Cryptocurrency leveraged by CSAM actors
Earlier this month, Thai authorities arrested a German national for operating a dark web platform that facilitated the sale of child sexual abuse materials (CSAM). The incident highlighted the role of law enforcement and cryptocurrency tracing in uncovering global abuse networks.
For years, CSAM actors have leveraged cryptocurrencies under the misconception that digital assets provide anonymity and protection from detection. Threat actors have used crypto as payment for content, to donate to platforms, and as financial incentives for uploaders, rewarding individuals in crypto for sharing material.
Over the past two years, at least one crypto transaction to a CSAM address has occurred every two minutes. TRM identified that between 2022 and 2024, the crypto transaction volume linked to CSAM-related addresses increased by 130%, indicating a concerning upwards trajectory.
Over the past year, TRM has observed a significant shift in the CSAM threat landscape with vendors migrating from hosting content on the surface web to more sophisticated marketplaces on the dark web. This migration is likely in response to heightened enforcement as well as changes in illicit market dynamics. This rise in marketplaces has occurred alongside an increase in the use of cryptocurrencies in the CSAM ecosystem. CSAM actors are also increasingly leveraging artificial intelligence (AI) in their operations.
This evolving landscape poses a challenging environment for law enforcement but also presents opportunities for tracing transactions and identifying CSAM operators through blockchain intelligence.
Key trends in the CSAM ecosystem
TRM Labs has observed the following trends since 2023 in the CSAM ecosystem:
- CSAM vendors migrating to the dark web
- AI playing a growing role in CSAM operations
- Dark web CSAM scams decreasing while social media scams surge
- CSAM consumers increasingly using intermediary addresses
CSAM vendors migrating to the dark web
Law enforcement takedowns of two CSAM networks on the dark web, Welcome to Video in 2019 and Dark Scandals in 2020, demonstrated how blockchain intelligence could help dismantle such networks. Following these takedowns, there was a surge of CSAM-related hosting on the surface web.
In response to this migration, CSAM hotlines and activist groups intensified their efforts to remove illegal content from free file-hosting services on the surface web. As such, many platforms began enforcing stricter compliance measures. This resulted in frequent takedowns and disrupted access for offenders who regularly used these services.
Facing escalating challenges on the surface web, since 2023 CSAM actors have increasingly moved operations back to the dark web, driven by a desire to establish a more stable infrastructure, independent of mainstream platforms and less susceptible to takedown efforts. Due to the costs of maintaining and operating servers on the dark web, CSAM operators have broadly opted for a marketplace model.
These CSAM marketplaces on the dark web primarily use two operational structures:
- Admin-owned: administrators maintain exclusive control over content, uploading files and retaining all profits
- Contributive: administrators provide the platform infrastructure and share profits with uploaders based on the revenue they generate
AI playing a growing role in CSAM
As highlighted in TRM’s report The Rise of AI-Enabled Crime, CSAM actors are increasingly leveraging AI to produce and distribute CSAM, which complicates detection efforts and raises new ethical and legal challenges.
The Internet Watch Foundation (IWF) published a report in July 2024 revealing that over 3,500 AI-generated child sexual abuse images had been uploaded to a dark web forum last analyzed in October 2023. The IWF also reported that threat actors were using real images of victims to train AI models to produce content.
Furthermore, in February 2025, a Europol operation supporting authorities from 19 countries resulted in the arrests of 25 individuals who were part of a criminal group responsible for distributing AI-generated images of minors. These examples underline the growing threat from CSAM actors abusing AI.
Given that closed-source AI models implement strict safeguards against misuse, threat actors are turning to open-source alternatives that they can customize for illicit purposes. Although these models require greater technical proficiency, they enable bad actors to create highly realistic CSAM that can be monetized. As well as using Generative AI to create videos, threat actors also leverage deepfake technology to add minors’ faces to adult pornography.
While CSAM criminals are increasingly abusing AI, the technology can also be used as a shield against such activity. Blockchain intelligence investigations are now incorporating AI into existing tools, such as those offered by TRM, to help identify on-chain transactions linked to CSAM websites, forums and vendors, as well as to disrupt financial networks that support this heinous trade.
Dark web CSAM scams decreasing while social media scams surge
Alongside vendors selling CSAM, criminals are also taking advantage of CSAM demand by fraudulently claiming to sell such content for financial gain. These bad actors often distribute CSAM to lure individuals before requesting payment for expanded access to ‘hidden collections’ that don’t exist. Once their fraudulent nature is revealed, operators of such scams typically change URLs and entity names.
TRM’s intelligence tips have helped law enforcement to identify and take down several fraudulent websites. Our blockchain intelligence has also linked many of these operations to a single threat actor group, revealing patterns of coordinated activity.
However, TRM has observed a decline in fraudulent CSAM websites operating on the dark web in the past year. In contrast, there has been a surge of such scams on social media and messaging platforms. Networks fraudulently claiming to sell CSAM have proliferated, often exposed by other CSAM threat actors as scams. This shift underscores the adaptability of illicit actors who continuously evolve their tactics to exploit demand.
CSAM consumers increasingly using intermediary addresses
Due to the ongoing surveillance of cryptocurrency payments directed towards known CSAM entities, consumers are increasingly employing obfuscation techniques to mask their illicit transactions. In particular, individuals are strategically utilizing intermediary addresses to create a layer of separation, thereby hindering the direct attribution of funds to CSAM-related activities.
Case studies: Disrupting CSAM operators around the world
As mentioned, in March 2025 Thai authorities arrested a German international operating a dark web platform that facilitated the sale of CSAM in exchange for cryptocurrency. The arrest followed a referral from US Homeland Security Investigations (HSI) to the Royal Thai Police.
This is just one example of law enforcement organizations leveraging blockchain intelligence to identify and arrest individuals involved in CSAM networks as well as to take down CSAM websites. In the past year, law enforcement organizations in Brazil, the United States, Spain, Australia, Czechia, the United Kingdom, Réunion, and Canada have successfully disrupted such operations with the help of blockchain intelligence.
In one case, the Brazilian Federal Police (BFP) identified and arrested a 20-year-old man for producing and distributing child sexual abuse material. According to the BFP, the man advertised access to photographs and videos on a messaging application. The man also produced new child sexual abuse videos on demand with a juvenile family member.
Mistakenly believing that digital assets would provide anonymity, the suspect instead left a trail that investigators used to trace transactions back to a broader network of illicit activity. Another case in Brazil led to the arrest of a CSAM producer linked to a commercial network. The arrest prevented a two-year-old victim from coming to further harm.
Lastly, in Czechia, authorities tracked financial flows to disrupt a network of multiple CSAM websites on the dark web. These cases highlight the growing role of blockchain intelligence in uncovering hidden criminal networks and supporting law enforcement in their mission to bring offenders to justice.
Blockchain intelligence’s role in dismantling CSAM networks
As threat actors continuously refine their methods to obfuscate their illicit activities and evade detection, real-time blockchain analysis has become a critical tool in disrupting their operations. The ability of organizations such as TRM Labs to trace cryptocurrency transactions delivers a clear message to such threat actors: their activity is not invisible, and they will be found.
Blockchain intelligence and AI-powered investigations are exposing malign actors’ misplaced perception that crypto offers anonymity. Law enforcement, in collaboration with blockchain intelligence firms, can now track illicit payments, expose networks, and dismantle CSAM marketplaces with precision.
The cryptocurrency regulatory landscape is also shifting, with legislators increasingly focusing on strengthening compliance standards for exchanges and introducing measures to prevent digital assets from facilitating illicit activity, including CSAM-related payments. By integrating blockchain intelligence, AI-driven monitoring, and regulatory enforcement, investigators can permanently disrupt CSAM networks and bring perpetrators to justice. TRM Labs remains at the forefront of this effort, providing critical intelligence to law enforcement and reinforcing the power of blockchain intelligence for social good.
Access our coverage of TRON, Solana and 23 other blockchains
Fill out the form to speak with our team about investigative professional services.
