chainalysis

Tron, Tether, and Chainalysis announced the establishment of a joint initiative called the "Digital Crime Task Force," aimed at identifying and combating illegal activities utilizing USDT on the Tron blockchain. The three parties stated that the task force will collaborate with law enforcement agencies through intelligence gathering to shorten the interval from threat identification to enforcement action, accelerating the asset freezing process before criminals can transfer funds. Tron founder Justin Sun stated that millions rely on USDT on Tron to sustain their livelihoods and businesses, and as digital finance reaches more people, the ability to protect must also be enhanced accordingly.The establishment of the task force comes against the backdrop of rising threats from AI-driven scams and cyberattacks in the cryptocurrency industry. Chainalysis pointed out that by 2025, the profit efficiency of AI-enabled scams will be 4.5 times that of traditional methods, with identity impersonation scams increasing by over 1400% year-on-year. Tether CEO Paolo Ardoino stated that criminals are using AI to accelerate their actions, and waiting for victims to report is no longer sufficient; Tether has collaborated with over 360 law enforcement agencies in 73 countries to freeze over $7 billion related to illegal activities.The task force plans to cover threat types including investment and romance scams, hacking attacks, terrorist financing, and North Korea-related cyberattacks. This formation follows the dissolution of a previous alliance: in 2024, Tron, Tether, and TRM Labs established the "T3 Financial Crime Group," which, according to Bloomberg earlier this month, was disbanded due to slow response and lack of coordination among members. Earlier this week, the cross-chain interoperability protocol Across resumed operations after experiencing a domain hijacking, and blockchain infrastructure provider Chainstack also disclosed that it faced an AI-driven security breach last month, leaking customer names, emails, and password hashes.

The Scottish High Court sentenced 29-year-old Robert Barr to 8 years in prison for allegedly planning to steal cryptocurrency while in prison, with the amount involved reaching up to £2 million (approximately $2.7 million). Co-defendants Sean Favier (26) and Iain Doyle (37) both admitted to participating in serious organized crime, receiving sentences of 4 years and 5 years, respectively. Judge Lord Cubie stated that this case combines 21st-century computer technology with old-fashioned burglary.According to court disclosures, Barr's plan was to have Favier and Doyle enter a residence near Midlothian, Edinburgh, and force the victim to install remote control software AnyDesk on their computer, allowing Barr, who was serving a 21-month fraud sentence at HMP Edinburgh at the time, to remotely control the computer and transfer cryptocurrency into a wallet under his control. Around 11:30 PM on April 17, 2024, the two arrived at the residence, but the homeowner couple discovered them through the doorbell camera and refused to open the door, causing the plan to fail.Investigators recovered months of preparations from Barr's phone, which was seized in June 2024, including identifying the victim, collecting photos of the house, and conducting reconnaissance. The phone messages explicitly mentioned threats or violence. The victim is a co-founder of a cryptocurrency startup, whose accomplices had previously stolen a cryptocurrency wallet in January 2024 but were unable to access the funds due to a lack of a PIN code. Prosecutors described Barr as a "seasoned cybercriminal." The judge will consider issuing a serious crime prevention order against him on November 17, and Barr is currently detained due to potential extradition matters. According to a report by Chainalysis, the amount stolen in such "ransom attacks" exceeded $30 million in the first half of 2026.

According to The Wall Street Journal, the Binance hackers immediately launched a large-scale money laundering operation after their heist. According to Chainalysis data, the organization dispersed the funds to over 10,000 cryptocurrency wallets.Some cryptocurrency service providers continued to process transactions related to the theft and charge fees even after the FBI called for a halt. THORChain processed over $46 million in stolen funds within 72 hours of the theft and charged over $200,000 in fees; nearly $4 million was mixed through Wasabi Wallet.Some developers stated that they could not prevent North Korean hackers from laundering money through their platform, which has frustrated law enforcement agencies.

Blockchain analysis company Chainalysis stated that it has confirmed that certain customer information, including the names, usernames, password hashes, and valid tokens of all Chainalysis users, was exposed to a malicious actor during this security incident. During the investigation, access to Reactor and Data Solutions was cut off by the officials. There is currently no evidence that any investigative data was accessed or that Chainalysis's attribution data was tampered with.It is reported that the officials implemented additional proactive monitoring systems to detect abnormal activities. After abnormal activities were discovered today, the KYT (User Interface and API) and other address screening products and login pages were taken offline. Customers whose KYT accounts appear to have been accessed without authorization are being directly notified.Chainalysis plans to restore access to KYT and address screening starting tomorrow. Customers can send trusted IP addresses to support@chainalysis.com or contact the Chainalysis customer team to be whitelisted. Subsequently, Chainalysis will authorize users to reset passwords and rotate API keys for transaction logging.

According to the Nikkei, data from Chainalysis shows that in reported cryptocurrency theft incidents in 2026, 89% involved North Korean hackers, compared to 15% in 2021.The report states that North Korean hackers are increasingly using generative AI to create fake documents and impersonate technicians. The South Korean government estimates that more than 8,000 personnel are employed by North Korean authorities for this purpose.

According to Bitcoin.com News, Brazilian cryptocurrency exchange Mercado Bitcoin disclosed on November 2 that it experienced a security incident, with approximately 38 million dollars in digital assets stolen. Additionally, Arkham Intelligence analyst Emmett Gallic estimated that the suspicious transfer amount exceeded 46 million dollars, and these two figures have yet to be verified.The exchange stated that users would not suffer asset losses due to this incident. The platform has suspended deposits, withdrawals, and platform services, and has notified the relevant authorities. Preliminary analysis indicates that the attackers may have controlled the transaction authorization signature credentials. According to Bitquery analysis, the suspicious transfers involved multiple chains including Ethereum, Bitcoin, Solana, Stellar, Arbitrum, Tron, and Polygon, with the specific method of intrusion yet to be determined.Mercado Bitcoin stated that it has collaborated with Tether, Circle, Paxos, BRL1, and Chainalysis to freeze 11 million dollars in assets and has identified other funds that can be frozen. The platform has not yet announced a specific time for restoring services.

Cointelegraph cited the blockchain analysis company Chainalysis, stating that an Ethereum reorganization unexpectedly hindered the transfer of stolen funds from Binance related to North Korean entities. A deposit of 10 ETH was refunded twice, prompting the cross-chain protocol THORChain to trigger an emergency pause.Reports indicate that this reorganization occurred on October 31, with THORChain processing two refunds for the same 10 ETH deposit, leading to the suspension of exchanges on 12 out of the 13 chains it supports. Chainalysis noted that this pause disrupted the cross-chain transfer paths associated with the stolen funds from Binance. Binance previously disclosed that an unauthorized transfer occurred from its hot wallet on October 29, affecting an estimated $6.3 billion, with institutions like Chainalysis linking the incident to the North Korean cybercrime organization TraderTraitor.

Blockchain data analysis company Chainalysis stated on October 31 that addresses related to stolen funds from Binance are attempting to transfer assets before the stablecoins are frozen. One method they are tracking involves depositing stablecoins into DeFi protocols and then retrieving them with new addresses.Chainalysis indicated that this method appeared early on the Tron blockchain following the approximately $6.4 billion attack. The related operations first convert TRX into stablecoins, and then into tokenized deposit receipts. These receipt tokens themselves cannot be frozen, but holders can exchange them back for the stablecoins they represent. The company noted that North Korean threat actors have used similar methods in other cases, citing the example of the TraderTraitor organization transferring $500,000.According to Chainalysis, the related funds were deposited into DeFi lending protocols and received non-frozen deposit tokens, which were then transferred to a new wallet that was not associated and exchanged back for stablecoins, before being converted to ETH on Ethereum through a cross-chain bridge. The company also stated that Circle and Tether have participated in freezing approximately $2.8 billion to date. Chainalysis mentioned that converting stablecoins to ETH does not exempt attackers from being tracked, and its investigators are monitoring the related on-chain patterns in real-time.

According to Chainalysis data, as of October 29, 2026, losses from suspected North Korean-related hacking attacks accounted for nearly 89% of the reported cryptocurrency hacking losses this year, compared to 15% in 2021.In terms of losses from individual attacks, the average loss from suspected North Korean-related attacks has increased from $50.65 million in 2021 to $185.65 million in 2026, approximately 3.7 times that of 2021.From 2021 to October 29, 2026, the reported cryptocurrency hacking losses have totaled $22.34 billion, of which losses from suspected North Korean-related attacks amounted to $13.24 billion, accounting for about 59% of the total.

Blockchain analysis company Chainalysis issued a security incident notification stating that this month, external attackers exploited Agentic Techniques to gain unauthorized access to its systems and internal tools. The team is currently investigating the unauthorized activities, patching vulnerabilities, and strengthening system security.Chainalysis stated that based on the evidence currently available, there are no signs of unauthorized access to the investigation content (including charts, notes, and case information), transactions or query results, plaintext passwords, multi-factor authentication (MFA) keys, and user session tokens.However, some non-sensitive customer data has been accessed, including platform user IDs, names, email addresses, and organizational role information, involving relevant customers and their organizational members. Chainalysis is confirming the specific affected records and will release further details later.Chainalysis specifically emphasized that this security incident is unrelated to the recent theft of cryptocurrency assets from Binance.

Blockchain data analysis company Chainalysis stated on X that investigators observed previously unseen money laundering patterns in the stolen funds from Binance. Thousands of transactions appeared in a short period, indicating that the attackers were using automated methods to obscure the trail of funds. The funds were not transferred in a single direction but circulated repeatedly among multiple addresses, often being sent back to addresses that had appeared earlier in the sequence.In an investigative article released the same day, the company assessed that the theft of approximately $6.4 billion from Binance was carried out by the North Korean cybercrime organization TraderTraitor, calling it one of the largest thefts in cryptocurrency history. The article noted that around 4:20 PM Eastern Time on October 29, funds began to flow out of Binance's hot wallet, involving multiple blockchains, with a total unauthorized outflow of approximately $6.4 billion. On Ethereum, the attackers used operational wallets funded through Tornado Cash to submit valid signature authorizations, allowing Binance's hot wallet to execute the code deployed by the attackers and sweep the assets.The article also stated that the attackers transferred $500 million in stablecoins to a wallet for exchange, converting $325 million in stablecoins to $285 million in ETH within nearly 20 minutes, and then transferred the remaining $175 million in stablecoins to a transit wallet. Related freezes began at 5:14 PM Eastern Time, and as of the publication of the article, approximately $2.8 billion had been frozen. Investigators also observed that multiple addresses first received exactly 1 TRX, then received and transferred out other funds, believing this repetitive sequence indicated a programmatic process in the fund transfers. The investigation is ongoing.

According to the "2026 Crypto Geography Report" released by blockchain analysis firm Chainalysis, Sub-Saharan Africa, although the smallest crypto market in the world, became the fastest-growing region globally with an annualized growth rate of 13.4% from July 2025 to June 2026, reaching a total scale of 101 billion dollars. South Africa and Nigeria together account for over three-quarters of the trading share in the region.Among them, South Africa's crypto economy surged 52% year-on-year to 39.3 billion dollars, with strong growth in commercial payment scenarios and cross-border stablecoin flows, becoming a regional crypto hub connecting neighboring countries. Nigeria's crypto scale reached 38.1 billion dollars, ranking third in global grassroots adoption rates, with local trading platforms absorbing half of the inflow funds from the country's centralized exchanges amid changes in the regulatory environment, and Bitcoin accounting for as much as 92% of small P2P transfers.

Chainalysis released a report on cryptocurrency adoption in the Middle East and North Africa, showing that from July 2025 to June 2026, the scale of cryptocurrency activity in the UAE grew by 32% year-on-year to $10.48 billion, ranking second in the region, only behind Turkey's $14.45 billion.This scale measures the asset value flowing into cryptocurrency service providers and peer-to-peer channels, rather than the market value of asset holdings. During the same period, the overall scale in the Middle East and North Africa decreased by 1.4% to $44.33 billion; excluding the UAE, the decline in other markets was 8.6%. The inflow of funds into centralized exchanges in the UAE increased by 22% to $5.5 billion, while inflows into institutional platforms such as custodians and market makers grew by 75% to $1.17 billion.

According to CoinDesk, the U.S. Department of Justice announced that authorities in Ghana and Nigeria arrested 28 people in an enforcement action against a West African scam network, which involved cryptocurrency investment fraud.The UK's National Crime Agency (NCA) stated that the operation also uncovered 117 victims of human trafficking in Ghana, who are awaiting repatriation to Nigeria. Private sector partners identified over $11 million in funds that could be frozen.The operation, hosted by the NCA, brought together tech companies and law enforcement agencies, aiming to combat scam networks targeting citizens of the U.S., U.K., and other countries. The Department of Justice stated that this is the first joint operation focused on West Africa. Cryptocurrency exchanges Coinbase and Binance, as well as blockchain analysis companies Chainalysis, Elliptic, and TRM Labs, were all involved.Coinbase stated that it assisted in tracking illegal funds, supporting asset freezes, and providing intelligence to investigators, identifying over 65 active scam victims and preventing over $415,000 in potential losses. TRM Labs claimed it uncovered a large-scale peer-to-peer money laundering network. In the Sasaabi region of Ghana, authorities arrested 19 people and seized 303 electronic devices; Nigeria arrested another 9 people. Meta reported that it has deleted over 3.7 million Facebook and Instagram accounts, pages, and groups, most of which targeted Americans and Britons through impersonation tactics. Law enforcement also received leads on over 30 suspected scam centers.

According to Chainalysis data, among the tokenized U.S. Treasury assets where the geographical location of holders can be identified, the holdings of Italy, Portugal, and Singapore account for 29.9%, 18.8%, and 18.2% respectively, totaling 66.9%; the United States accounts for 10.5%, ranking fourth. The proportion of holders from Japan is 16.4%, the highest among all countries, but the value of their holdings only accounts for 0.4%, indicating that the value of holdings is mainly concentrated among a few large overseas investors.The report indicates that in the past year up to July 1, 2026, the scale of tokenized U.S. Treasuries grew by 125%, rising from $6.86 billion to $15.42 billion. Chainalysis believes that tokenization has lowered the minimum investment threshold and allows some overseas investors to gain exposure to U.S. Treasuries without needing to open a U.S. brokerage account.

According to a report released by Chainalysis on Wednesday titled "North America: The Inside Story of Growth in Agency Commerce," the United States will become a net inflow country for Bitcoin in 2026, marking the first time since 2022. The data shows that institutions have continued to buy Bitcoin this year, while retail investors are generally in a selling position. The report states that dollar stablecoins provide a way for those without U.S. bank accounts to hold dollars, while Americans already have dollar accounts, leading other parts of the world to turn to digital dollars, with Americans increasingly relying on Bitcoin as a scarce store of value.The report points out that since the launch of the spot Bitcoin ETF in 2024, the U.S. share of global Bitcoin activity has been rising in each reporting period, even though the U.S. crypto economy size (2.78 trillion dollars) shrank by 2.2% during the bear market, it still retained most of the nearly doubled gains by 2025. The U.S. Securities and Exchange Commission approved the Bitcoin ETF in January 2024, after having rejected such products for a decade; these funds managed by Wall Street institutions such as BlackRock, Fidelity, and more recently Morgan Stanley, set the record for the most successful issuance in ETF history.The report also states that stablecoins have transformed U.S. debt into the preferred currency for peer-to-peer economies and cross-border enterprises, with stablecoins continuously entering new application scenarios in 2026, mainly occurring overseas, bringing billions of dollars in economic activity to U.S. businesses and government. Since Donald Trump took office, several laws and executive orders supporting the crypto industry have been signed, including the GENIUS Act signed in 2025, which allows entities such as banks to issue stablecoins, provided they are backed by assets like U.S. Treasury bonds and disclose reserve status monthly.

According to Chainalysis, one of the biggest victims in the theft incident involving the cryptocurrency hardware wallet manufacturer Ledger was also a scammer, suffering a loss of over 60 BTC, worth approximately 4.8 million dollars, with funds coming from a task scam.In this scam, participants were paid to create fake sales and reviews for real products. Subsequently, a "negative balance" appeared, and participants were told that they had to invest their own funds to receive payment. On September 22, the mastermind behind the scam transferred the funds to three separate Ledger addresses. On October 9, the thieves emptied all three addresses, transferring the funds to the same wallet through a single transaction from each address. The receiving wallet has been reported to be involved with the stolen funds.

According to CoinDesk, based on the report "Inside North America's $3 trillion crypto economy: Agentic commerce accelerates" released by Chainalysis, AI agents have completed over 138 million transactions through the x402 payment protocol incubated on the Base blockchain via Coinbase, using cryptocurrency to purchase data, computing power, and access to AI models.The report indicates that in geographically identifiable AI model inference payments, wallets associated with the United States account for 88.1%, while wallets associated with China only account for 0.1%. Eric Jardine, the research director at Chainalysis, stated that one possible explanation is that Chinese developers are more inclined to use open-weight models like DeepSeek and Qwen, thereby reducing the demand for pay-per-use inference services.Chinese-associated wallets exhibit different activity patterns, accounting for about 90% of geographically identifiable payments for security and code analysis services, with most of the flow directed towards the AI smart contract auditing platform AgentLisa.Jardine also cautioned that this gap should not be interpreted as open-source AI weakening the on-chain inference market in Asia. Currently, payment giants such as Visa, Mastercard, and Stripe have supported the x402 protocol, and Coinbase has also begun allowing enterprise clients to accept AI agent payments.

According to a report by Cointelegraph, a recent report from Chainalysis indicates that remittances from Canada to India, China, and the Philippines have surged by 141% year-on-year, reaching $2.36 billion, with digital asset payments continuing to expand in these three major remittance corridors.In the 12 months ending June 2026, there were a total of 3.56 million related transactions, with an average amount of $663 per transaction. Chainalysis noted that these three countries accounted for an increase in the proportion of Canada's cross-border stablecoin outflows from 10.9% the previous year to 19.4%.Eric Jardine, research director at Chainalysis, cited additional data provided to Cointelegraph, stating that crypto remittances from Canada to the Philippines alone reached $61.02 million, involving 73,564 transactions, representing year-on-year growth of 28% and 34.7%, respectively.The analysis counted Bitcoin and stablecoins that circulated between personal wallets with amounts exceeding $10,000. Chainalysis listed Canada as the largest peer-to-peer (P2P) crypto economy among the G7 countries and believes that the large overseas-born population and the high costs of traditional remittance services are potential driving factors for its increasing adoption.Morva Rohani, executive director of the Canadian Web3 Council, stated in the report that about 23% of Canada's population is born overseas, the highest proportion among the G7, with frequent use of remittance corridors to India, the Philippines, Nigeria, Pakistan, and China.The report also found that in June, stablecoins accounted for 44% of the Canadian dollar-denominated order book trading volume, up from 30% a year ago.