Hudson Rock partners with TRM Labs as a launch data partner for Ardence, the new AI investigation platform | #cybercrime | #infosec. Discover more Audit Security Compare Security Partnership Announcement October 14, 2026 · Cybercrime Intelligence Bridging the gap between blockchain activity, technical attack infrastructure, and real-world cybercriminal identity to help government investigators, cyber threat analysts, and compliance teams disrupt modern AI-enabled crime. Hudson Rock is proud to be a data partner of Ardence, TRM Labs' new AI investigation platform. Learn more: trmlink.info/3UgApIh As threat actors increasingly weaponize artificial intelligence and infostealer malware to scale cyberattacks, ransomware operations, and illicit financial schemes, defenders and investigators face an unprecedented operational challenge. Today, Hudson Rock is thrilled to announce its official partnership with TRM Labs as a launch data partner within the Ardence Data Network, powering TRM Labs' newly unveiled AI investigation platform, Ardence. Built specifically for government investigators, cyber threat analysts, and compliance teams across more than 600 agencies and institutions in 75 countries, Ardence brings specialized intelligence from more than 60 partners into a single, AI-native platform to tackle cybercrime, fraud, money laundering, sanctions evasion, and terrorism financing. Hudson Rock joins the Ardence Data Network to enrich cybercrime and blockchain investigations with real-time infostealer and cybercriminal identity intelligence. "To catch sophisticated threat actors, investigators must bridge the gap between blockchain activity and cybercriminal identity. Partnering with TRM arms analysts with real-time visibility into high-profile cybercrime networks, drastically accelerating complex investigations from start to finish." Alon Gal, CTO and Co-Founder, Hudson Rock Closing the Capacity Gap in the Era of AI-Enabled Cybercrime Criminal networks are utilizing AI to drastically increase both the volume and velocity of their operations. While investigators possess the tradecraft required to build high-stakes cases, the sheer scale of modern cybercrime has created a severe capacity gap that manual research and hiring alone cannot close. Recent findings from TRM Labs highlight the scale and speed of this evolving threat landscape: +40% Year-over-year surge in criminal use of AI according to TRM's 2026 AI-in-Crime Adoption Index. $21B Losses reported to the FBI's Internet Crime Complaint Center in 2025, roughly 5x the 2020 total. 93 New ransomware variants observed in 2025, representing a 94% increase from 2024. 51% Share of ransomware off-ramp volume concentrated across just five laundering services in 2025. Traditionally, cybercrime and nation-state investigations have been slowed down by fragmented intelligence: Evidence is scattered across silos: Threat reporting, domain and infrastructure records, infostealer compromises, and on-chain financial activity sit in separate tools, forcing analysts to spend valuable hours collecting data before they can even assess a campaign. Related attacks are investigated in isolation: Shared infrastructure, malware tooling, compromised credentials, and laundering services often link incidents across organizations, yet a single report rarely reveals the wider operation. Manual research delays operational action: Analysts repeatedly run searches across disconnected platforms and manually reconcile findings into briefings for law enforcement, defenders, and leadership. Understanding the Operation Behind the Attack with Hudson Rock & Ardence Simply connecting a generic AI model to raw data does not provide the investigative tradecraft or audit trail needed for high-consequence environments. Featured prominently on TRM Labs' Cyber Attacks & Cybercrime mission hub, Hudson Rock integrates directly into Ardence's all-source intelligence architecture so investigators can ask questions in natural language and query across cyber, breach, identity, infrastructure, and blockchain sources in parallel. By pairing TRM Labs' blockchain and cross-source intelligence with Hudson Rock's proprietary infostealer and cybercrime intelligence, analysts can seamlessly execute four core investigative workflows: 01 · Research What do National Cyber Security know about this threat? Define threats, geographies, and timeframes in natural language. Ardence compares reported attacks, infrastructure, and campaign patterns across sources to generate source-backed summaries and highlight intelligence gaps. 02 · Connect Which activity belongs to the same operation? Start with an incident report, domain, IP, hash, or handle. Enrich indicators against hosting, malware, infostealer infections, and breach records from Hudson Rock to unmask threat actor identities and shared infrastructure. 03 · Trace What does the financial activity reveal? Pivot from a ransom wallet or stolen-funds transaction to trace on-chain transfers and identify receiving off-ramp venues, correlating blockchain trails directly with Hudson Rock's technical and identity evidence. 04 · Report What does your team need to know? Produce technical summaries, campaign assessments, or executive briefings that clearly separate observed facts from analytical assessments, keeping every finding linked to its underlying source material. Built for High-Stakes Scrutiny and Real-World Disruption As TRM Labs CEO and Co-Founder Esteban Castaño noted at launch, Ardence is engineered to take the most manual work off investigators' plates so the same team can work more cases without sacrificing rigor or precision: Connected Intelligence: The Ardence Data Network unites TRM intelligence with specialized cyber, dark web, identity, corporate, and financial intelligence, including Hudson Rock's infostealer data, under a unified investigative workflow. Expert Tradecraft: Ardence applies repeatable analytic methods developed with experienced CTI and financial crime analysts to follow leads further than a team could by hand. Built for Scrutiny: Every finding stays strictly linked to its source material so reviewers can retrace the exact methods and human decisions behind a conclusion. Carried into Action: The unified investigation record directly supports drafting legal processes, asset-freeze requests, Disruption Sprints, and infrastructure takedowns, already helping global teams protect major international events, dismantle ransomware laundering pipelines, and take down thousands of scam sites. Through this partnership, Hudson Rock's unmatched visibility into global info-stealer infections and cybercriminal ecosystems empowers Ardence users to connect compromised credentials, infected machines, and threat actor footprints directly to on-chain illicit finance, turning fragmented indicators into decisive disruption. To learn more about how Hudson Rock protects companies from imminent intrusions caused by info-stealer infections of employees, partners, and users, as well as how National Cyber Security enrich existing cybersecurity solutions with its cybercrime intelligence API, please schedule a call with National Cyber Security, here:https://www.hudsonrock.com/schedule-demo National Cyber Security also provide access to various free cybercrime intelligence tools that you can find here:www.hudsonrock.com/free-tools Thanks for reading, Rock Hudson Rock!

Why your Data Lakehouse is slower than your old warehouse (and what you did wrong during migration). Team Ascend September 23, 2026 A team moves off an expensive proprietary warehouse, excited about open formats and lower storage cost, and a few months later the dashboards that used to load in seconds are taking minutes. Analysts start asking why the new platform feels slower than the one it replaced. This is a common story, and it rarely means the lakehouse architecture itself was the wrong choice. Adoption of this model keeps climbing. According to Dremio's State of the Data Lakehouse in the AI Era report, which surveyed 563 IT decision-makers in late 2024, 41% of organizations had already migrated from a cloud data warehouse to a lakehouse, more than from any other source system, citing cost efficiency and unified data access as the top drivers. The architecture works. What usually breaks performance is how the migration itself was executed, which is where data engineering services come in. Where lakehouse performance actually breaks down. Most performance complaints trace back to a small number of decisions made during migration, not a limitation of the platform. Two patterns show up again and again once you look at the query logs: * Copying the old table structure instead of redesigning it. Teams under time pressure often lift the schema straight out of the old warehouse and load it into the new environment without rethinking partitioning, file layout, or clustering. * A structure that worked well for a proprietary warehouse engine does not automatically perform the same way on an open table format like Iceberg or Delta Lake, because the underlying storage and query engines behave differently. * The small files problem. Data that streams in continuously, or gets written in small batches across many partitions, ends up scattered across thousands of tiny files instead of a manageable number of larger ones. The total data volume barely changes, but query engines have to open and scan far more files to answer the same question. Without a regular compaction and clustering process built into the pipeline from day one, this gets worse every week after going live, quietly, until someone finally notices the dashboards have slowed to a crawl. What good migrations actually do differently. The gap between a lakehouse that performs and one that does not usually comes down to whether these problems were addressed before go live or discovered after complaints started rolling in. Engine selection matched to the actual workload. Not every query engine performs equally well on every kind of workload. High concurrency, low latency dashboard queries behave very differently from long running batch analytics, and choosing an engine without testing against your real query patterns is one of the fastest ways to end up disappointed. TRM Labs, presented at Iceberg Summit 2025, offers a well documented example. Working with more than 100 terabytes of data growing 25 to 45% annually, and a strict three second latency requirement for customer facing analytics, the team evaluated several engines before settling on the right fit for their workload. The result was a 50% improvement in P95 query latency and a 54% reduction in query timeout errors compared to their prior setup. Compaction, clustering, and partition management cannot be a one time cleanup step performed right before launch. They need to run continuously as part of the data pipeline, or the small files problem simply returns within a few months. This kind of continuous tuning matters most for teams handling high volume, fast moving data, the same challenge that shows up in logistics and supply chain analytics, where shipment, inventory, and tracking data streams in around the clock. Ascend Analytics covered this in more depth in Analytics in Logistics and Supply Chain: A Game Changer for Your Business. A migration checklist worth running before you commit. A short audit before migration usually prevents most of these issues: * Map expected query patterns and latency requirements before choosing an engine * Build a realistic plan for file sizing and compaction, not just at launch but ongoing * Assign a clear owner for table maintenance after go live, not just during the migration project * Test the chosen engine against real production query patterns, not synthetic benchmarks Why this is a data engineering problem, not a platform problem. Most vendors selling lakehouse platforms will tell you the architecture supports both flexible storage and fast queries, and that is generally true. What they will not always tell you upfront is that reaching that performance requires deliberate engineering work throughout the migration, not just at the end. Teams that plan file layout, engine selection, and monitoring into the pipeline from the start tend to catch these issues during planning instead of during a stressful post launch fire drill. Query performance also depends on what happens after the data lands. Dashboards built on a solid business intelligence layer surface these slowdowns early, before they turn into a pattern of complaints. Frequently asked questions. Does moving to a lakehouse always cause performance problems? No. A properly planned migration with the right engine choice, file layout strategy, and ongoing maintenance plan can match or beat the performance of a traditional warehouse. The performance problems people run into almost always trace back to migration shortcuts, not a limitation of the lakehouse model itself. How does Ascend Analytics help teams avoid these migration mistakes? Ascend Analytics plans migrations around actual query workloads rather than assumptions, building file layout, compaction, and monitoring into the pipeline from day one instead of treating them as an afterthought. Is a lakehouse always cheaper to run? Often, but not automatically. Storage costs can drop significantly, but if poor file layout forces excessive computation to compensate, some of those savings disappear into higher query costs. Cost and performance need to be planned together. What is the biggest warning sign that a migration went wrong? Query times that were fine at launch and steadily worsened over the following months, without any major change in data volume. That pattern almost always points to the small files problem building up because compaction was not built into the pipeline. Should every organization consider outside help for this kind of project? Not every organization needs it, but teams without deep experience running production lakehouse workloads at scale often benefit from working with a partner who has already seen these failure patterns and can plan around them upfront. Is your lakehouse migration actually built to perform, or just built to launch? A lakehouse that launches on schedule but slows down every month afterward was not really finished on launch day. It was missing the ongoing engineering work that keeps performance stable as data keeps growing. Ascend Analytics helps teams plan migrations around real workloads and build maintenance into the pipeline from the start. If your queries are getting slower instead of faster, reach out to Ascend Analytics and let's look at what is actually happening under the hood. Table Of Contents

TRM Labs doubles valuation to $2B as it expands into AI. TRM Labs' valuation doubled to $2 billion as the blockchain analytics firm prepares to launch a new AI-focused investigations platform in November. Published 2 hours ago · Updated 1 hour ago Key Highlights * TRM Labs said its valuation has doubled to $2 billion, six months after raising $70 million at a $1 billion valuation. * CEO Esteban Castano said the new funding reflects investor interest in TRM's planned AI investigations platform, which is expected to launch publicly in November. * The platform is designed to investigate AI-related fraud, deepfakes, sextortion and other crimes alongside TRM's existing blockchain analytics business. TRM Labs said its valuation has doubled to $2 billion following an add-on funding round from existing investors, six months after the blockchain analytics company raised $70 million at a $1 billion valuation. In an interview on September 9, CEO Esteban Castano said the funding reflects investor interest in the company's planned expansion into AI investigations while TRM continues its blockchain analytics business. The new valuation comes as TRM prepares to launch an AI investigations platform in November and continues to compete for government and institutional contracts. TRM raises additional funding from existing investors. TRM did not disclose the size of the latest funding round. Castano described it as "modest" and said the capital came entirely from existing investors. The company previously raised a $70 million Series C at a $1 billion valuation. Blockchain Capital led the round, with participation from Goldman Sachs, Bessemer Venture Partners, Y Combinator, Thoma Bravo and Galaxy Ventures. The financing brought TRM's total funding to approximately $220 million across seven rounds, according to the company. Castano said TRM expects to exceed $100 million in annual recurring revenue within weeks. He also said the company has about 500 employees, with offices or operations in London, Singapore and Washington, D.C. Castano has described the valuation as a recruitment tool, calling it a "bat signal." TRM's $95M ICE contract faces Chainalysis challenge. TRM's valuation increase follows a recent contract win with the U.S. government. U.S. Immigration and Customs Enforcement (ICE) awarded TRM Labs a contract worth approximately $95 million for blockchain analytics and crypto-tracing capabilities used in investigations. ICE awarded the contract through a sole-source procurement process - a direct award to one vendor without a competitive bidding round - after conducting market research to determine whether other vendors could provide the required capabilities. On August 17, ICE gave vendors six days to respond during the market research process. The agency subsequently determined that TRM was the only company that met its stated requirements. Those are Chainalysis' allegations and do not establish that ICE or TRM violated procurement rules. The dispute provides additional context on the competition between the two companies in the government market. TRM plans AI investigations platform. TRM is preparing to publicly launch a new investigations platform in November focused on crimes involving artificial intelligence. According to Castano, the platform will address areas including AI-enabled fraud, deepfakes, sextortion and child sexual abuse material. TRM argues that criminal networks increasingly operate across different types of crime and that cryptocurrency activity can help investigators connect related activity. Castano also said AI has reduced some of the technical barriers involved in fraud and manipulation, allowing certain activities to be carried out more quickly and at greater scale. These are the company's stated reasons for developing the platform. Because it has not yet launched publicly, its performance and customer adoption cannot yet be assessed. TRM's valuation contrasts with Chainalysis. TRM's new valuation differs sharply from the most recently disclosed valuation of Chainalysis, its larger and more established competitor. Chainalysis raised $170 million at an $8.6 billion valuation in 2022. Its valuation was later reported at approximately $1.55 billion in 2026, according Chianalysis blog publsied in May. The figures come from different funding periods and market conditions, so they do not provide a direct measure of the companies' current relative value. Chainalysis remains an established provider of blockchain intelligence. The company says it serves more than 1,500 organizations, including government agencies, financial institutions and crypto businesses. TRM's latest valuation therefore does not show that it has overtaken Chainalysis in market size. It reflects the price assigned to TRM in its latest financing and investor expectations around its existing business and planned products. Crypto crime creates demand for investigative tools. Blockchain investigation companies operate in a market shaped by the use of cryptocurrency in scams, ransomware, sanctions evasion, hacks, and other criminal activity. Chainalysis estimated that illicit cryptocurrency activity reached approximately $158 billion in 2025, while crypto hacks accounted for about $3.4 billion in losses. The figures are estimates based on the firm's methodology. TRM has also reported increased use of AI in scams and fraud. Its global head of policy, Ari Redbord, previously said the company had observed a 500% increase in AI-enabled use in scams and fraud. Government agencies have also used multiple blockchain analytics providers in cryptocurrency-related investigations. The IRS has said it began working with more than one provider rather than relying on a single vendor. These developments provide context for the market in which TRM operates as it adds AI-focused investigation tools. AI could broaden TRM's product scope. TRM's planned AI platform would take the company beyond investigations centered primarily on blockchain transactions. The company says cryptocurrency can connect different forms of online crime because digital assets are used across multiple illicit activities. The approach would also place TRM in competition with companies providing cybersecurity, fraud-detection and other investigative software, rather than only with blockchain analytics firms. The public launch in November should provide a clearer opportunity to assess the platform's capabilities and customer adoption. What comes next for TRM. TRM enters the next stage with a $2 billion valuation, a large federal contract and a planned AI investigations platform. The ICE contract remains subject to Chainalysis' legal challenge, while the AI product has yet to launch publicly. The company's stated $100 million ARR target and future customer adoption will provide additional indicators of how its business is developing. For now, the latest financing reflects investor expectations rather than a completed test of TRM's AI strategy. The November launch and the outcome of the ICE procurement dispute will provide further information about the company's position in the blockchain intelligence market. Disclaimer: The information researched and reported by The Crypto Times is for informational purposes only and is not a substitute for professional financial advice. Investing in crypto assets involves significant risk due to market volatility. Always Do Your Own Research (DYOR) and consult with a qualified Financial Advisor before making any investment decisions.