Why
The stated purpose of the operation is the finding. It was not run to detect anything — the crypto intelligence already existed, and the operation's job was to convert it into leads investigators could act on. That sentence locates the bottleneck precisely, and it is not where most people assume. On-chain analysis was never the scarce part. The transaction graph is public, permanent and complete; anyone can trace flows between addresses and cluster them. What the graph never contains, at any depth of analysis, is a name.
So the operation was a join, and the join key lives off-chain. An address becomes a person only where the chain touches an intermediary that performed identity verification — an exchange, a payment platform. That is why the participant list matters more than the tooling: 9+ agencies for legal authority and 13+ private firms because the identity half is theirs, held in systems that compete with each other. Getting Binance, Coinbase and Block to contribute against the same address set, in one place, over several days, is an organisational achievement, not a technical one. Chainalysis says it intends to reuse that model for other crime types, which is the honest description of what was actually built.
The distribution of the numbers says the same thing again. 125 countries and 100+ platforms across clear and dark web on one side; 16 confirmed registered offenders on the other. The wide numbers describe the graph, which is easy to see. The narrow number describes identification, which requires the join. The ratio between them is the price of the missing key.
And this catalogue has already asked the constructive version of the question. what-encryption-does-not-hide studies computing over data that cannot leave its owner, and what-encryption-does-not-hide asks which parties see which fields. Put those next to a fusion operation and a real question appears: how much of this join could be done without anyone pooling raw identity data — private set intersection over address lists, clean-room queries answering does this address match a verified account at your institution without disclosing the account. Not a criticism of the operation, which used what exists. A statement of what the technique would have to become to run without a room.
How it works
The funnel, and where it stops
| Step | Published | What the step requires |
|---|---|---|
| Addresses and identifiers examined | 29,120 | On-chain analysis — public data, no permission needed |
| Investigative leads produced | 14,300 | Enrichment and correlation across months of prior work |
| Suspect accounts identified | 7,700+ | The join — only exchanges and payment platforms can supply it |
| Registered offenders confirmed | 16 | Cross-reference against an external registry |
| Arrests, prosecutions, sanctions | not yet published | Courts and jurisdictions — 125 of them are in scope |
Every published figure sits upstream of the one that decides whether the operation worked. That is not concealment: the outcomes genuinely have not happened yet, and Chainalysis says it will share them as they arrive. It does mean the honest reading of the announcement today is a pipeline was built and filled, not a result was achieved — and the follow-up worth diarising is whether the bottom row ever gets a number.
Why the participant list is the artifact
| Contribution | Who supplied it | Why it cannot come from elsewhere |
|---|---|---|
| Transaction graph, clustering | Chainalysis | Public data — the one part anyone could reproduce |
| Identity behind an account | Binance, Coinbase, Block | Held under KYC obligations, in competing systems |
| Legal authority to act | Europol, AFP, RCMP, NCA | Jurisdictional, and there are 125 jurisdictions here |
| Content classification | IWF and specialist non-profits | Neither exchanges nor analysts are positioned to do it |
| The room itself | NCFTA | Somewhere all of the above can sit together lawfully |
The question this catalogue can actually work on
How much of the join survives without pooling? The operation's shape — bring every holder of a fragment into one room — is the version available today. The version worth studying is whether the same answer can be reached by parties who never exchange raw records: private set intersection over address lists, or a clean-room query returning matched / not matched against a verified-account set without revealing the account. what-encryption-does-not-hide is where the technique lives; this is a concrete problem to point it at, with a public funnel to measure any proposal against.
Reading it soberly
The subject is the most serious one this catalogue touches, and the discipline is unchanged: report only the published numbers, mark the step that has none, and do not treat leads as outcomes. The Korean note in the announcement — that these cases keep arising domestically and that blockchain intelligence will be offered to support investigations — is a statement of intent, and belongs in the same column as everything else that has not happened yet.