Chainalysis has identified the cryptocurrency payments infrastructure of one of the largest child sexual abuse material (CSAM) website operating on the darkweb. This site has received over $530,000 in crypto payments funneled through more than 5,800 addresses since July 2022, surpassing the scale of the notorious 2017 “Welcome to Video” case previously covered here.
A lead from UK law enforcement sparked the investigation
This investigation began with a single tip from UK law enforcement. From that address, Chainalysis was able to expand the cluster using on-chain tracing and proprietary heuristics and investigative software. As the investigation progressed, we uncovered a sprawling payments infrastructure with over 5,800 addresses that revealed the scale of the illicit activity and its continued operations.
Site fingerprint
The site offers multiple paid membership levels, leverages QR codes to streamline crypto payments, and hosts a wide range of illicit content.
The site may still be active
The first payments to this network began in July 2022, and activity has continued at least into June 2025, indicating that the website may still be active. Given the gravity of the situation, Chainalysis has proactively shared leads with law enforcement partners around the world.
Supporting law enforcement and compliance teams
- Law enforcement: We are committed to helping investigators triage the large volume of leads and are available to support the investigation into both users and administrators of the site using Chainalysis Reactor and Data Solutions.
- Compliance teams: Our customers may see an increase in Chainalysis KYT alerts related to exposure from this entity. We encourage teams to review their CSAM alerting thresholds and reach out if they need assistance interpreting or responding to activity.
Ongoing monitoring
Chainalysis will continue to monitor cryptocurrency fund movements to and from this infrastructure and update our customers and partners accordingly. As always, we remain committed to supporting efforts to disrupt online child exploitation and help bring those responsible to justice.
If you are with a law enforcement agency or compliance team and need support related to this investigation, please contact us through your existing Chainalysis Customer Support Representative or reach out via our support channels.
This website contains links to third-party sites that are not under the control of Chainalysis, Inc. or its affiliates (collectively “Chainalysis”). Access to such information does not imply association with, endorsement of, approval of, or recommendation by Chainalysis of the site or its operators, and Chainalysis is not responsible for the products, services, or other content hosted therein.
This material is for informational purposes only, and is not intended to provide legal, tax, financial, or investment advice. Recipients should consult their own advisors before making these types of decisions. Chainalysis has no responsibility or liability for any decision made or any other acts or omissions in connection with Recipient’s use of this material.
Chainalysis does not guarantee or warrant the accuracy, completeness, timeliness, suitability or validity of the information in this report and will not be responsible for any claim attributable to errors, omissions, or other inaccuracies of any part of such material.
The post Chainalysis Identifies Large CSAM Website Using Cryptocurrency appeared first on Chainalysis.
