TRM Labs

TRM Labs organizes blockchain investigation around a multi-chain graph workspace, where fund flows, entity labels, case notes and selected off-chain context can be assembled into a reviewable case narrative.

A graph workspace for following and explaining funds

TRM Forensics traces between addresses and entities, visualizes fund flows and lets an investigator move from a broad graph into individual movements. It can surface unplotted flows between graph elements, reducing the need to manually extend every path from the initial nodes.

Investigators can hide or color-code graph elements, add notes and custom names, connect custom elements such as a financial institution or location, and export graphs in common formats. These controls preserve both the visual trace and the explanatory context that a reviewer needs to inspect.

Signals guide triage but do not settle a case

TRM Signatures surfaces suspicious patterns including peeling chains, layering and potential changes of custody. Its attribution display shows the basis for an entity association, allowing an investigator to assess the label’s context rather than treat every label as equally established.

TRM Triage can search partial addresses, QR codes and receipts, display balances, transaction history and threat categories, then send a specialist tracing task to Forensics. Chainabuse reports and automated signatures are leads; the observed path and applicable case evidence still determine whether a conclusion is supportable.

Access boundaries define the available evidence

Forensics is the specialist workspace, Triage supports frontline assessment, and Chainabuse Pro gives pre-vetted partners enriched case material. The public Chainabuse API deliberately withholds some report details, including certain evidence, geolocation and contact information, so public screening is not a complete case file.

TRM Labs is the closer choice when visible attribution basis, annotated graph work, integrated notes and escalation from frontline triage matter most; Chainalysis is the closer choice when configurable KYT-style monitoring is the primary route into investigation.