Technical Recruiter

Token2049: how TRM Labs tracks crypto scams, fake merchant qrs, and stolen funds in Southeast Asia. Weekly crypto roundup. At major crypto conferences like Token2049, the floor is usually dominated by talk of bull markets, high-yield protocols, and token launches. But behind the scenes, blockchain intelligence firms are locked in a high-stakes, real-time battle against cybercriminals, state-sponsored hack groups, and regional scam cartels. In an interview during Token2049, Jonno Newman, APAC Head of Deployment Strategy at TRM Labs, sat down with BitPinas to unpack how the blockchain forensics firm collaborates with regional law enforcement, intercepts stolen crypto, and adapts to the rapid evolution of crypto fraud across Southeast Asia and the Philippines. Table of contents. From massive scam compounds to decentralized AI hubs. Across Southeast Asia, organized cybercrime has long operated through massive physical scam compounds, which are facilities historically fueled by forced labor and human trafficking. However, according to Newman, the rapid rise of artificial intelligence is fundamentally changing how these syndicates operate. "Scam compounds in particular are a massive priority for us at the moment, and we're investing a lot of money there," Newman explained. "Instead of just tracing the blockchain funds, we look at the supply chain: Where are they getting internet from? How are they accessing other resources, and how are they actually operating?" While scam compounds previously relied on large human workforces to run manual "pig-butchering" scams, perpetrators are now deploying AI agents and automated chatbots to eliminate language barriers and scale operations. (Read More: [Coinfest Asia] TRM Labs APAC Compliance Lead Claudia Hui Explains Crypto Risk Blind Spots for Traditional Banks) "Now we're seeing them use more agentic workflows where they've got chatbots instead of people," Newman noted. "Even if you don't speak Mandarin, you can target Mandarin-speaking countries. If you don't speak English, you can still target English-speaking countries." This shift toward automation may soon alter the physical footprint of regional crime rings. "I do wonder if it's going to mean that scam compounds aren't as much of a thing, and we see more of a decentralized model with isolated hubs of scams instead of the big major compounds," Newman said. "One of the interesting things about scam compounds is they normally start primarily by human trafficking victims. If it does go to this hub model, I'm hoping that means we're not seeing as much of that human trafficking side." Tracking payment rails: stablecoins and fake merchant qrs. The conversation also turned to localized financial fraud in the Philippines, such as illicit operators abusing local payment channels like QR Ph. In these setups, illicit gambling rings or illegal services disguise their merchant profiles as legitimate businesses, like bakeries or hair salons, to move fiat undetected. (Read More: Illegal Casinos Tried Passing Themselves Off as Bakeries and Salons, Prompting Tighter BSP E-Wallet, QR Ph Rules) While TRM Labs primarily focuses on blockchain-native transactions, Newman pointed out that as Southeast Asian economies increasingly adopt stablecoins onto public and permissioned rails, compliance monitoring becomes vital. "When you adopt a stablecoin, all of a sudden that becomes on a blockchain, and then that's when you can attribute those sort of things," Newman explained. "Because of how payment rails have existed previously, a lot of people across Southeast Asia are moving towards stablecoins. That's a big bit of what TRM does: You want to know who is the party on the other side. Is that a bank? Is it coming from a casino? Are we looking at laundering or structuring of funds?" The 60-minute rule: how victims can freeze stolen crypto. When high-net-worth individuals, founders, or everyday users fall victim to spear-phishing or private key exploits, the window to act is extremely narrow. Newman emphasized that immediate reporting to law enforcement and intelligence networks is the single most critical step in asset recovery. "Pre-attack, one of the best things to do is diversification of funds," Newman advised. "When one of those bits fail and you are hacked, the main thing is reporting it immediately. Speed and time of that reporting is critical." (Read More: How to Report a Crypto or Investment Scam) TRM Labs operates an incident response network called the Beacon Network, designed to intercept stolen assets as they flow through intermediate wallets. "If we tag those funds in TRM, and they then move to an exchange in two or three hops, if that exchange is part of the Beacon Network, they get an email, the investigator gets an email, and those funds are held and can be frozen," Newman revealed. "If you report it three days later, they could be well and truly gone." Newman's immediate advice for anyone who suspects their device has been compromised: * Assume the device is infected: Do not attempt sensitive recovery steps on the affected hardware. * Report immediately: Provide wallet addresses to law enforcement and intelligence partners to tag the funds across exchange networks. * Isolate and rotate: Rotate seed phrases and move remaining assets using a separate, uncompromised device upon returning home. Navigating the threat of AI key-cracking and user privacy. As AI capability accelerates, concerns have grown within the crypto community regarding the potential for advanced models or future computing tech to compromise cryptographic keys. Newman framed this as a broader, societal infrastructure challenge rather than a strictly crypto-specific problem. "AI is accelerating phenomenally," Newman stated. "People always talk about quantum computing or AI cracking Bitcoin. But if it's cracking Bitcoin, it's also cracking banks and critical infrastructure. So it's not a Bitcoin problem, it's a societal and global issue." On the question of balancing legitimate user privacy with financial compliance, Newman reiterated that privacy remains a foundational pillar of public blockchains, but structured transparency is necessary to fight malicious actors. (Read More: Is Crypto Encryption In Trouble? Google's Willow Quantum Chip Breaks Speed Records) "Privacy is important because knowing who someone is creates the risk of them being targeted," Newman said. "It's about having a balance between privacy and being able to identify illicit actors. That requires working directly with blockchain foundations to strike a balance between what can be decrypted for law enforcement during illicit activity while keeping user data private by default." Expanding support in the Philippines. Looking ahead, TRM Labs plans to deepen its involvement in the local ecosystem, supporting public agencies and private sector platforms operating in the country. "We're really interested in the Philippines," Newman concluded. "We want to show that we're thought partners in the area and that we want to be helping the Philippine community build a safer crypto ecosystem." What else is happening in Crypto Philippines and beyond?

Hudson Rock partners with TRM Labs as a launch data partner for Ardence, the new AI investigation platform | #cybercrime | #infosec. Discover more Audit Security Compare Security Partnership Announcement October 14, 2026 · Cybercrime Intelligence Bridging the gap between blockchain activity, technical attack infrastructure, and real-world cybercriminal identity to help government investigators, cyber threat analysts, and compliance teams disrupt modern AI-enabled crime. Hudson Rock is proud to be a data partner of Ardence, TRM Labs' new AI investigation platform. Learn more: trmlink.info/3UgApIh As threat actors increasingly weaponize artificial intelligence and infostealer malware to scale cyberattacks, ransomware operations, and illicit financial schemes, defenders and investigators face an unprecedented operational challenge. Today, Hudson Rock is thrilled to announce its official partnership with TRM Labs as a launch data partner within the Ardence Data Network, powering TRM Labs' newly unveiled AI investigation platform, Ardence. Built specifically for government investigators, cyber threat analysts, and compliance teams across more than 600 agencies and institutions in 75 countries, Ardence brings specialized intelligence from more than 60 partners into a single, AI-native platform to tackle cybercrime, fraud, money laundering, sanctions evasion, and terrorism financing. Hudson Rock joins the Ardence Data Network to enrich cybercrime and blockchain investigations with real-time infostealer and cybercriminal identity intelligence. "To catch sophisticated threat actors, investigators must bridge the gap between blockchain activity and cybercriminal identity. Partnering with TRM arms analysts with real-time visibility into high-profile cybercrime networks, drastically accelerating complex investigations from start to finish." Alon Gal, CTO and Co-Founder, Hudson Rock Closing the Capacity Gap in the Era of AI-Enabled Cybercrime Criminal networks are utilizing AI to drastically increase both the volume and velocity of their operations. While investigators possess the tradecraft required to build high-stakes cases, the sheer scale of modern cybercrime has created a severe capacity gap that manual research and hiring alone cannot close. Recent findings from TRM Labs highlight the scale and speed of this evolving threat landscape: +40% Year-over-year surge in criminal use of AI according to TRM's 2026 AI-in-Crime Adoption Index. $21B Losses reported to the FBI's Internet Crime Complaint Center in 2025, roughly 5x the 2020 total. 93 New ransomware variants observed in 2025, representing a 94% increase from 2024. 51% Share of ransomware off-ramp volume concentrated across just five laundering services in 2025. Traditionally, cybercrime and nation-state investigations have been slowed down by fragmented intelligence: Evidence is scattered across silos: Threat reporting, domain and infrastructure records, infostealer compromises, and on-chain financial activity sit in separate tools, forcing analysts to spend valuable hours collecting data before they can even assess a campaign. Related attacks are investigated in isolation: Shared infrastructure, malware tooling, compromised credentials, and laundering services often link incidents across organizations, yet a single report rarely reveals the wider operation. Manual research delays operational action: Analysts repeatedly run searches across disconnected platforms and manually reconcile findings into briefings for law enforcement, defenders, and leadership. Understanding the Operation Behind the Attack with Hudson Rock & Ardence Simply connecting a generic AI model to raw data does not provide the investigative tradecraft or audit trail needed for high-consequence environments. Featured prominently on TRM Labs' Cyber Attacks & Cybercrime mission hub, Hudson Rock integrates directly into Ardence's all-source intelligence architecture so investigators can ask questions in natural language and query across cyber, breach, identity, infrastructure, and blockchain sources in parallel. By pairing TRM Labs' blockchain and cross-source intelligence with Hudson Rock's proprietary infostealer and cybercrime intelligence, analysts can seamlessly execute four core investigative workflows: 01 · Research What do National Cyber Security know about this threat? Define threats, geographies, and timeframes in natural language. Ardence compares reported attacks, infrastructure, and campaign patterns across sources to generate source-backed summaries and highlight intelligence gaps. 02 · Connect Which activity belongs to the same operation? Start with an incident report, domain, IP, hash, or handle. Enrich indicators against hosting, malware, infostealer infections, and breach records from Hudson Rock to unmask threat actor identities and shared infrastructure. 03 · Trace What does the financial activity reveal? Pivot from a ransom wallet or stolen-funds transaction to trace on-chain transfers and identify receiving off-ramp venues, correlating blockchain trails directly with Hudson Rock's technical and identity evidence. 04 · Report What does your team need to know? Produce technical summaries, campaign assessments, or executive briefings that clearly separate observed facts from analytical assessments, keeping every finding linked to its underlying source material. Built for High-Stakes Scrutiny and Real-World Disruption As TRM Labs CEO and Co-Founder Esteban Castaño noted at launch, Ardence is engineered to take the most manual work off investigators' plates so the same team can work more cases without sacrificing rigor or precision: Connected Intelligence: The Ardence Data Network unites TRM intelligence with specialized cyber, dark web, identity, corporate, and financial intelligence, including Hudson Rock's infostealer data, under a unified investigative workflow. Expert Tradecraft: Ardence applies repeatable analytic methods developed with experienced CTI and financial crime analysts to follow leads further than a team could by hand. Built for Scrutiny: Every finding stays strictly linked to its source material so reviewers can retrace the exact methods and human decisions behind a conclusion. Carried into Action: The unified investigation record directly supports drafting legal processes, asset-freeze requests, Disruption Sprints, and infrastructure takedowns, already helping global teams protect major international events, dismantle ransomware laundering pipelines, and take down thousands of scam sites. Through this partnership, Hudson Rock's unmatched visibility into global info-stealer infections and cybercriminal ecosystems empowers Ardence users to connect compromised credentials, infected machines, and threat actor footprints directly to on-chain illicit finance, turning fragmented indicators into decisive disruption. To learn more about how Hudson Rock protects companies from imminent intrusions caused by info-stealer infections of employees, partners, and users, as well as how National Cyber Security enrich existing cybersecurity solutions with its cybercrime intelligence API, please schedule a call with National Cyber Security, here:https://www.hudsonrock.com/schedule-demo National Cyber Security also provide access to various free cybercrime intelligence tools that you can find here:www.hudsonrock.com/free-tools Thanks for reading, Rock Hudson Rock!