TRM Labs Opens Its 200-Member Freeze Network to Any Verified Agency

TRM Labs has opened the network it uses to freeze stolen crypto to police forces that are not its customers. Beacon Concierge, announced in a release that crossed the wire at 22:09 UTC on Thursday, is a managed service: a law-enforcement agency verifies itself once, files a single submission, and TRM's investigators trace the funds, assemble the evidence package and carry the request to whichever stablecoin issuer or exchange can act. No TRM licence is needed. The company says the service has already run 15 cases for 14 agencies in 10 countries and frozen more than $35 million.

What an issuer can do that a bank cannot

Stablecoin issuers can freeze funds on-chain, a power the release describes as having no equivalent in traditional finance. The case TRM makes for Concierge is about plumbing, not powers. Agencies often have no relationship with the issuer, cannot package a request the way it needs to arrive, or lose the race while the money is still moving. In large incidents, the company says, stolen funds have been split across thousands of transactions within days. Pre-emptive freezing is the direction supervisors have been moving in as well; Korea's financial regulator this week let exchanges freeze withdrawals on suspected hacks under a no-action letter.

"Criminals move quickly, and the agencies pursuing them need a clear path to the issuers who can act," said Esteban Castaño, CEO and co-founder of TRM Labs. "Beacon Concierge puts our investigators, our tracing and the Beacon Network behind every verified agency, so more cases can move from first lead to issuer action."

The network behind the service

Beacon launched in August 2025. TRM puts it at more than 200 members covering 80% of crypto trading volume, and says the average time to action, once flagged funds reach a member, is measured in minutes. More than $200 million has been interdicted with members to date. One claim appears only in the release: TRM says the Financial Action Task Force, the inter-governmental body that writes anti-money-laundering standards, named Beacon a leading public-private model in asset recovery guidance published in November 2025. The Block's write-up of the same announcement does not carry it.

One worked example, three counts of it

TRM's illustration is the Binance exploit of late October. Beacon has labelled more than 26,000 addresses across 14 blockchains, traced more than 67,000 transfers and links, including over 1,050 cross-chain swaps, and followed money from 59 origin addresses an average of 10 hops, as far as 71 down one branch. Members flagged 39% of those addresses. Beacon added the rest automatically from those flags. The network pushed more than 45,000 alerts to participating platforms.

The size of the theft is still contested. The Block's account cites DefiLlama putting the Binance breach at $6.36 billion inside a year-to-date total of $8.78 billion across 341 hacks and exploits. That figure sits beside the two already on the record, Binance's own $6.3 billion and Chainalysis's $5.9 billion. The three do not reconcile, and none of the three accounts explains the others.

One passage needs care. The Block presents a second TRM statement inside quotation marks, beginning "The Binance hack shows why cross-chain and multi-asset coordination is more important than ever." In the release that sentence carries no quotation marks and reads as the company's own prose. The wording is TRM's either way. It was not issued as a quote.

What Concierge does not move is the decision at the end of it. An issuer chooses whether to freeze, and the release commits only to staying with a case through that decision and to taking the most severe harms first. Neither account gives a refusal rate, a median time from submission to freeze, or how much of the $200 million has found its way back to an owner. Those are the figures that would show whether the route holds.

Read also: Chainalysis Says an Agentic Attack Reached Customer Records