An international law enforcement operation has dismantled Kidflix, one of the largest known child sexual abuse platforms operating on the dark web. Led by the German Federal Criminal Police (BKA) with support from Europol and law enforcement partners across 35 countries, the takedown is part of Operation Stream, a multi-year global effort to combat the distribution of child sexual abuse material (CSAM) online.
The scale of the platform was staggering. Kidflix hosted over 91,000 unique CSAM videos, totaling 6,288 hours of recorded abuse. Europol reported that the site had more than 1.8 million users, making it one of the most prolific and widely accessed CSAM networks ever uncovered. Since the investigation began in 2022, law enforcement has identified 1,393 suspects, made 79 arrests, and seized over 3,000 digital devices. Most importantly, 39 children have been identified and protected as a result of this investigation.
Kidflix operated entirely on the dark web and relied on cryptocurrency to enable pseudonymous access to its illegal content. Users around the world made payments to the platform through a wide array of channels — including international exchanges, decentralized finance (DeFi) platforms, mixers, Bitcoin ATMs, peer-to-peer exchanges, and even centralized exchanges based in the United States. Investigators observed that site administrators sent a significant portion of those funds directly to international DeFi platforms, further complicating attribution and recovery efforts.
Using on-chain analysis, investigators followed incoming cryptocurrency payments to identify likely customers and traced outgoing flows to uncover where the proceeds were being sent. Investigators were able to link wallet addresses to user behaviors and financial patterns consistent with other CSAM-related typologies. Kidflix customers sent crypto from international exchanges, mixers, bitcoin ATMs, DeFi platforms, peer-to-peer exchanges, and even centralized exchanges based in the United States.
On-chain insights helped illuminate the global laundering networks enabling Kidflix to operate for years at scale.
In TRM’s March 28, 2025, report on CSAM and cryptocurrency, TRM found that between 2022 and 2024, crypto transaction volume linked to CSAM-related addresses increased by 130%. This upward trend highlights the growing role of digital assets in the proliferation and monetization of child abuse material. The Kidflix case underscores the reality behind that data — sophisticated platforms that leverage blockchain technology for profit, while hiding behind the anonymity of the darknet.
The dismantling of Kidflix sends a clear message: darknet platforms that traffic in child exploitation will be pursued across jurisdictions, even when they rely on advanced obfuscation techniques and decentralized financial infrastructure. This case demonstrates how the transparency of the blockchain—combined with international coordination and public-private partnership — can be used not just to see illicit activity, but to stop it.
TRM Labs is proud to support Europol, the German Federal Police, and our global law enforcement partners in the fight against online child exploitation.
Access our coverage of TRON, Solana and 23 other blockchains
Fill out the form to speak with our team about investigative professional services.
