Crypto Tracing Leads to Arrest in Global Child Abuse Network Takedown

In brief

A Peruvian national was arrested in Brazil after crypto tracing exposed his alleged links to German-hosted dark web child sexual abuse material networks.
The network hosted over 21,000 illegal videos viewed nearly 900,000 times, with memberships costing as little as $10.
“By following the money, investigators were able to connect fragmented digital identities,” TRM Labs’ Ari Redbord told Decrypt.

Blockchain intelligence has helped crack one of the world’s largest child sexual abuse material networks, leading to the arrest of its alleged administrator in Brazil and the seizure of dark web platforms that served over 350,000 users worldwide.

The joint operation by authorities in the United States, Germany, and Brazil relied on crypto tracing to identify a Peruvian national who allegedly used mixers and multiple wallets to hide his financial tracks, according to a TRM Labs report.

Brazilian Federal Police arrested the Peruvian national in September after a TRM Labs-led crypto-tracing operation, finding child sexual abuse material during the search, the report said.

The seized platforms had over 350,000 users, offering 21,000 illicit videos totaling about 660 hours and nearly 900,000 views, with memberships starting at just $10.

The alleged administrator allegedly ran the dark web platforms Videos Yad and Videos Sebick, hosted on German servers that authorities later shut down and replaced with official seizure notices from the Bavarian State Criminal Police Office.

The suspect allegedly operated multiple sites under fake identities, using mixers, numerous wallets, and third-party accounts to hide payments, but TRM Labs’ analysis found shared blockchain infrastructure linking the old and new platforms.

Investigators working with Brazilian police traced payments from customers through intermediaries to final cash-outs at Brazilian crypto exchanges, revealing shared infrastructure across the sites.

This digital paper trail proved decisive after the network had operated undetected for years.

“The necessity of this on-chain information to unmask the alleged administrator underscores the investigative value of TRM’s database of financial intelligence related to CSAM,” the report noted.

“This case demonstrates how blockchain intelligence can play a decisive role in protecting the most vulnerable,” Ari Redbord, VP and Global Head of Policy and Government Affairs at TRM Labs, told Decrypt. “By following the money, investigators were able to connect fragmented digital identities, expose a transnational criminal network, and bring a long-running operation to an end.”

Alliances against exploitation

Authorities and blockchain firms are stepping up joint efforts to dismantle crypto-enabled child exploitation networks.

In June, Elliptic joined the Internet Watch Foundation to receive live alerts on crypto transactions linked to child abuse material, with the IWF’s 2024 report showing crypto as the top payment method on such sites, appearing on 60.87% of URLs offering payment options.

“Public-private collaboration remains vital in combating online child exploitation,” Redbord said. “These cases cross borders, platforms, and currencies—and it’s only through partnerships like this one that we can deliver meaningful impact.”

Crypto crime crackdown

The operation marks part of a growing global push to hold crypto intermediaries accountable for enabling illicit finance, from child exploitation to ransomware.

Last month, Canada’s FINTRAC imposed a record $126 million fine on Cryptomus for failing to report thousands of suspicious transactions linked to child exploitation, ransomware, and sanctions evasion.

Europol recently seized $330,000 in crypto and arrested seven people tied to a Latvian cybercrime network that used 1,200 SIM box devices for crimes, including distributing child abuse material.