Chainalysis has identified the payment infrastructure behind one of the largest known darkweb child sexual abuse material (CSAM) operations, tracing more than $530,000 in cryptocurrency payments flowing through over 5,800 distinct wallet addresses since July 2022. The investigation, which began after a tip from UK authorities, represents one of the most significant uses of blockchain forensics to combat child exploitation networks operating in crypto.
How the investigation unfolded
Chainalysis traced the CSAM site’s financial footprint across thousands of addresses. The sheer volume of transactions, more than 5,800 wallets processing payments over a three-year period, suggests an operation with significant reach and a disturbingly large customer base.
The firm has been sharing intelligence from this investigation with global law enforcement agencies and with compliance teams at cryptocurrency exchanges. Those compliance teams use Chainalysis tools to flag suspicious activity and freeze accounts linked to illicit operations.
Separately, Binance played a direct role in one of the highest-profile child exploitation takedowns in recent memory. In April 2025, Europol and German authorities dismantled Kidflix, a platform that had accumulated nearly 1.8 million users. Binance’s contribution was specific and measurable: the exchange analyzed wallet addresses provided by law enforcement and identified 120 accounts tied to the platform.
