Global Investigator: Crypto Fund Tracing & Recovery

Build a Safer World.

TRM Labs provides AI-powered intelligence solutions that help public and private sector agencies investigate and disrupt crime. TRM's platforms enable investigators to trace illicit activity, build cases, and construct operating pictures of threat networks. Leading agencies and businesses worldwide rely on TRM to make the world safer and more secure.

The Scam Investigations team is TRM’s tip of the spear against pig butchering syndicates, romance fraud networks, and investment scam operations that steal billions from victims each year. The team operates an integrated workflow — from AI-supported complaint triage to time-sensitive investigation, escalation, and recovery support for victims.

As a Global Investigator, you will work at the recovery-focused layer of scam investigation. You will validate high-priority blockchain leads, conduct forward and backward tracing, assess whether funds touch regulated platforms or other actionable endpoints, and produce clear investigative documentation that supports time-sensitive escalation and victim-centered recovery outcomes.

The impact you will have here:

• Validate time-sensitive blockchain signals and move high-confidence matters through the appropriate escalation workflow. Speed and accuracy both matter.

• Trace victim funds end-to-end — forward to the wallets that consolidate them, backward to the platforms they came from. Your work feeds directly into the legal packages that recover them.

• Own the recovery side. After a freeze, run the backtrace that ties frozen funds to specific victims and produce the documentation that drives restitution. The freeze is the start. Victim recovery is the goal.

• Support time-sensitive asset-preservation workflows with regulated platforms and ecosystem partners.

What we’re looking for:

• 3–5 years of cryptocurrency investigations or asset-recovery experience — law enforcement crypto units, blockchain analytics firms, exchange compliance investigations, or equivalent. You understand how regulated platforms behave under request, including the difference between voluntary cooperation and formal process, and you treat getting money back to victims as part of your job rather than a downstream handoff.

• You don’t need a checklist to start. Handed something you’ve never seen, you figure out the first move and take it. When the playbook stops, you keep going.

• You think in outcomes, not lanes. If “that’s not what I was hired for” is a sentence you reach for, this isn’t the seat.

• Experience producing investigative packages that can support formal legal, compliance, or enforcement workflows.

• Creative tactical thinking — demonstrated ability to pivot from a single point to a network view, identifying operators behind operations.

• Blockchain / cryptocurrency tracing (required, gating) — forward-then-backward trace, exchange attribution, co-mingling handling, multi-hop VASP tracing, and LIFO/FIFO backtrace for recovery work. Non-negotiable.

• AI fluency (required) — you use AI tools in your workflow to synthesize returns, draft outputs, and accelerate analysis, with examples of how AI has impacted your work.

• Location / citizenship / clearance — placeholder, varies by region (NA seats: US Citizenship required, ability to obtain Public Trust clearance, US-based). EMEA / APAC seat requirements TBD by region.

About the team:

• Follow-the-sun rotation — the team runs investigators across NA, EMEA, and APAC for around-the-clock coverage.

• Distributed, async-first via Slack and Notion, with structured syncs for alignment.

• High autonomy, high standards, low bureaucracy — work directly with engineering, analysts, legal counterparts, and partners who depend on the team’s output.

• .

Team operating rhythms:

• Daily monitoring shift

• Daily shift handoff call

• Weekly team syncs

• All output documented in Notion and TRM’s investigative tools

• Surge availability expected during time-sensitive disruption windowsLearn about TRM Speed in this position:

• React timely to the movement of funds during an ongoing investigation.

• Support other teams on time sensitive issues that might be unforeseen.

• Continuously learn new issues in crypto.

We are building a safer world.…