Who Watches the Chain: Crypto AML Surveillance in 2026

Bitcoin fell more than 5% on November 6, 2026, sliding to about $76,000 from a prior close above $80,000, a drop of more than $4,000 in a single day, according to Fortune. Every one of those sell orders, every panicked transfer onto an exchange, every nervous swap into a stablecoin, was written to a public ledger that does not forget. That permanence is the quiet engine room of crypto compliance, and almost nobody who fills out a know-your-customer form ever sees it.

Ask most people what stops dirty money in crypto and they describe the onboarding check: the passport scan, the selfie, the proof of address uploaded when an account opens. That part is real. It is also the part you see, and it is not the part doing the heavy lifting. The work happens after the check clears, on the chain itself, where a small group of private companies read every transaction, group anonymous addresses into real-world identities, and attach a risk score to money as it moves. Their software, not the signup form, is what flags a withdrawal, freezes a deposit, or puts a customer on a suspicious activity report.

This is the defining paradox of crypto anti-money-laundering in 2026. The most transparent money ever built has produced the most powerful private surveillance layer in the history of finance, and it runs on a business model, a legal theory, and a set of statistical guesses that very few of the people being watched have ever examined. This piece is about who watches the chain, how they do it, what it catches, and what it costs the rest of us.

KYC, AML, and the regulator that is not the SEC

Two acronyms get used as if they were one. Know your customer (KYC) is identity at the door: collecting and verifying who a customer is. Anti-money-laundering (AML) is the wider program that KYC feeds, the system meant to detect and report the movement of criminal proceeds. In the United States the rulebook is the Bank Secrecy Act, and the agencies that enforce it sit inside the Treasury, not at the market regulator. The Financial Crimes Enforcement Network (FinCEN) oversees program and reporting duties; the Office of Foreign Assets Control (OFAC) runs sanctions. A crypto exchange registers as a money services business and answers to them. The Securities and Exchange Commission, which dominates most crypto headlines, is not the anti-money-laundering authority here.

A compliant program in the US rests on familiar pillars: a designated compliance officer, written policies and internal controls, ongoing staff training, independent testing, and risk-based customer due diligence. Two customer-facing layers sit on top: identity verification at onboarding, and continuous monitoring of transactions once an account is live, paired with screening against sanctions lists. Thresholds give it shape, with currency transaction reports above $10,000 and suspicious activity reports triggered at far lower sums. The pillar that never sleeps, the one running on every transaction of every customer around the clock, is monitoring and screening. In crypto, that pillar is built almost entirely out of blockchain analytics.

The ledger is public, and the courts noticed

A bank keeps a private ledger that police reach with a subpoena. Cash leaves no ledger at all. A public blockchain is the opposite of both: a permanent, append-only record of every transaction, visible to anyone with an internet connection. That openness is the raw material of crypto surveillance. You do not need to breach anything or compel a disclosure to read a Bitcoin or Ethereum transaction; it is already published, and it will still be there in a decade.

American courts settled the constitutional question early. In United States v. Gratkowski, decided in 2020, the Fifth Circuit held that a defendant had no reasonable expectation of privacy in the data he put on the Bitcoin blockchain, reasoning that the information is analogous to bank records and therefore falls under the third-party doctrine, outside Fourth Amendment protection (Justia). The owners of addresses are pseudonymous, the court acknowledged, but it is possible to discover who they are by analyzing the chain. That single observation is the entire industry in miniature: the data is public, linking it to a person is a technical problem, and solving that problem does not require a warrant. With the legal path cleared, the only question left was who would build the tools.

How a wallet gets a risk score

Blockchain analytics turns a wall of hexadecimal addresses into a map of named entities, and it works in three moves. The first is clustering. Because spending from several addresses in one transaction usually means a single wallet controls all of them, analysts can bundle addresses that are almost certainly the same owner; change-address patterns and other spending habits extend the clusters further. These heuristics trace back to academic work from the early 2010s that first showed Bitcoin was far less anonymous than its users assumed.

The second move is attribution. Firms spend years tagging which clusters belong to which real-world services: this one is a Coinbase deposit address, that one a darknet market, this a sanctioned wallet, that a mixer. They gather the tags through their own test transactions, data partnerships, leaked records, and old-fashioned investigation. The third move is scoring. Once an address is tagged, every address that touches it inherits a share of its reputation, a concept the industry calls exposure or taint. A wallet that received coins two hops removed from a ransomware payment carries that history whether or not its owner knew. The output is a number or a label, from low to severe, and a compliance desk acts on it. A high score can hold a withdrawal, bounce a deposit, close an account, or generate the report that lands a name in a federal database.

Meet the firms that watch the chain

Three companies dominate, and a handful of others fill in around them. Chainalysis, founded in 2014 by Michael Gronager and Jonathan Levin, is the giant. A 2022 funding round led by Singapore’s sovereign wealth fund valued it at $8.6 billion, double its previous mark (Finextra), and the company counts well over a thousand customers across roughly seventy countries, from exchanges and banks to tax agencies and police forces. Its Reactor investigation tool and its annual crime report are the closest thing the sector has to a standard reference.

TRM Labs is the fast-growing challenger. Its valuation doubled to $2 billion in 2025 as it leaned into AI-assisted investigations (BankInfoSecurity), up from the $1 billion it had been worth after an earlier funding round (Yahoo Finance). Its policy shop is led by Ari Redbord, a former senior Treasury official, and its clients include Circle, PayPal, Visa, and law enforcement in dozens of countries. Elliptic, founded in London in 2013, is the bank favorite: a 2025 investment from HSBC made it the first blockchain analytics firm backed by four globally systemic banks, alongside JPMorgan, Santander, and Wells Fargo (CoinDesk). Elliptic says it screens more than a billion transactions a week and that roughly two-thirds of global crypto trading volume flows through venues already on its platform (Elliptic). Crystal and a few newer data firms round out the field.

The pricing tells you who the real customers are. These are not tools sold to retail traders; licenses run from tens of thousands of dollars a year into the high six figures for a large platform, and most big exchanges run two providers at once, one for investigations and one for screening, so a second opinion covers the first. The customer base that matters most, though, is governmental.

The government’s outsourced eyes

Long before banks bought in, the US government was the anchor client. As far back as 2020, CoinDesk documented that federal agencies had already spent more than $10 million on Chainalysis tools, services, and training across dozens of procurement contracts, with the IRS the single biggest buyer (CoinDesk). The IRS criminal division, the FBI, ICE, and the DEA have all been customers. In effect, the state has outsourced on-chain forensics to a few private vendors, which is efficient and also quietly consequential: the government increasingly sees the chain through software it does not own and cannot fully audit.

Just how valuable those contracts are became public in 2026, when Chainalysis sued the federal government over one. After ICE awarded a sole-source contract worth about $94.6 million to TRM Labs for forensic software supporting Homeland Security investigations, Chainalysis filed a bid protest in the US Court of Federal Claims, calling the decision to skip open competition arbitrary, capricious, and unreasonable (Decrypt). TRM intervened to defend the award. Two companies that sell governments the power to watch everyone were now fighting in open court over a nine-figure deal to do exactly that.

The people who build these systems make the optimistic case plainly. Jonathan Levin, now Chainalysis’s chief executive, has told US lawmakers that blockchain’s transparency, speed, and programmability make it a better foundation for oversight than the opaque plumbing of traditional finance, precisely because the record is public and permanent (PYMNTS). Ari Redbord of TRM Labs, who spent years at the Treasury before joining the industry, has made the same point in congressional testimony: because value moves on a shared ledger, investigators can follow the money across wallets, exchanges, mixers, and bridges in close to real time, a visibility that cash never offered (House testimony). When it works, it works spectacularly.

What the surveillance catches

The clearest demonstration is also the grimmest. In 2019, investigators dismantled Welcome to Video, at the time the largest known marketplace for child sexual abuse material measured by content. Agents from the IRS criminal division and Homeland Security used Chainalysis tools to trace the site’s Bitcoin to the exchanges its users had passed through, then matched those trails against the exchanges’ own KYC records to put names to addresses. The operator was identified in South Korea and 337 users were arrested across a dozen countries (MIT Technology Review). The permanence that privacy advocates fear is, in a case like that, a prosecutor’s gift.

The financial cases are splashier. In February 2022 the Justice Department seized about $3.6 billion in Bitcoin, some 119,754 coins tied to the 2016 hack of the Bitfinex exchange, following the money across six years of attempted laundering to arrest a married couple in Manhattan (US Department of Justice). When North Korea’s Lazarus Group drained roughly $1.4 billion from the Bybit exchange in 2025, analytics firms tracked the stolen funds through mixers and bridges within hours. The catch, and it is a large one, is that tracing is not the same as recovery: investigators watched most of that money move and could not freeze it. The chain shows you where the cash went; it does not hand it back. For a fuller account of how stolen funds get chased after a breach, see our reporting on the Halborn team and the Binance hack.

Where the trail goes cold

The wins are real, and so are the blind spots. The same Chainalysis report that tallied record illicit flows credited most of the growth to sanctioned entities and to services built specifically to resist tracing. Mixers chop a clean trail into noise. Cross-chain bridges hand an analyst a fresh ledger with no obvious link back to the old one. Instant swaps between assets, and the migration onto stablecoins that now carry the bulk of illicit volume, let value change shape faster than a human investigator can follow it. A blockchain is transparent, but transparency is not the same as legibility once the money is deliberately routed to confuse.

This is why pervasive tracing so rarely ends in a clean result against a serious adversary. Investigators watched North Korea’s operatives move more than a billion dollars and could not stop it, and by most estimates only a small share of global criminal proceeds is ever recovered. The nation-state program, the professional launderer, often has the tools and the patience to stay a step ahead. The people most reliably caught by always-on surveillance tend to be the careless and the ordinary, which is the civil-liberties objection in a different key: the net is finest exactly where the catch matters least.

Reactor goes to court

If the government and the exchanges are going to act on a vendor’s risk score, a fair question is whether that score would survive cross-examination. In 2026 it did, in the most consequential test yet. Roman Sterlingov was convicted of running Bitcoin Fog, a mixing service that laundered tens of millions of dollars for darknet markets. His defense challenged the Chainalysis analysis under the Daubert standard, the rule that governs whether expert evidence is reliable enough to put before a jury. A Chainalysis analyst and an FBI agent had testified that the firm’s Reactor tool clustered and attributed more than 900,000 Bitcoin addresses to Bitcoin Fog, and that known undercover addresses fell inside that cluster.

In September 2026 the US Court of Appeals for the D.C. Circuit upheld the decision to admit the Reactor evidence, finding that the tool “easily clears the threshold for reliability” and that it is “based on reliable principles and methods” (Chainalysis). The court brushed aside the argument that Reactor was unreliable for lacking peer review or a published error rate, reasoning that peer review is not necessarily expected in a field as new and specialized as blockchain analysis. Chainalysis now markets Reactor as the first tool of its kind to satisfy Daubert in a US federal court.

Read a second way, the same ruling is less reassuring. The conviction stood even though Chainalysis never disclosed Reactor’s source code in open court; the defense’s own experts were allowed to inspect the heuristics under a protective order, but Sterlingov himself was barred from reviewing the material that helped convict him (CryptoSlate). A tool can be good enough for a courtroom and still be a closed box to the person it points at. The court did not find that Reactor has a low error rate; it found that nobody is required to know what the error rate is.

Probabilistic, not certain

That matters because clustering is inference, not proof. The common-ownership heuristic is a strong bet, not a law of nature, and privacy tools are designed to break it: a CoinJoin transaction deliberately mixes inputs from many owners so the usual assumption fails. Attribution tags are only as good as the data behind them, and that data is proprietary, assembled by each firm and rarely audited by anyone outside it. Two vendors can disagree about whether the same address is a legitimate business or a front. When the answer is a number that can freeze your money, the gap between “very likely” and “certain” is exactly where ordinary users fall through.

The scoring also collides with how crypto works at the level of a single address. A wallet is not a name; it is a string, and the same person may control hundreds while one string can pass through many hands. We have written before about the 42-character problem, the way a raw address resists any human sense of identity. Surveillance software tries to impose identity on those strings at industrial scale, and most of the time it is right. The trouble starts with the times it is not, because the person on the wrong end of a mistaken score rarely gets to see the work, let alone contest it.

Guilt by address

The sharpest illustration of how taint can misfire arrived the week OFAC sanctioned the Tornado Cash mixer in August 2022. Within a day, an anonymous prankster began sending 0.1 ether, the smallest amount the mixer handled, out of sanctioned Tornado Cash addresses to the public wallets of well-known figures, including Ethereum co-founder Vitalik Buterin, Coinbase chief executive Brian Armstrong, the comedian Jimmy Fallon, the DJ Steve Aoki, and a Ukrainian war-donation fund. Roughly 300 of these unsolicited transfers went out, worth about $52,000 in total (CoinDesk, Chainalysis).

The stunt made a serious point. In a model that sorts addresses into clean or sanctioned, you can be tainted by money you never asked for and cannot refuse, because there is no way to decline an incoming transfer on a public blockchain. Compliance desks had to decide whether a wallet that received unwanted dust from a blacklisted address was now a problem, and OFAC eventually had to clarify that it would not go after people for dusting they did not control. The deeper issue is due process. A risk score is not a verdict; it is a private company’s probabilistic opinion, and there is no court, no appeal, and often no explanation when an exchange acts on it. Accounts get closed and withdrawals declined with a form email. The sanctions episode itself was later unwound: a federal appeals court found that immutable smart contracts were not sanctionable property, and OFAC delisted Tornado Cash in 2025 (CoinDesk). The addresses that got dusted, though, wore the mark in the meantime.

Who gets to define the number

The analytics firms do more than enforce the rules; they supply the facts everyone argues about. When officials, reporters, and this article cite how much crypto crime there is, the figure almost always traces back to one of these companies. Chainalysis reported that illicit addresses received at least $154 billion in 2025, a total it is careful to call a lower-bound estimate that will rise as more addresses are identified; it put the illicit share at under 1% of all tracked crypto activity, said stablecoins made up 84% of that illicit volume, and attributed a 162% jump largely to a 694% surge in sanctioned-entity activity (Chainalysis). Those numbers shape policy, yet the method that produces them is proprietary, and competing firms publish different totals for the same year off different data. The authoritative measure of crypto crime is, in practice, a set of private estimates.

Downstream, the machine those estimates justify is noisy. Across the wider AML world, industry studies consistently find that the overwhelming majority of monitoring alerts, often put at 90% or more, are false positives, and only a small fraction ever become a filed report (Facctum). That is a great many flagged, frozen, and investigated people who did nothing wrong, in order to catch the few who did. The stablecoin share is its own story: as value shifts onto dollar tokens, the pressure to monitor and freeze moves with it, a dynamic we traced in our look at America’s finished stablecoin rulebook.

The surveillance nobody voted for

There is a civil-liberties argument here that has nothing to do with defending criminals. Its loudest exponent is Peter Van Valkenburgh of Coin Center, the crypto policy nonprofit, which has sued the Treasury over a rule requiring anyone who receives $10,000 or more in digital assets to report the sender’s name, date of birth, and Social Security number to the IRS. Coin Center argues that forcing ordinary people to collect and hand over intimate financial information about others, with no warrant, violates the Fourth Amendment, and that compelling the disclosure of donors offends the First (Coin Center). Van Valkenburgh has gone further in writing, arguing that the Bank Secrecy Act regime itself is likely unconstitutional as a form of warrantless mass surveillance (Coin Center).

On effectiveness, he is just as blunt. Coin Center’s analysis of the costs and benefits of crypto financial surveillance concludes that for all the money and privacy it consumes, the system accomplishes “remarkably little,” with only a sliver of criminal proceeds ever seized (Coin Center). The worry is not the trafficker who gets caught. It is that the architecture watches everyone, permanently, folding the entire transaction history of millions of law-abiding people into a searchable record that no legislature ever explicitly voted to build. Gratkowski made it legal; nobody ever made it accountable.

From best practice to legal requirement

For years, buying analytics was something a cautious exchange did to stay out of trouble. Now the law increasingly requires the thing the vendors sell, which quietly turns a product into infrastructure. The global standard-setter, the Financial Action Task Force, expects regulated crypto businesses to screen the counterparties on transfers, and its 2026 work on stablecoins pushes issuers toward monitoring secondary-market activity, which only deepens the reliance on chain analysis.

In the United States, the GENIUS Act pulls stablecoin issuers inside the Bank Secrecy Act and, through a FinCEN and OFAC rulemaking due to take effect in early 2027, obliges them to run sanctions-compliance programs, which in practice means screening addresses against lists (Federal Register). Europe is stricter still. Its Transfer of Funds Regulation has required full counterparty data on crypto transfers with no minimum threshold since the end of 2024 (EUR-Lex), and the Anti-Money-Laundering Regulation, which takes full effect on 10 July 2027, bans anonymous crypto accounts and privacy coins outright (EUR-Lex), with a new authority in Frankfurt set to supervise the largest firms directly from 2028. Screening is no longer optional, so the screening software is no longer optional either. The same logic is pushing compliance onto the chain itself, into the permissioned pools and gated venues we examined in our piece on AMM design and tokenized stocks, and it sharpens an unresolved question: who is even responsible when the thing being supervised is code, a puzzle we took up in DeFi compliance and the DAO.

What it means for everyone else

Concentration is the risk nobody prices. When a near-oligopoly supplies the risk scores, one firm’s mistake does not stay contained. A single mistagged address can get a user bounced at every exchange that licenses that vendor, with no central place to appeal the error and no guarantee the user ever learns why. The same few proprietary datasets increasingly define who may transact, which is a great deal of power to vest in private companies that answer to their customers and investors rather than to the people they score.

For an individual, the practical lessons are simple and slightly unsettling. Your withdrawal address is usually scored before the coins ever arrive. Interacting with a mixer, a sanctioned contract, or even a wallet that later turns out to be dirty can raise your score through no fault of your own. And because the ledger is permanent, a transaction from years ago can surface in an investigation today. None of this is a reason to panic, but it is a reason to understand the system you are using.

The honest verdict is uncomfortable for everyone. Blockchain surveillance is genuinely effective, clearly legal under current US doctrine, and largely unaccountable, three things that rarely sit together in a healthy system. It has caught people who badly needed catching, and it watches tens of millions who did nothing wrong, on a permanent record, judged by proprietary math that even a federal court declined to pry open. The KYC form at signup was never really the point. The ledger is the point, and a small number of companies have made a very good business out of being the ones who read it.

Frequently Asked Questions

Is Bitcoin really anonymous?

Bitcoin and most crypto are pseudonymous, not anonymous. Every transaction is public and permanent, and blockchain analytics firms routinely link addresses to one another and, using exchange KYC records, to real identities. Treat on-chain activity as traceable by default.

Which companies run crypto AML surveillance?

The field is led by Chainalysis, TRM Labs, and Elliptic, with Crystal and newer data firms alongside them. They sell investigation and screening tools to crypto exchanges, banks, and government agencies, and their risk scores drive many day-to-day compliance decisions.

Can a blockchain analytics firm freeze my crypto?

Not directly. The firm produces a risk score, and an exchange or stablecoin issuer decides whether to act on it. A centralized exchange can freeze or decline your funds, and a stablecoin issuer can freeze tokens on-chain, but coins held in self-custody cannot be frozen, only flagged and refused when you try to cash out.

Is it legal for the government to track crypto without a warrant?

In the United States, yes for public blockchain data. In United States v. Gratkowski the Fifth Circuit held there is no reasonable expectation of privacy in on-chain information under the third-party doctrine. Obtaining your identity from an exchange can still require legal process, and Coin Center is challenging the broader reporting regime in court.

How can I make my crypto transactions more private?

It is difficult on a public ledger. Using fresh addresses, self-custody, and tools like CoinJoin reduces the links between your activity, but it also tends to raise your risk score and can trigger extra scrutiny or refusals at regulated venues. Privacy coins will be banned in the EU from 2027, and no method guarantees privacy on a transparent chain.

Anneke de Vries covers regulation and compliance for HOGE Wire.