Operation Lighthouse: 14,000 Leads Delivered to Investigators Against Child Exploitation Networks

The worst of the dark web, traced transaction by transaction. Chainalysis coordinated with Binance, Coinbase, and a dozen international police services in an operation called Operation Lighthouse, aimed at networks that monetize child exploitation content using cryptocurrencies. More than 14,000 investigative leads have been handed over to law enforcement.

Behind the acronym CSAM (child sexual abuse material) lie shops hosted on anonymized networks, charging access to their archives in bitcoin, monero, or stablecoins. The weak link in this trade is the payment itself.

Key Points

• Chainalysis brought together Binance, Coinbase, Block, and four police agencies (Europol, Australia, Canada, United Kingdom) to track child exploitation networks in 125 countries.
• This collaboration resulted in over 14,000 actionable leads, drawn from the examination of tens of thousands of crypto addresses and over a hundred underground forums.
• A precedent already exists for scams: in 2024, a similar operation targeting approval phishing generated 7,000 leads for $162 million in identified losses.
• The proof by example dates back to 2019, with Welcome To Video: tracing bitcoin payments then led to 337 arrests and the rescue of 23 minors.

29,000 Crypto Addresses Scrutinized

The operation took place at the New York offices of the National Cyber-Forensics and Training Alliance. Chainalysis coordinated with Europol, the Australian Federal Police, the Royal Canadian Mounted Police, the UK National Crime Agency, and companies like Binance, Coinbase, and Block.

Results:

• 29,000 addresses and digital identifiers scrutinized,
• over 100 forums and marketplaces targeted,
• suspects located in 125 countries (some of whom were already flagged as sex offenders).

<< Criminals exploit financial services, payment methods, social networks, and internet platforms to commit or facilitate these crimes (...) It is therefore essential that these sectors join forces to prevent and combat online sexual abuse of minors, and to identify those who commit, enable, or facilitate it. >>
Danny van Althuis, team leader at Europol -- Source: Chainalysis
Official tweet from Chainalysis announcing Operation Lighthouse, which generated 14,300 investigative leads against child exploitation networks paid in crypto. << Chainalysis launched Operation Lighthouse, a groundbreaking initiative jointly led by law enforcement and the private sector to dismantle child pornography networks using cryptocurrencies. This operation, which took place over several days, generated 14,300 investigative leads, uncovered more than 7,700 suspicious accounts, and identified individuals involved in child pornography activities in 125 countries. >>

A Format Already Tested on Crypto Scams

Chainalysis had already tested this type of collaboration in 2024 with Operation Spincaster, which brought together investigators from six countries and a dozen crypto companies to target approval phishing. This is a scam that prompts the victim to sign an authorization for spending from their wallet.

In detail, analysts trace flows using the Reactor software, platforms directly confront the obtained addresses with their verified customer databases, and each match becomes an exploitable lead. Spincaster produced 7,000 leads for $162 million in identified losses. Operation Lighthouse applies the same mechanics to a much darker object and doubles the count.

However, it should be noted that a lead is not an arrest. It is an address linked to an identified account, with a history of timestamped payments: a file ready to land on a prosecutor's desk. The transformation into prosecutions then depends on national jurisdictions, statutes of limitations, and additional elements gathered off-chain.

Cryptocurrencies, the Best Balances Against Criminals

The demonstration dates back to 2019, with the dismantling of Welcome To Video, the largest child pornography marketplace on the dark web at the time. The site, operated from South Korea, charged for its downloads in bitcoin. By tracing the payments, American, British, and South Korean investigators led to 337 arrests in 38 countries and the rescue of 23 minors, according to the U.S. Department of Justice.

<< Thanks to the sophisticated tracing of bitcoin transactions, IRS-CI special agents were able to determine the location of the dark web server, identify the site administrator, and ultimately physically locate the server in South Korea. >>

Don Fort, then head of the IRS Criminal Investigation Division (IRS-CI)

Since then, sellers have adapted their methods: splitting amounts, using mixers, switching to privacy-enhanced cryptocurrencies like Monero. None of these countermeasures solve the underlying problem. At some point, funds must be converted into fiat currency, and this exit point remains, in the vast majority of cases, an exchange platform subject to identity verification obligations.

Binance and Coinbase, From KYC to Criminal Records

The presence of the two largest global platforms in Lighthouse carries significant weight.

Since 2021, Binance has built an investigation team composed of former U.S. federal agents, notably from IRS-CI and the FBI. << The inherent transparency of blockchain makes it difficult for criminals to hide for long while exploiting their victims >>, summarized Gavin Sather, head of the anti-child sexual exploitation program at Binance. Coinbase, for its part, regularly publishes the count of its judicial requests received.

A pseudonymous address thus becomes a name, an IP address, and a complete statement, something no cash payment investigation can match. Payments made eight years ago remain readable today, without any intermediary having to keep track of them expressly. Cases closed due to lack of evidence can thus be reopened, and the 14,000 leads from Lighthouse will join a database that does not erase itself.