Most crypto compliance teams are not short of risk signals. What they lack is a way to turn those signals into decisions they can stand behind, made quickly and the same way every time. That is the problem we built TrustOnChain to solve.
A month that made the point
September 2026 was the costliest month for crypto theft so far this year. The biggest of those incidents, at Bitget, is worth a closer look, mainly because of how the exchange says it happened. According to Bitget's own statements, private keys were not compromised. Instead, spoofed transaction data reached the exchange's authorisation process, which approved transfers that looked routine.
Bitget has said it will cover the losses from its user protection fund and publish a full root-cause report. We won't guess at the details before then. Incidents like this can hit any platform, and Bitget's quick, public disclosure is to its credit.
For the rest of us, the takeaway is less about wallet security and more about decisions. By Bitget's account, the transfers were approved because the data in front of the approval step looked legitimate. Then, according to Chainalysis, the funds were spread across four blockchains within three hours. Every exchange, wallet and payment platform that received any of it had minutes to decide whether to accept assets that had already changed chain.
More signals have not meant better decisions
A typical exchange or payment platform now runs several screening providers alongside sanctions and fraud tools. Anyone who has worked an alert queue knows what happens next: the analyst opens four tabs and tries to reconcile them by hand.
The providers often disagree. One rates a wallet high risk, another medium, and a third has no hit at all. Each uses its own attribution data, categories and scoring, so all three can be reasonable and still point in different directions.
The evidence is split, too. Device, login and account history sit in one system and wallet exposure in another, while the people moving illicit funds switch freely between bank accounts, cards and wallets.
And the outcome is hard to reproduce. Two analysts can look at the same case and land in different places. Ask a team six months later which rule, data and policy version produced a particular approval, and most will struggle to answer.
Meanwhile the threat keeps evolving. Chainalysis reports that impersonation scams grew 1,400% year on year, and that scams using AI were far more profitable than those that didn't. Fraud operations are getting faster and cheaper to run, and a review process built on manual reconciliation has no way to keep pace.
Regulators want to see the evidence
Regulators are raising the bar on evidence as well. Expect fewer questions about whether a policy exists, and more about how it was applied to a specific transaction.
The FATF's July 2026 targeted update found that most surveyed jurisdictions now have Travel Rule laws, but enforcement is lagging. By one analysis, 55 of the 91 jurisdictions where the rule is in force have not yet issued a single finding or enforcement action. That will change, and when supervisors start testing, individual decisions are the obvious place to look.
In Singapore, MAS said in August that its proposed Guidelines on AI Risk Management will apply to all AI use at financial institutions, including AI agents, and will be finalised soon. The consultation draft holds boards and senior management accountable for AI risk, and expects stronger controls where AI affects compliance outcomes.
In practical terms, a compliance team should be able to show, for any decision, which approved policy was applied, what evidence it relied on and who signed off. Ideally, it should be able to replay that decision exactly as it happened.
What a decision layer looks like
Adding yet another data feed won't fix this. What's needed is a layer above the existing signals that turns them into consistent, explainable decisions. That is what TrustOnChain does, and it comes down to six things.
1. One view of every signal
TrustOnChain connects to the screening providers, lists and internal data you already use. Multi-Vendor Normalization maps each provider's labels and scores onto one common risk scale. Semantic Mapping Studio lets your team define and test those mappings, with every version tracked.
When providers disagree, the AI Conflict Arbiter shows where they differ and why, then resolves the conflict using provider weights your team sets. Your existing provider contracts stay as they are.
2. Web2 and Web3 evidence, connected
Web2 Signal Screening and Device Intelligence bring account, login and device context alongside Web3 Signal Screening. The Unified Risk Graph links accounts, devices, wallets and transactions in one picture, and marks which links are observed and which are inferred.
This is what lets a team spot, for example, several unremarkable accounts that share one device and are sending funds to the same place, before the money leaves.
3. Policy you can govern
With Policy & Workflow Controls, rules run first and AI runs second. Teams set risk appetite, write rules (including in plain language), and test changes against past cases before release. Maker-checker approval, versioning and rollback are built in.
Each decision is linked to the policy version that produced it, so a rule change becomes a controlled release that can be reviewed and rolled back.
4. Decisions at transaction speed, with a clear next step
TrustOnChain returns approve, hold, review or reject in real time, across on-chain monitoring, payment and fiat screening, sanctions and the Travel Rule. A hold comes with the step that clears it, such as a source-of-funds request, and a fallback if the customer doesn't respond.
5. AI that prepares the case, people who make the call
When a case needs review, AI agents do the groundwork in Case Management: gathering evidence, tracing the fund path, linking wallets to customers, drafting the STR/SAR narrative and proposing a disposition. The analyst reviews, agrees or overrides, and escalates where needed. Tocky, our built-in assistant, lets analysts ask questions about a case in plain language.
6. Evidence ready for the regulator
The Audit & Evidence Pack records the full chain behind every decision: the raw provider data, how it was normalised, which policy version evaluated it, what the AI suggested and what the human decided. Any decision can be replayed and exported in one step.
In practice
Here is an illustrative example. A customer requests a large USDT withdrawal to an external wallet, from a new device behind a VPN. One provider flags mixer exposure, another rates the wallet medium risk. On its own, each signal is ambiguous.
TrustOnChain reconciles the provider views into one rating. The graph shows the destination is two hops from a mixer cluster, and that the device is shared with two other accounts sending funds the same way. Policy returns a hold and requests source of funds. If the customer doesn't respond, the case opens with the evidence pack, fund path and draft report already prepared.
Five questions to ask about your own stack
Whichever tools you use, these are worth putting to your team:
- When two providers disagree, who decides, and is the reasoning recorded?
- Can you see a customer's device and account history next to their wallet exposure in one place?
- Can you test a rule change against past cases before it goes live, with sign-off from a second person?
- Does every decision trace back to a specific, approved policy version?
- If a regulator picked one decision from last quarter, could you show them the full evidence within an hour?
If several of these get a hesitant answer, more data is unlikely to help. The weak point is how decisions get made.
From signals to decisions
Over the past decade the industry has become much better at detecting risk. Acting on it consistently, and being able to prove it, is where most teams still struggle.
TrustOnChain is the AI decision layer for exchanges, wallets and payment platforms working across Web2 and Web3. It works with the data and providers you already have, so there is nothing to replace on day one.
We are offering a free proof of concept on one of your own review workflows, using your own data. Book a 30-minute walkthrough to see screening, investigation and audit in one platform.
Sources
Incident details reflect public statements and reporting as of 6 October 2026 and may change when Bitget publishes its root-cause report. The worked example above is illustrative, not a customer case.
- Blockhead: Bitget loses $351.6 million in hot wallet breach, rules out private key compromise (25 September 2026)
- CryptoRank: Chainalysis attributes $387M Bitget hack to North Korea (October 2026)
- CoinDesk: Chainalysis report on impersonation and AI crypto scams (14 January 2026)
- Regulation Tomorrow: FATF publishes targeted update on virtual assets and VASPs (21 July 2026)
- Notabene: Takeaways from the FATF's seventh targeted update on virtual assets (17 July 2026)
- MAS: Guidelines for Artificial Intelligence Risk Management (13 November 2025)
- DeepInspect: MAS parliamentary reply on agentic AI in financial services (5 August 2026 reply)
