In February, we shipped new capabilities to help teams move faster from signal to decision.
In this edition:
Webhooks for Transaction Monitoring alerts
We've enabled webhooks for Transaction Monitoring alerts to send events directly to customer-defined endpointts, so you no longer need to poll the Transaction Monitoring API to find new or updated alerts. This reduces integration complexity and latency for downstream case management or workflow tools.
How to use
Configure your webhook endpoint and authentication in your Transaction Monitoring integration
Subscribe your endpoint to receive alert events (for example, “alert created” and “alert updated” events)
Use your existing case management or orchestration tools to process incoming webhook payloads in near real time
Learn more in your API documentation.
Subpoena-ready Graph CSV exports with notes
CSV exports from Graph Visualizer now include graph notes, giving investigators a subpoena-ready tabular record of their work where each row includes the associated note text. This makes it easier to share and archive investigative context without relying on screenshots of the graph.
How to use
In Graph Visualizer, use the existing Export → CSV action
The exported CSV will now include your graph notes alongside entities, addresses, and transfers, so you can attach the file directly to case records or legal process responses
TRON dusting transfer labels
We’ve added a TRON transfer label that identifies dusters — addresses that send thousands of tiny, unsolicited transfers to random wallet addresses — and labels those transfers with the dust icon in the tool.
To date, TRM has labeled approximately ~4M dust broadcasters, representing 1.2% of TRON addresses, and ~196M unique dusted addresses, representing 50.2% of TRON addresses.
How to use
In Graph Visualizer, identify the “dusting” transfer label (with the dust icon) on individual TRX transaction lines
43 new blockchains for Ownership & Sanctions screening
We’ve added 43 new blockchain networks for Ownership/Sanctions-only coverage in Wallet Screening, significantly expanding the universe of addresses that can be screened for risk.
Highlights include chains such as Kaspa (KAS), Mina (MINA), Osmosis (OSMO), Secret (SCRT), Theta Network (THETA), and many more, bringing coverage to a broader range of L1s, L2s, and app chains. These additions were accelerated using our automated chain onboarding tooling, allowing TRM to onboard new networks much faster as they emerge.
How to use
Use Wallet Screening as normal; if your integration uses the “all supported chains” configuration, these new chains are automatically included
For a full and always‑up‑to‑date list of supported blockchains, see the Supported Blockchains.
Expanded fentanyl coverage
TRM has significantly expanded underlying threat intelligence that powers risk scoring and investigations:
TRM has uniquely attributed over USD 566M in new crypto‑linked fentanyl activity, driven by advanced clustering heuristics focused on fentanyl vendors, Chinese drug precursor manufacturers, and cartel money‑laundering networks
These expansions help compliance, law enforcement, and national security teams detect exposure earlier and build stronger cases against transnational criminal organizations linked to fentanyl and other financial crime typologies.
Seed Analysis: continuous monitoring
Seed Analysis now supports continuous monitoring, enabling investigators to automatically track new activity on seed‑derived addresses over time instead of running periodic one‑off rescans.
This update:
Eliminates manual, periodic re‑analysis of seed phrases
Surfaces only incremental changes, reducing alert fatigue
Helps investigators stay ahead of evolving wallet activity linked to seized devices or recovered seed artifacts
How to use
Download the latest version of Seed Analysis (v20260227.0)
Run a Seed Analysis as usual from TRM Forensics
Enable continuous monitoring for the seed so TRM automatically checks for new transfers and balances on derived addresses based on the configured cadence
Review new activity in each monitoring cycle to decide on follow‑up actions (e.g., additional tracing or seizure steps)
TRM BLOCKINT API: new reference and search endpoints
TRM BLOCKINT API now includes new reference and search endpoints that turn TRM’s blockchain intelligence into a programmable lookup layer for your own internal integrations.
These endpoints let your developers quickly discover what chains, assets, and categories are supported from a schema naming perspective across TRM.
How to use
Review the TRM BLOCKINT API documentation for details on the new reference and search endpoints (e.g., parameters, response schemas, and rate limits).
GET /public/v1/blockint/chains/supported returns the list of supported chains
GET /public/v1/blockint/assets/supported returns the list of supported assets
GET /public/v1/blockint/categories/supported returns the list of supported categories
GET /public/v1/blockint/address/search lets you do fuzzy search by partial address (minimum 10 characters). Results are address + chain pairs where we have observed on-chain activity for that address on that chain. Supports prefix matching and optional % wildcards.
Update existing integrations or build new ones to fetch TRM intelligence directly into your internal tools, dashboards, or case workflows using these endpoints
TRM Triage for private sector businesses
Building on our beta, we’ve launched TRM Triage for compliance use cases, enabling teams to use a configuration of Triage tailored for private sector compliance and investigations. This enables a user to enter an address — from a high-net-worth individual for example — and quickly see risk insights, view additional details about the wallet’s interactions, and escalate as needed to a specialist in their organization.
How to use
Customers interested in TRM Triage for private sector use cases can work with their TRM account representative to get access
One-click PDF exports for Entity Monitoring reports
We’ve released one‑click Entity Monitoring report PDF exports. Users can quickly generate a PDF snapshot of their Entity Monitoring dashboard for audit, record keeping, or regulatory exams, rather than manually assembling screenshots or copying data into separate documents.
How to use
From the Entity Monitoring view, use the new Export PDF and choose Current View or Month to Date, to generate a complete report for the entity in just a few clicks
Supported blockchains view in Environment Settings
We’ve added a Supported blockchains view in Environment Settings.
Lists all currently supported blockchains and their support levels (e.g., Ownership, Standard, or Enhanced)
Shows a total count of supported blockchains
Tags newly added chains with a “New” badge so recent additions stand out
How to use
Navigate to Environment Settings → Supported Blockchains to see the full list of chains, support levels, and newly added networks
Learn more about our blockchain support.
Chain support indicators and info boxes in Forensics
We’ve introduced new blockchain support indicators and info boxes across Forensics to clarify which capabilities based on the blockchain.
Updates include:
Indicators in Block Explorer and Graph Visualizer that show the blockchain support level
Information icons next to features that are only available on Enhanced chains, such as certain visualizations (e.g., Sankey charts)
How to use
When working in Block Explorer or Graph Visualizer, check the chain indicators to confirm whether you’re on a Standard or Enhanced chain
Use the info boxes to understand why specific visualizations or analytics may not appear for a given chain and whether switching to an Enhanced chain is required for that capability
New MWeb Trace Signature® for Litecoin’s privacy layer
We’ve launched a new MWeb Trace Signature that improves traceability through Litecoin’s MimbleWimble Extension Blocks (MWEB) privacy layer.
This Signature:
Surfaces a deterministic link between peg‑in and peg‑out transactions around the MWEB privacy layer, where data supports it.
Shows a purple Signature line in Graph Visualizer that connects traceable flows through MWEB back to on‑chain Litecoin activity.
It does not provide full transparency into all activity inside MWEB, but it highlights high‑confidence traces that help investigators understand exposure to Litecoin’s privacy feature and follow funds across peg‑in and peg‑out events.
How to use
When you encounter Litecoin activity interacting with MWEB, look for the “MWeb Trace” Signature label on relevant addresses and transactions
In Graph Visualizer, plot the signature to visualize the purple trace line between pegged‑in and pegged‑out funds, and follow the annotated path as part of your investigation
Interested Investigators renamed to Deconflict
The Interested Investigators module has been renamed to Deconflict in the TRM platform.
Aligns the product naming with the broader TRM Deconflict offering, reflecting a single, unified network of verified agencies collaborating across TRM solutions
Updates labels and icons in the navigation and context menus (for example, the “Indicate Interest” action in Graph Visualizer now appears under the Deconflict name)
Your existing workflows, data, and investigator network remain unchanged — only the name and visuals have been updated.
How to use
Continue to use the module as before to indicate investigative interest on addresses and entities and to identify overlapping cases
Look for the Deconflict label and icon in the TRM navigation and right‑click menus where Interested Investigators previously appeared