurrency accounts suspected of links to child sexual abuse material (CSAM) activity. The operation shows how public blockchain records can help investigators follow financial trails that may otherwise remain hidden across online platforms.
Operation Lighthouse Targets Crypto Abuse Networks
The investigation, known as Operation Lighthouse, focused on crypto activity connected to more than 100 CSAM websites, forums, and distribution networks across the open web and dark web. Investigators examined 29,120 crypto addresses and related digital identifiers during the operation.
The work was not limited to one country or one company. It brought together law-enforcement agencies, blockchain investigators, exchanges, payment companies, and nonprofit groups focused on online child safety. The goal was to turn suspicious transaction data into leads that authorities could use in formal cases.
Chainalysis said the operation produced around 14,300 investigative leads across 11 crypto exchanges and payment services. These leads involved suspected activity spanning 125 countries, underlining the global nature of both cryptocurrency networks and online child exploitation.
Why Blockchain Data Matters
Cryptocurrency transactions can appear anonymous because users usually send funds through wallet addresses rather than names. However, many blockchains store transaction histories publicly, allowing specialists to study how funds move between addresses over time.
Investigators can use this information to spot repeated payment patterns, trace transfers between wallets, and identify links to services where users may have completed identity verification. Those findings do not automatically prove criminal conduct, but they can give law enforcement a starting point for gathering evidence through legal channels.
In this case, Chainalysis and its partners used on-chain intelligence to map possible connections between crypto wallets and people or groups involved in CSAM-related platforms. The information is expected to support account disruption, further investigations, and potential legal action.
A Coordinated International Effort
Operation Lighthouse was held during a multi-day investigative sprint at the National Cyber-Forensics and Training Alliance in New York. The event followed months of data enrichment and preparation, according to reports on the operation.
Participating organizations included Europol, the United Kingdom’s National Crime Agency, Binance, Coinbase, Block, and the Internet Watch Foundation. Each group brought different skills, ranging from blockchain tracing and exchange compliance to law enforcement and child-protection expertise.
This type of cooperation is important because suspected offenders can move crypto quickly across borders, platforms, and wallet addresses. A wallet may be linked to activity in one country, an exchange in another, and a victim-support investigation somewhere else.
Suspect Accounts Are Not Final Verdicts
The 7,700 accounts named in the investigation are described as suspect accounts, not as confirmed criminal convictions. That distinction matters because blockchain analysis can identify risk signals and potential connections, while prosecutors and courts determine whether an individual has committed an offense.
Authorities must still verify evidence, follow due process, and obtain the legal approvals required to request customer information, freeze assets, or bring charges. This approach helps ensure that investigations are accurate while protecting legal rights.
Reports said the suspect pool included 16 registered sex offenders as well as people working in fields such as law enforcement, healthcare, education, and the military. Chainalysis warned that some identified individuals may have had direct access to children, making rapid follow-up especially important.
What Happens Next
The leads from Operation Lighthouse are expected to move into follow-up investigations by relevant authorities. These cases could result in arrests, prosecutions, account restrictions, or other enforcement actions, depending on the evidence and local laws.
Crypto exchanges also play a major role after suspicious wallet activity is identified. Where required and legally permitted, platforms can review accounts, file reports, respond to lawful requests, and take action against services that may be used for illegal transactions.
The case also highlights a key fact about digital assets: crypto transactions are not always invisible. While wallet addresses do not show a person’s name by default, the permanent record of transfers can become a powerful investigative tool when paired with compliance data and cross-border cooperation.
A Broader Warning for the Industry
Operation Lighthouse sends a clear message to criminals who use cryptocurrency for serious abuse: blockchain-based payments can leave a trace. The technology can be misused, but the same transparent ledger system can also help investigators build cases and disrupt harmful networks.
For the crypto industry, the investigation reinforces the need for strong compliance systems, responsible exchange monitoring, and close cooperation with child-safety organizations and law enforcement. The focus is not simply on tracking transactions; it is on helping protect children and preventing digital financial tools from supporting exploitation
