ICE’s $94.7M blockchain surveillance deal challenged

U.S. Immigration and Customs Enforcement (ICE) awarded nearly $95 million to TRM Labs for cryptocurrency forensic software and analytical support designed to trace illicit funds and help investigators identify and disrupt financial networks, according to newly unsealed court records that provide the clearest picture yet of the agency’s requirements.

TRM had brought several former senior federal officials during Trump’s first administration into its government and policy operations while retaining former Trump Treasury officials to represent it in Washington, DC.

The July 1 award is being challenged in the U.S. Court of Federal Claims by rival blockchain intelligence company Chainalysis Government Solutions, which alleges ICE improperly evaluated potential competitors against highly specific capabilities associated with TRM and then concluded that TRM was the only company capable of meeting the government’s needs.

ICE awarded TRM $94,655,840 for TRM forensic software and support services for Homeland Security Task Force investigations. Chainalysis describes it as the largest blockchain analytics contract ever awarded by the federal government.

Chainalysis filed its complaint under seal July 27. A redacted version was made public August 28. The court has not ruled on the merits of its allegations.

The dispute reveals that ICE was seeking capabilities extending considerably beyond conventional cryptocurrency tracing.

According to Chainalysis’s complaint, ICE’s May 28 Request for Information (RFI) asked prospective contractors 18 questions. Among them was whether a company owned and operated a proprietary database containing more than one million records related to financial scam victims.

ICE also asked about platforms using AI for “agentic data retrieval and entity resolution” and how many preconfigured law enforcement workflows a system could provide.

Other questions contemplated a more automated form of intervention. ICE asked whether investigators could flag cryptocurrency wallets associated with illicit activity and, if the assets subsequently moved, automatically send real-time notifications to participating virtual asset service providers (VASPs).

The RFI described a system in which participating providers could potentially execute voluntary holds without requiring investigators to coordinate manually with them each time. ICE also asked how many blockchains could support such automated notifications.

The agency separately sought information about vendors’ operational relationships with stablecoin issuers for coordinating illicit asset freezes with law enforcement and the aggregate value of funds frozen through those relationships.

ICE’s justification for using noncompetitive procedures says the agency sought an advanced analytical and AI platform, skilled intelligence analysts and capabilities for real-time monitoring, tracing and disruption of illicit financial flows.

The acquisition is tied to President Donald Trump’s March 6 Executive Order 14390, which ordered an expansion of federal efforts against transnational cybercrime, fraud and predatory schemes.

The order called for creation of an operational cell within the National Coordination Center to coordinate efforts against cyber-enabled criminal activity by foreign transnational criminal organizations and directed federal officials to draw, where appropriate, on technical capabilities, threat intelligence and operational insights from commercial cybersecurity companies and other non-federal entities.

The White House went considerably further August 12 with a presidential memorandum directing the National Coordination Center to establish a program under which vetted U.S. companies can conduct Cyber Surveillance Operations and Cyber Effects Operations against foreign cyber-enabled transnational criminal organizations under federal direction, control and oversight.

ICE and Homeland Security Investigations (HSI) previously acquired TRM forensic software and services under a single-award indefinite-delivery contract awarded in August 2022. Federal contract records show ICE subsequently placed a series of orders against the vehicle for TRM software and services.

In June 2025, ICE announced that it intended to increase the ceiling on that contract on a sole-source basis. The notice said the software and support were for HSI’s Cyber Crimes Center and that the contracting officer had determined only one source was reasonably available based on TRM’s capabilities.

The central legal dispute is not simply whether TRM possessed the capabilities ICE wanted, but whether ICE properly determined that no other vendor could satisfy its requirements.

Eight companies responded to ICE’s 18-question May RFI. The agency’s acquisition justification says its market research ultimately determined that only TRM could satisfy all of the Cyber Disruption Center’s critical needs.

Chainalysis argues that ICE reached that conclusion partly by relying on highly specific RFI criteria that were absent from the formal Statement of Need the agency issued less than two weeks later.

The complaint points to criteria involving the million-record scam victim database, AI capabilities, automated cryptocurrency notifications, operational relationships with cryptocurrency companies and the rapid deployment of cleared personnel.

Chainalysis alleges those criteria either did not appear in the Statement of Need or were expressed differently yet were subsequently used to conclude that TRM alone qualified.

The company says it could satisfy the requirements contained in the Statement of Need. It told the court that its platform provides AI-assisted investigations, blockchain analytics and off-chain intelligence and that its capabilities already support federal law enforcement work.

For sextortion investigations, Chainalysis said its tools have been used in support of HSI’s Child Exploitation Investigations Unit, HERO Program, Victim Identification Program and Project Guardian and can trace Bitcoin, stablecoins and privacy coins.

Chainalysis did acknowledge one material difference. It said it does not provide the exact automated mechanism described in ICE’s RFI under which downstream VASPs receive automatic notifications requesting voluntary holds. Instead, it said investigators can generate an actionable trace and contact the appropriate provider through established law enforcement processes.

Chainalysis also challenges how ICE conducted the final stage of its market research.

ICE issued its Notice of Intent to Sole Source to TRM on June 8 and gave interested companies until June 11 to demonstrate that they could satisfy the Statement of Need. According to the complaint, responses were limited to one page.

Chainalysis submitted a response. It alleges ICE completed its market research the following day and concluded that Chainalysis lacked automated real-time disruption, integrated on-chain and off-chain intelligence, and scalable victim identification and notification without seeking further clarification from the company.

Chainalysis characterizes the exercise as a formality used to clear the way for a TRM award rather than a meaningful evaluation of whether another company could compete. ICE’s procurement justification says the agency considered the eight RFI responses and subsequent responses to the sole-source notice and determined that TRM alone could meet all of its requirements.

Those competing accounts are now before the Court of Federal Claims.

TRM has intervened in the case to defend the award. Oral argument is scheduled for September 2.

Chainalysis initially protested the procurement to the Government Accountability Office on July 12. According to its complaint, ICE provided its justification and market research materials, Chainalysis withdrew the GAO protest July 21 and filed its Court of Federal Claims action July 27.

The company is asking the court to declare the sole-source award unlawful and prevent ICE from proceeding with the contract as awarded.

Article Topics

blockchain  |  cryptocurrency  |  ICE - U.S. Immigration and Customs Enforcement  |  surveillance