Three Platforms, Three Positionings

The blockchain tracing market has become, by 2026, a stable oligopoly centered around three names. Chainalysis, founded in 2014, remains the gold standard for investigations intended to be presented in court. Elliptic, founded in 2013, positioned its flagship product Navigator on cross-chain coverage and data depth (99% claimed market coverage, 100 billion indexed data points). TRM Labs, founded in 2018, achieved unicorn status in 2026 by focusing on AI and real-time threat intelligence, which appeals to national security-oriented clients.

This differentiation is not marketing. It determines which tools are used in which contexts, and therefore which modes of operation remain more or less exposed.

Chainalysis: Legal Robustness

Chainalysis Reactor 2.7, the reference version as of mid-2026, offers a mature investigation workflow that includes automated demixing for mixer analysis (with known limitations on Tornado Cash and certain stateless architectures), a seed phrase recovery toolkit, and cross-chain tracing. The hallmark is evidentiary quality, that is, the ability to present findings in a form acceptable to a jurisdiction. More than 1,500 client organizations, including the majority of major law enforcement agencies. The 2025 and 2026 US indictments in darknet mixer cases cite Chainalysis almost systematically as the investigation source.

Where Chainalysis is weaker: emerging chains (uneven coverage on chains launched after 2023), Lightning Network operations (limited visibility on multi-hop payments with blinded paths), and Monero (coverage limited to probabilistic matches via identifiable on-ramp and off-ramp flows).

Elliptic: Coverage

Elliptic Navigator 4, released in March 2026, capitalizes on the depth of data accumulated since 2013. The product excels at complex modern frauds that move funds across multiple bridges and DEXs. The claimed coverage is 99% of the market, which includes a high number of EVM chains and several major non-EVM chains.

Elliptic's trade-off lies in workflow. Where Chainalysis pushes evidentiary value, Elliptic prioritizes analytical intelligence. This intelligence is useful for understanding a criminal operation or tracing a flow, but it translates less readily into procedural evidence. Elliptic's clients are more often compliance teams and financial intelligence units than law enforcement prosecutors.

Weaknesses analogous to Chainalysis on Monero, and limited on Lightning. Notable strength on bridges and cross-chain operations via Atomic Swap, which has become a critical area with the growth of bridging protocols.

TRM Labs: Speed and AI

TRM Forensics 2026 is positioned on real-time, which means a focus on automated alerts and agentic AI. The promise is to transform chain analysis from a post-event investigation activity into a continuous monitoring discipline. Typical clients are exchanges under compliance pressure, financial institutions exposed to crypto, and certain government agencies oriented toward national security.

The TRM Labs approach is powerful for quickly identifying suspicious flows at the moment they emerge. It is less equipped for deep analysis of an isolated case. The co-paper by Friedhelm Victor (TRM Labs) on Haveno and Bisq, published in 2025, suggests that the company is also investing in R&D on P2P DEXs, which could extend its coverage toward areas currently marginal for its competitors.

What still holds out

Three privacy zones remain exploitable against the three tools in June 2026.

  • Monero, in strict usage. An operation that never crosses an identifiable on-ramp or off-ramp, and maintains uncorrelatable stealth addresses, remains opaque to Chainalysis and Elliptic. TRM Labs is investing to reduce this angle, but no public capture of a pure Monero flow has been documented by the three platforms in 2025-2026.
  • Lightning Network with blinded paths. Multi-hop payments with path masking remain invisible to the three tools, provided that intermediate peers are independent. The growing concentration of Lightning around a few major hubs reduces this protection without eliminating it.
  • Direct Atomic Swaps. Protocols like COMIT and BasicSwap execute Bitcoin-to-Monero exchanges without a centralized intermediary. The arxiv paper 2505.02392 identifies detectable patterns, but their exploitation remains theoretical at the stage of known indictments.

What no longer holds up

The other side of the coin is equally clear. Post-OFAC Tornado Cash is now traceable by Chainalysis with sufficient precision to support a proceeding (the 2025 and 2026 indictments against operators and certain major users attest to this). Naive uses of Bitcoin Mixer 2 are systematically demixed. Operations that pass through a centralized exchange even briefly are almost always reattributable to the end user.

Implications for the directory

The rating grid for listed services accounts for these developments. Services that rely on privacy architectures recently compromised (notably certain third-generation mixers) have seen their rating adjusted. Services that remain firmly positioned in the three resistant areas (native Monero P2P, Lightning with blinded paths, atomic swaps) keep or increase their rating.

For the operational user, the conclusion is that no privacy tool guarantees opacity indefinitely. The computational cost of chain analysis is steadily decreasing, and the scope of what was theoretically traceable is gradually becoming practically traceable. Usage discipline, in terms of compartmentalization and frequency, becomes at least as important as the choice of tool.

Verdict

Chainalysis, Elliptic, and TRM Labs do not do the same thing, and do not represent the same threat for the same types of operations. Understanding this differentiation has become essential for anyone wishing to operate in privacy with a lucid threat model. Our directory will continue to flag, to the extent information is available, which services remain solidly positioned against which tracing platforms. For the rest, continuous monitoring is the only lasting defense.