A Chainalysis-led public-private operation generated 14,300 investigative leads across 11 cryptocurrency exchanges and payment services while examining crypto activity associated with online child sexual abuse material, according to results released by the blockchain analytics company.
Chainalysis said Operation Lighthouse surfaced more than 7,700 suspect accounts and identified suspects in 125 countries. Those figures describe accounts and leads for further investigation; they do not represent arrests, convictions or findings that every flagged account holder committed an offence.
The operation investigated 29,120 cryptocurrency addresses and digital identifiers connected to more than 100 platforms, forums and distribution networks on the surface and dark web. Chainalysis said the flagged accounts included 16 registered sex offenders.
From blockchain identifiers to investigative leads
Operation Lighthouse followed months of data enrichment and culminated in a multi-day sprint hosted by the National Cyber-Forensics and Training Alliance in New York. Chainalysis said more than nine law-enforcement agencies, more than 13 private-sector partners and specialist nonprofits took part.
Participants included Europol, the UK National Crime Agency, the Australian Federal Police, the Royal Canadian Mounted Police, Binance, Coinbase, Block and the Internet Watch Foundation. The aim was to combine blockchain tracing with information held by financial platforms, investigators and child-protection organizations so that onchain identifiers could be connected to accounts and potential real-world subjects.
The distinction between an address, an account and a person is important. A blockchain address can provide a traceable transaction path, but legal process and platform records may be needed to associate activity with an account holder. The operation’s output is therefore best understood as a pool of prioritized leads for follow-on investigation and possible account action, not a completed enforcement result.
What it means for exchanges and payment services
For crypto payment companies, the results show why transaction monitoring cannot operate as a stand-alone control. Onchain indicators may identify exposure to known services or clusters, while customer records, account activity and intelligence shared by other organizations can help establish whether a match warrants escalation.
That creates an operational challenge: providers need a process for moving from a blockchain alert to case review, evidence preservation, legally appropriate information sharing and, where justified, account restrictions or reporting. The number of leads reported by Operation Lighthouse also suggests that review capacity and prioritization matter alongside detection technology.
The operation does not establish that the participating exchanges or payment services hosted abusive material. The financial signals were used to investigate activity linked to platforms and networks elsewhere online. Providers should therefore avoid treating association alone as proof of criminal conduct while still responding quickly when corroborating information raises the risk.
Outcomes remain pending
Chainalysis said participants used the sprint to support follow-on legal process and case development. The company expects the results to mature into arrests, prosecutions and account-level disruption, and its published FAQ says prosecutorial outcomes will continue to accrue through 2027.
Those outcomes have not yet been reported in the released results. The immediate development is the creation of a cross-platform lead set and a repeatable collaboration model. Its effectiveness will ultimately depend on how many leads are substantiated, how quickly providers and authorities can act, and whether the process produces defensible interventions without conflating a risk signal with guilt.