Institutions evaluate defensible intelligence and act through responsible processes.
See it taking shape ↓
Helps investigators follow fund flows and examine relationships and attribution as evidence for a case, with the investigator reviewing what the evidence supports.
Tracing connected marketplace withdrawals with exchange accounts and further investigation.
Crypto narcotics investigations relied on disparate manual tools.
Named agency case with legal and investigative action; separate from software-only recovery.
Illustration: an institution reviews a transfer and its context.
Review the address risk context.
Connect movements and attributed relationships.
Check the evidence and agent output.
Document a responsible institutional next step.
TRM Labs builds intelligence tools that help public agencies and financial institutions understand illicit activity involving cryptocurrency and other digital systems. The current company story broadens this into investigations that combine blockchain information with other threat domains. Signet reads the practical problem as connecting fragments of evidence while preserving their source and meaning. A blockchain transaction records a transfer between addresses, but an investigation needs to understand the relevant entity, surrounding behavior and links with information obtained elsewhere. TRM's material describes attribution, tracing, risk signals and case-building tools around that work. The investigator or compliance team then evaluates what the information supports and which next action is appropriate. The software's role is distinct from a court's legal conclusion or an authority's power to freeze or seize assets. An illustrative Korean exchange could screen a withdrawal address, review its risk signals and follow a configured escalation path. That example explains a product workflow rather than asserting a particular Korean customer result or a universal legal requirement.
TRM Forensics presents tracing across blockchains, graphing, behavioral pattern detection and attribution with source and confidence information. Investigators can bring non-blockchain information into a graph and use it to connect a broader case. These capabilities make the relationship between the transaction and the surrounding investigation visible, but every link still needs to be evaluated in context. Co-Case Agent adds natural-language assistance for tracing, reviewing a graph and suggesting the next step. The official launch describes a record of the interaction and investigator control; its product page says the person applies final judgment. Signet therefore separates an agent's suggested path from a verified evidentiary conclusion. In a case preparation example, the analyst would retain the original transaction, explain the attribution and its confidence, document the question being asked and validate each relevant output. The result can then be reviewed by a colleague or the customer rather than resting on an unexplained generated answer. This is also the standard visible in the current intelligence analyst postings.
The official Homeland Security Investigations case study describes agents moving from disparate manual tools to blockchain intelligence for narcotics investigations. In the named Farmacy41 case, an investigative lead connected marketplace activity with a suspect, and transaction tracing helped follow withdrawals to exchange accounts. Investigators obtained additional account information and used legal processes to search, seize assets and pursue the case. The reported outcome was a USD15 million forfeiture and arrests involving the vendor and supplier. Signet uses the case to explain the sequence between financial tracing and institutional action, keeping the outcome tied to that investigation and the actors described. It does not mean that the software alone confiscated funds or that every deployment will recover a similar amount. The separate Massachusetts Attorney General case gives another public setting around investment-fraud victims. Together, the material shows that the product must fit a workflow with evidence, review and responsible institutions. A candidate should be able to explain the analytical contribution precisely without overstating the software's authority or its share of a coalition result.
Forensics is TRM's investigation environment for tracing and examining funds, entities and relationships. Its current page describes universal tracing, graph operations, behavioral signatures, attribution transparency and the use of custom graph elements. Co-Case Agent is embedded in that investigative environment. The March25 launch says it became available to Forensics customers at no additional cost, with further capabilities released over time. Signet preserves that product and date instead of assuming the same commercial terms apply to every future offering. The agent can assist with discovering patterns and performing directed graph work, while the investigator evaluates relevance and defensibility. The official HSI illustration shows a fund-flow diagram used to explain a real case. It is captioned as a case diagram rather than a screenshot of a current live user account. A candidate can use it to understand how several marketplace flows connect with a wallet, but should not treat that simplified picture as the complete evidentiary record. The broader capability remains a relationship between tool output, human expertise and reviewable source material.
Wallet Screening helps a financial or crypto business evaluate an address and its risk context. Transaction Monitoring addresses account and transaction activity over time through configurable rules, alerts and review. Entity Due Diligence supplies information around a service or business being assessed, while Triage is a separate starting point for examining an address. The September product release adds a velocity-rule condition to Transaction Monitoring, based on an account's total transfer volume over a24-hour period without requiring a risk-category filter. That is different from screening one transfer solely for exposure to a named category. Signet keeps the unit, period and rule condition visible when explaining the capability. The product descriptions can guide a demonstration, but the customer's risk policy and review process determine how a signal is used. In an illustrative withdrawal workflow, a team might screen the address, examine relevant account history, document why an alert matters and escalate it for review. Candidates should explain the information needed at each stage, rather than treating a score or automated disposition as the whole compliance decision.
The TRM MCP page describes agent access to transaction-monitoring alerts, wallet-screening results and risk context inside tools including Claude Code, Gemini and OpenAI Codex. It provides structured operations around alert details, counterparties, exposure paths and disposition. The page says dispositions need written justification and actions are recorded as MCP-originated in the audit trail. These controls matter because retrieving information, dismissing an alert and escalating a case carry different responsibilities. The September release separately describes the TRM Docs MCP, which provides account-scoped access to current API documentation. Signet keeps documentation access distinct from an agent operating on investigation or monitoring data. Deconflict and the Beacon Network address collaboration and coordination with other actors around cases and funds; TRM Academy supplies learning and certifications. They are related parts of an operating system, but their purposes and access differ. A candidate should be able to name which information a workflow consumes, which action it performs and who reviews the result. That is more useful than describing every integration as a general autonomous crimefighting capability.
Company-reported investment-round valuations, separate from revenue and public market capitalization. These are dated disclosures, not a continuous growth record.
| Date | Value | Basis |
|---|---|---|
| 2026-02-04 | $1,000,000,000 USD | Company-reported investment-round valuations, separate from revenue and public market capitalization. |
| 2026-09-09 | $2,000,000,000 USD | Company-reported investment-round valuations, separate from revenue and public market capitalization. |
TRM Labs
$1B disclosed financing valuation.
$2B disclosed financing valuation.
TRM's public products and February funding announcement describe software sold to government agencies, financial institutions and crypto businesses. The commercial need is a continuing capability to screen, monitor, investigate and document financial or digital activity. Training, customer support and specialist services connect the product with actual use. Signet interprets the model through those operating requirements rather than imagining a standard price per address or investigator. A financial institution may need risk controls across ongoing transactions, while an agency may need tracing and case-building tools around investigations. The relevant product, access and service scope would depend on that customer's agreement. Co-Case Agent's March launch states a particular inclusion for Forensics customers, showing why a feature can expand a workflow without a separate charge at that point. That does not make the entire platform free. A candidate can explain the buyer's outcome and implementation path by tracing the problem, relevant capability, review process and adoption needs. This creates a concrete business account without turning a product description into an unsupported financial forecast.
On February4,2026, TRM announced a recently closed USD70 million Series C at a USD1 billion company valuation. On September9 it announced a strategic expansion led by Blockchain Capital at a USD2 billion valuation. The latter announcement says ARR had quadrupled in three years, while the February release describes average annual revenue growth above150percent over the preceding five years. Signet preserves those statements as the company's relative operating claims and uses the two disclosed valuations for a dated financing chart. An investment-round valuation is not annual revenue or a public market capitalization. Funding received is also different from the valuation attached to the round. The ratios do not supply an absolute ARR baseline to calculate a current dollar value. A candidate should keep the type, date and basis of each measure clear before discussing the business. The chart therefore compares two reported financing valuations in2026, not sales from different accounting periods. The September customer statement provides another operating observation: more than600 public and private institutions across75 countries.
Signet interprets sustained use through the requirements expressed by the customers and products: relevant intelligence, traceable attribution, responsive workflows and the ability to review or export a record. The named HSI case includes the customer's evaluation of tracing and support, while screening and monitoring address recurring institutional operations. Data and AI capability can make work more efficient, but a useful commercial relationship still depends on the customer trusting the result and integrating it into an accountable process. Three operating risks follow from the public material. Attribution and source quality affect the analysis; an automated result must be checked; and institutions need their own responsible response when a risk or investigative lead appears. These are analytical connections, not a quantified claim about margins or retention. The intelligence analyst jobs make the first two requirements concrete through data completeness, source-cited products and human quality control. A candidate can use those examples to explain how specialist work contributes to the product that institutions purchase and continue to use.
Founded TRM after digital technology and employment work.
Build AI investigations while retaining evidentiary standards.
Brings software engineering and consulting experience.
Connect intelligence with reliable technical workflows.
Former Treasury official and federal prosecutor.
Connect threat analysis with institutional context.
“without compromising on evidentiary standards.”
Esteban Castaño · Dated official company announcement · 2026-09-09
The current official biographies identify Esteban Castaño as CEO and co-founder and Rahul Raina as CTO and co-founder. Castaño's account includes digital-technology work at McKinsey and youth employment work at Generation before founding TRM; it also describes leaving Stanford's business school to build the company. Raina's biography includes engineering at Amazon and OpenDoor alongside management consulting, with computer science and business studies at the University of Michigan. The current CEO letter dates the founding to2018 and describes the initial purpose as mapping how threat actors used cryptocurrency. Signet connects those public details with the operating choices now visible in the product: intelligence must be understandable and tools must be built to support a concrete investigation. The biographies are context, not evidence that a founder's prior employer created a particular feature or that credentials guarantee a customer's outcome. A candidate should focus on how the company turns that direction into data quality, traceable analysis, system design and the responsibilities of people using the platform.
Ari Redbord's current profile identifies him as Global Head of Policy, with prior work in the US Treasury and federal prosecution. Sujit Raman is identified as Chief Legal Officer and a former US Associate Deputy Attorney General. These public roles make the regulatory and institutional context visible around the product organization. Signet does not infer a Korean reporting line from a global title or transfer a US authority's powers to a private software vendor. The company's materials repeatedly emphasize evidence, auditability and the judgment of investigators. The March agent launch describes the person retaining control over a case, and the September funding announcement connects new AI capabilities with evidentiary standards. That is a practical leadership choice: faster tools must still support a result that someone can explain and review. Candidates can prepare an example in which they documented uncertainty, checked a source and communicated a defensible conclusion. The relevant behavior is visible both in product controls and current analyst qualifications, rather than resting only on the authority of a senior person's biography.
The current original analyst postings name three leadership principles: Impact-Oriented Trailblazer, Master Craftsperson and Inspiring Colleague. The descriptions connect customer focus and experimentation with responsibility for outcomes, high standards and clear, candid collaboration. Signet explains those behaviors in plain language while preserving the original principle names. The same postings establish applied AI fluency as a baseline and say candidates will be evaluated on it during interviewing. This goes beyond listing an AI tool: candidates should show how they structure a problem, automate a repeatable part, improve quality and validate the output. The careers page describes a distributed organization with intentional connection, written context and synchronous decision-making. The role-specific text then makes working rhythms more concrete, including incident response or partner coordination across time zones. Candidates should compare those conditions with their preferred work and demonstrate the craft required for the actual function. That may mean a hack analysis and incident briefing for one role, or a source-cited environmental-crime report and external partner program for the other.
Own hack or environmental intelligence, evidence quality and cross-regional delivery.
Open posting count, not team headcount
Open posting count, not team headcount
Posting counts describe current functions, separate from team headcount.
Korea is an allowed work location within global intelligence roles.
The official Ashby posting API currently lists110 positions. Signet checked primary locations, secondary locations and public address fields rather than treating every global remote posting as eligible for Korea. Two listed roles explicitly include South Korea, with Seoul in the secondary address: Senior / Staff Threat Intelligence Analyst, Hacks, and Senior / Staff Intelligence Analyst, Environmental Crimes. Both are remote, full-time positions in the Primary Intelligence team under R&D. Their primary locations are the United States and United Kingdom respectively, so the Korean inclusion is described as a permitted secondary location rather than a new Seoul office or a Korea-only assignment. The jobs were published on September30 and October1,2026. The count is current open-posting scope, not local headcount. This distinction matters for applicants: a global mission may be performed from Korea, but time-zone collaboration and external responsibilities remain part of the role. The exact original descriptions are kept alongside the Korean summaries so candidates can assess the requirements and operating rhythms without losing their conditions.
The Hacks posting asks for at least five years in blockchain intelligence, crypto investigations, cyber threat intelligence, incident response or a related field. It expects ownership of incident response under pressure, strong tracing across Bitcoin, EVM, TRON and Solana, and understanding of exploits and post-theft behavior. The work includes triage and coordination when a major hack occurs, rapid customer visibility, complete and accurate hack records, downstream attribution as funds move, and technical explanation of important incidents. The analyst leads a small contractor team and works with data science and engineering on systems and AI automation. Human quality control is explicit. On-call responsibilities and a war room for major events are part of the operating rhythm. Signet reads this as analytical and operational ownership rather than simply writing occasional research reports. A suitable candidate should show an incident handled end to end, explain the accuracy checks on attribution and movement, and discuss how an AI-assisted workflow was validated. A generic interest in cryptocurrency is not the experience threshold described by the original posting.
The Environmental Crimes role also asks for at least five years in intelligence, financial crime, illicit finance, blockchain intelligence or transnational investigations. It adds domain knowledge around wildlife trafficking, environmental crime or a closely related illicit-trade field, plus source-cited writing and OSINT craft. The analyst owns a threat category and the United for Wildlife and Project Pangolin partnership work, connecting on-chain tracing with open sources and partner-provided information. The posting says prior crypto experience is not required and training is provided, while commitment to learning tracing is required and direct tracing experience is strongly preferred. Signet preserves that distinction instead of converting a preferred qualification into a mandatory one. The role requires collaboration across US, EMEA and APAC time zones, no on-call duties, and travel up to20percent. It expects about six or more major trips a year plus two TRM offsites. The original30,60and90-day expectations connect finished intelligence, partner delivery and reusable AI work with a repeatable program. Applicants should assess both analytical depth and the external relationship workload.
Current Signet catalog · 2026-10-19
Compare5+ years, on-call, travel and global overlap.
Reported financing and relative growth are separate measures.
Financial intelligence supports a wider Microsoft-led coalition.
Cyber and blockchain views connect ransomware and nation-state analysis.
The September9 Series C expansion states a USD2 billion valuation and a relative ARR growth claim over three years. It also describes a broader investigations direction linking fragmented information across threat categories. Signet keeps the financing measure separate from revenue and from product availability. The announcement's institution and country counts describe the reported customer scope at that point. Candidates can use the release to understand the stated investment direction while relying on current product and role descriptions for what a particular team actually does. Each measure belongs to its stated date and scope.
The September22 account describes TRM supporting a Microsoft-led disruption of the EvilTokens cybercrime service. Its contribution centered on the financial infrastructure, cryptocurrency relationships and downstream cash-out analysis, alongside a wider industry coalition and legal action. Signet describes that specific analytical contribution rather than attributing the complete operation to one software provider. The case illustrates the current direction toward combining cyber, identity and financial information. It also shows why a candidate needs to communicate the distinction between an observed relationship, an investigative lead and the action an institution takes. The dated account is an implementation context, separate from a claim that TRM automatically resolves all AI-enabled crime.
The current October6 article describes collaboration with Zscaler ThreatLabz on ransomware and nation-state activity, combining technical threat intelligence with blockchain financial analysis. The date on the current article matches the company-news listing; an earlier search index carried a different October2 label, so Signet uses the current original. The joint research discusses a specific period of known ransom payments, not TRM revenue or the whole cybercrime market. The wider September product update adds monitoring rules, supported MCP clients, saved agent prompts and expanded Detect coverage. Candidates can connect those changes with evidence gathering and operational response while keeping the scope, period and responsible party clear.
TRM connects financial and threat evidence with reviewable investigations.
Own hack or environmental intelligence, evidence quality and cross-regional delivery.
Employer postings were checked on 2026-10-10. Availability can change. Mock applications request a review from Signet.
Follow the company from its vision through products, evidence and people to the Korea team and current roles. Use the table of contents to move within the page, and expand the sections for more context.