Crypto firms launched a shared network to stop illicit funds at the off-ramp

TRM Labs launched Beacon Network on August 20, 2025, bringing a large group of exchanges, payment companies, custodians, investigators and law-enforcement participants into a shared alert system intended to stop stolen or criminally linked cryptocurrency before it could be withdrawn.

The launch mattered because crypto tracing had often been strongest after a theft, while recovery depended on getting usable intelligence to a platform that could still control the funds. TRM described Beacon as a real-time response network: verified investigators could flag an address, its system would trace related movements, and a participating exchange or issuer would receive an alert when tagged assets reached its service. The receiving company—not TRM or the blockchain—would then decide whether to review or hold a deposit.

A coalition built around the off-ramp

TRM’s announcement named 20 founding firms, by Coinburn’s count of the organizations listed. They included Coinbase, Binance, Kraken, OKX, PayPal, Stripe, Robinhood, Ripple, Crypto.com, Anchorage Digital and several other exchanges, custodians and decentralized-finance services. TRM also named independent researchers and security groups, including ZachXBT and Security Alliance.

That breadth was the institutional development. Competitors that ordinarily keep customer and investigations data inside separate compliance operations were agreeing to receive and act on common threat signals. Affiliate participation was described as free for verified exchanges and law-enforcement partners, reducing a commercial barrier to wider coverage.

The boundaries were equally important. TRM did not disclose every participating agency. Contemporaneous reporting identified the Australian Federal Police while saying other agencies were not yet named. The launch list also did not include the two largest dollar-stablecoin issuers, Tether and Circle. Participation therefore looked broad, but it was not universal.

Why speed had become the problem

The February 21, 2025 theft from Bybit supplied the clearest case for faster coordination. The FBI attributed the approximately $1.5 billion virtual-asset theft to North Korea on February 26 and urged exchanges, bridges, analytics firms and other service providers to block transactions tied to listed addresses. TRM said the stolen funds moved through more than 10,000 transactions during the first month after the attack. That transaction count is TRM’s vendor analysis, not an independently audited total.

TRM also estimated that at least $47 billion in cryptocurrency had been sent to fraud-related addresses since 2023. That figure measures value sent to addresses in TRM’s fraud category over an open-ended period beginning in 2023; it is not the same as adjudicated crime, realized victim losses or unrecovered proceeds. It nevertheless explained the scale of the problem the company said Beacon was built to address.

The policy setting was moving in the same direction. A July 2025 White House digital-assets report recommended more domestic and cross-border information sharing and encouraged real-time public-private participation, subject to legal obligations and civil-liberties protections. On August 18, 2025, the Treasury Department separately asked for public comment on tools including application programming interfaces, artificial intelligence, digital identity verification and blockchain monitoring under the GENIUS Act.

What was not proven at launch

Beacon’s operating design and membership were documented on August 20, but its effectiveness was not. No event-day record established how many alerts had been validated, how much money had been frozen or recovered, how quickly participants responded, or what false-positive controls applied. The system also could not reverse blockchain transfers; it depended on flagged funds reaching a cooperative intermediary with legal and technical power to pause them.

Beacon therefore represented infrastructure and coordination, not a demonstrated reduction in crime. Its significance on August 20 was that major crypto and payments firms were attempting to turn public-ledger visibility into a shared interdiction process at the point where assets could still be stopped.