Cryptocurrency has emerged as a payment method used for illicit IPTV and streaming services. One estimate found that cryptocurrency accounts for 20% of all payment methods offered by digital pirates.
In response, Europol’s IPC3 Unit, in collaboration with the European Union Intellectual Property Office (EUIPO) and the Spanish National Police (Policía Nacional), organized a team of collaborators to run an operation it called “Intellectual Property Crime Cyber-Patrol Week,” which ran from November 10 through 14, 2025.
The operation brought together major industry players to identify and disrupt criminal networks using digital currencies to fund piracy and launder proceeds from illegal streaming.
A total of 30 investigators participated in this operation hosted at the EUIPO headquarters in Alicante, Spain, where they used advanced Open-Source Intelligence Techniques (OSINT) and cutting-edge online investigative tools to identify potential intellectual property infringements.
The Cyber-Patrol’s results included:
- 69 sites identified and targeted.
- 25 illicit IPTV services have been reported for disruption to Coinbase and Binance.
- 44 sites are still under various stages of investigation.
- Estimated annual traffic for the 69 sites is 11,821,006.
- Total value of cryptocurrency traced through associated accounts is $55,000,000.
- Several services identified for continued investigation by public and private entities.
Details of the collaboration
One of the participating companies, Irdeto, reported that the initiative was also supported by the Premier League – which, together, represented the Audiovisual Anti-Piracy Alliance (AAPA). Others included cryptocurrency exchanges Coinbase and Binance, blockchain analytics firm Chainalysis and an investigation platform by Maltego. Law enforcement officers from over 15 European countries took part in the coordinated “crypto sprint,” focused on tracing and dismantling financial channels that sustain digital piracy.
Operational methodology
The initiative leveraged Chainalysis’s advanced blockchain intelligence tools to map the flow of illicit funds and reveal the networks behind criminal operations. Using Chainalysis Reactor, Irdeto investigators traced complex money-laundering patterns, uncovering links between pirate operators, payment intermediaries, and consumers of illegal content.
Maltego Graph (Desktop) was used to enable investigators to visualize the data to spotlight and identify data connections and patterns in an intuitive and holistic way.
“The intelligence shows that cryptocurrency has fast become a new payment method used by digital pirates,” said Mark Mulready, Vice President of Cyber Services at Irdeto. “This operation marks a turning point in how we combat piracy by cutting off the payment mechanisms that fuel illicit services and striking at the very heart of their business model”.
Both Coinbase and Binance acted on the intelligence from the operation. Their proactive efforts prevented further abuse of their services by users linked to piracy networks, thereby reinforcing the integrity of their platforms.
“This joint effort underscores the importance and power of public and private collaboration in tackling digital crime, which has been integral to our work at Binance,” said EMEA Head of Investigations Lilija Mazeikiene. “It also highlights how crime cannot easily hide on the blockchain, where the pseudo-anonymous nature of crypto makes illicit transactions easier to uncover than cash and other forms of payment. Digital pirates will soon realize that crypto will make it harder for them to hide.”
Illegal financial flows evolve
Criminals moving away from traditional payment systems and are turning to cryptocurrency for payments – a method they believe to offer increased anonymity – when offering their illegal services.
But by using fire to fight fire, investigators used cryptocurrencies to purchase illegal services; thereby enabling them to identify illicit actors. In turn, these were then reported to partners, which includes major crypto exchanges and specialised tooling companies.
Best practices
This multidisciplinary and multi-agency enforcement operation aimed to map active targets, develop actionable intelligence packages, and facilitate the exchange of best practices.
This initiative not only promotes innovative technological solutions but also reinforces cooperation with the private sector, consequently enhancing enforcers’ ability to detect and neutralise emerging threats.
Why it matters
By identifying, tracing, and successfully shutting down the crypto accounts of illicit services, the criminal revenue stream is disrupted. This effort is vital for protecting global economies and creators. This approach hits pirates where it hurts them the most: their money.
Events such as this Cyber-Patrol Week provide a unique platform for EU authorities responsible for combating intellectual property crime to collaborate and strengthen operational cooperation in pursuit of a safer Europe.
This approach exemplifies the European Union’s commitment to an integrated, cross-border strategy where international collaboration and technological innovation are key pillars. By working together, intellectual property crime in a global digital landscape can be better anticipated and addressed.
Further reading
EUR 47 million in crypto traced to disrupt digital piracy services. Press release. November 19, 2025. Europol
Irdeto and industries support law enforcement to disrupt pirate networks. Press release. November 19, 2025. Irdeto.
