Law Enforcement Roundup: 2026 MLAT Requests That Targeted Offshore Exchange Records

A 2026 roundup of MLAT requests targeting offshore exchange records has to begin with an awkward fact: the public record is incomplete. The available material does not provide a verified list of individual 2026 requests, jurisdictions, exchanges, or response times. It does, however, show the investigative pattern behind these requests, and why offshore custodians remain central to cryptocurrency cases.

For a privacy-conscious researcher, the useful question is not simply which exchange received a request. It is what investigators were trying to establish, what legal route they used, and whether the resulting records could connect an on-chain address to a person, account, device, or transaction.

What an MLAT request is actually for

A mutual legal assistance treaty request is a formal request from one country to another for investigative or judicial assistance. In cryptocurrency cases, that assistance may involve exchange account records, subscriber information, transaction histories, wallet addresses, login data, or evidence held by a foreign service provider.

The request is generally more demanding than an informal inquiry. Investigators must identify the legal basis, describe the suspected offense, explain the relevance of the material, and specify the records sought. The receiving country then applies its own procedures before obtaining and transmitting the evidence.

This matters because an exchange is not the same thing as a blockchain. The ledger may show funds moving between addresses. The exchange may hold the records that associate one of those addresses with an identity, an email account, an account number, a device, or a withdrawal destination.

That division creates the basic investigative sequence:

• Identify and preserve the relevant blockchain transactions.
• Trace the funds through intermediary addresses and services.
• Determine which custodian controlled a deposit or withdrawal point.
• Request records from the custodian through an appropriate legal channel.
• Compare the returned records with seized devices, communications, financial data, and witness evidence.

Blockchain analysis has already been used in major investigations. Public summaries describe its role in linking BTC-e activity to Fancy Bear in 2018, supporting the 2019 takedown of a major child sexual abuse material site, recovering most of the Colonial Pipeline ransom in 2021, and helping IRS Criminal Investigation seize more than 50,000 bitcoin connected to Silk Road in 2022.

Why offshore exchanges remain attractive targets

Offshore does not mean invisible. It usually means that the records, staff, infrastructure, or legal entity sit outside the investigator’s home jurisdiction. The practical obstacle is access, not the absence of data.

An exchange may retain information that cannot be inferred from the public chain. Examples include account registration details, internal ledger entries, deposit and withdrawal histories, identity verification documents, support tickets, account notes, and records showing how funds moved between customer accounts inside the platform.

Internal transfers are particularly important. A blockchain trace can stop at an exchange deposit address because the subsequent movement may occur on the exchange’s private accounting system. An MLAT request can seek that internal trail, subject to the foreign jurisdiction’s law and the request’s level of detail.

The same records can carry different evidentiary weight. A name on an account is an investigative lead. A verified identity document is stronger. A login record that overlaps with device evidence, communications, and a matching withdrawal address is stronger still. None of these items should be treated as conclusive in isolation.

The request usually follows the money, not the platform name

Investigators do not need to begin with a known suspect. A case can start with a victim report, a seized device, a marketplace payment address, or a suspicious transaction. Blockchain analysis can then identify the services that handled the funds.

TRM Labs describes this as a risk of “leaving leads on the table” when investigators fail to follow cryptocurrency transactions on-chain. Its examples include fraud, child sexual abuse material investigations, and drug cases where addresses are discovered alongside physical evidence.

The exchange becomes relevant once the trace reaches a hosted service. At that point, the request should be built around specific transaction identifiers and time windows rather than broad demands for all customer data.

A useful request may ask for:

• The account associated with a specified deposit or withdrawal address.
• Transactions involving identified hashes, addresses, and timestamps.
• The exchange’s internal ledger entries for the relevant assets.
• Registration and verification records for the identified account.
• Login, access, and account-change records within a defined period.
• Records showing linked accounts, destination addresses, or internal transfers.
• Preservation of the material while the formal request is processed.

The exact categories depend on the offense and the law of the requested country. An overbroad request creates delay. A poorly explained request can produce a partial response or no usable evidence at all.

Why formal requests take time

Cross-border evidence is slow because several systems have to line up. The requesting authority must satisfy its own rules. A central authority or equivalent office may review the request. The foreign authority must determine whether the conduct is criminal under its law, whether the material is obtainable, and whether production would conflict with privacy or procedural protections.

Exchange compliance adds another layer. A TRM Labs case study involving the Houston Police Department shows the practical problem. Investigators seeking to recover cryptocurrency had to provide detailed transaction histories, evidence connecting suspect accounts to criminal activity, and precise legal language that met international compliance requirements. The warrant required multiple revisions before the exchange accepted it.

That case concerned a recovery of approximately $150,000 for a victim after accounts containing roughly $300,000 were frozen. It is not an MLAT case study, and it should not be presented as one. It is still a useful illustration of the documentation burden that can appear before an exchange acts on a lawful request.

Seizure and records are related, but different

An MLAT request for records does not automatically freeze funds. Investigators may need a separate preservation request, restraint order, seizure warrant, or forfeiture proceeding. The correct mechanism depends on the jurisdiction and the asset’s location.

Recent legal developments have expanded the tools available in some countries. A TRM Labs summary of UK proposals describes powers to recover assets directly from exchanges and custodian wallet providers, take control of unhosted assets during a search, convert seized assets into cash to limit exposure to price volatility, and return fraudulently obtained cryptocurrency to victims.

Those are legal powers, not universal international rules. Researchers should avoid treating them as a standard global procedure. The relevant distinction is simple: obtaining account evidence and taking control of an asset may require different applications, standards, and authorities.

Civil forfeiture can also change the posture of a case. In a DOJ action involving a Hamas-linked fundraising network and BuyCash, officials used a federal terrorism forfeiture statute to pursue assets without requiring a criminal conviction. The associated funds had been traced through wallets and were frozen by cooperating exchanges.

That example shows why an exchange may receive several types of demand: a preservation request, a criminal evidence request, a restraint request, or a forfeiture-related order. The label matters less than the authority cited and the records or assets covered.

What blockchain evidence can and cannot prove

The chain is durable, but interpretation remains difficult. A transaction proves that an address sent or received assets. It does not, by itself, prove who controlled that address or why the transfer occurred.

Attribution requires corroboration. Investigators may compare exchange records with seized devices, messages, IP information, account recovery events, bank records, or witness statements. Operation Disruptor is described as combining traditional investigative work, informants, digital forensics, and financial tracing, with attention to admissibility and chain of custody.

There are familiar failure points:

• An address may be controlled by a service rather than an individual.
• Several users may interact with a shared deposit system.
• Internal exchange transfers may not appear on the public chain.
• A transaction graph can show movement without showing intent.
• Online identifiers require corroborating evidence before they can be tied to a real person.
• Records collected from multiple jurisdictions may follow different authentication rules.

These limitations do not make blockchain analysis weak. They make it a lead-generation and corroboration tool, not a substitute for conventional evidence.

What the 2026 record should be measured against

Counting MLAT requests would be a poor measure of investigative impact. A better review asks whether the request produced usable evidence, preserved funds, supported charges, or returned assets to victims.

For each publicly documented matter, record:

• The requesting and requested jurisdictions.
• The legal instrument and the type of relief sought.
• The exchange or custodian involved, if publicly named.
• The blockchain assets and transaction identifiers in scope.
• Whether records were preserved, produced, or refused.
• Whether funds were frozen, seized, forfeited, or returned.
• How the digital evidence was corroborated.
• Any stated delay, jurisdictional conflict, or privacy objection.

This method avoids a common reporting error: treating a freeze as a recovery, or treating a blockchain attribution as a conviction. The available case material shows that outcomes vary with evidence quality, cooperation agreements, and the applicable statutory framework.

The private sector is now part of the evidence chain

Exchanges are not passive filing cabinets. Their compliance teams decide whether a request is sufficiently precise, legally valid, and operationally actionable. Investigators who understand the exchange’s account structure can avoid asking for records the platform cannot identify.

Public-private cooperation has also expanded beyond individual exchanges. In August 2024, TRON, Tether, and TRM announced the T3 Financial Crime Unit. TRM reported that the initiative, working with law enforcement, had facilitated the freezing of more than $130 million in illicit proceeds, including a $26.4 million seizure by Spain’s Guardia Civil.

Those figures describe the initiative’s reported activity, not MLAT production. They do show the direction of travel: blockchain intelligence, custodial platforms, and public authorities increasingly operate as one investigative network, even when the formal legal process remains national.

A skeptical reading of offshore exchange records

Exchange data can be decisive, but it is not automatically clean. Internal ledgers may use account identifiers that require explanation. Time zones can create apparent discrepancies. Deposits may be pooled. Records may be exported in formats that omit context. Account ownership may have changed over time.

Researchers reviewing a case should ask for the original production language, the covered period, the account identifier, and the method used to authenticate the records. They should separate direct observations from analytical labels such as “linked,” “associated,” or “high risk.”

The strongest cases tend to combine three layers: the public ledger, custodian records, and independent evidence connecting the account to a person or operation. Remove one layer and the attribution becomes easier to challenge.

This is research only. Do not attempt to contact, access, or transact with illicit services. Public reporting should avoid publishing live market locations, account details, or operational instructions that could expose victims or interfere with an investigation.

The practical verdict for 2026 is restrained. Offshore exchange records remain valuable because custodians can bridge the gap between pseudonymous transactions and identifiable accounts. MLATs remain necessary where the evidence sits abroad. Neither tool is fast, automatic, or self-authenticating. The cases that hold up are the ones where legal precision, blockchain tracing, exchange cooperation, and ordinary corroboration all point in the same direction.