Norway’s Kripos Monero Tracing Method Led to 28 Arrests in Dark Web CSAM Operation
Published
Key Takeaways
- Coordinated operation: Norway's Kripos arrested 28 men across seven countries in a dark web CSAM crackdown.
- Monero link: Suspects allegedly used Monero to buy access to various forums containing materials depicting child sexual abuse.
- Tracing breakthrough: Kripos deployed a Monero tracing method developed in 2025 to identify the suspects.
Norway's National Criminal Investigation Service, known as Kripos, announced that 28 men aged 22 to 54 have been arrested across seven countries in an international dark web operation tied to Monero payments. The suspects allegedly used the privacy-focused cryptocurrency to buy access to dark web forums containing child sexual abuse material (CSAM).
"We have worked closely with six countries to coordinate the arrests of the identified users who paid with cryptocurrency to gain access to the forums," police prosecutor Terje Nedrebø Michelsen said in a statement.
Kripos Monero Tracing Method Identifies Suspects
A central element of the case is Monero tracing. Kripos said it developed a method in 2025 that makes it possible to trace Monero use in specific cases. The agency has not disclosed how the technique works but confirmed it was used in this operation to identify individuals who allegedly paid for forum access.
Regulatory pressure forced major exchanges to delist Monero in some markets between 2021 and 2023. Monero's on-chain transaction volume grew by approximately 30%-35% this year.
Investigators seized more than 460 items, including:
- electronic devices,
- storage media,
- crypto wallets,
- illegal CSAM material,
- drugs,
- large quantities of doping substances.
Europol said the suspects will face charges for storing, acquiring, and sharing CSAM, and that one suspect was extensively using artificial intelligence (AI) to generate illegal material. Europol also said some of the identified victims were part of another suspect's immediate family.
Ongoing Investigation and Child Protection
In Norway, two people were identified, and one man in his 30s from Trøndelag was arrested. Investigators also identified two suspected sellers of illegal abuse material, neither of whom is located in Norway. During searches, police implemented measures to protect three children who were present.
Kripos said the investigation remains ongoing, with many suspects still in the case and more arrests expected, potentially in additional countries.
The arrests took place in Norway, Sweden, Switzerland, Canada, the Czech Republic, Poland, and Germany. The operation ran from late May to mid-June 2026.
In April, eight tech giants' CSAM reporting deficiencies were investigated following NCMEC-documented findings. Offenders also used cryptocurrency transactions for Kidflix, a CSAM platform with 1.8 million users active from April 2022 to March 2025.
Related
Get expert insights on threats, breaches, scams, and security trends — delivered every Monday.
Most Popular
Get expert insights on threats, breaches, scams, and security trends — delivered every Monday.
Most Popular