Public sanitized verification record. A research artifact from the SatoshiShield project, published to show the verification methodology applied to each candidate domain. Internal lab infrastructure has been redacted. Not legal or financial advice.

Coinfirm — Verification Record (Retrospective)

Purpose of this record

This is a retrospective verification record created on 2026-05-29 to document Coinfirm as an independent surveillance vendor for historical and audit purposes, even though the actual evidence collection and blocklist inclusion happened under the Lukka verification (the related verification record).

Coinfirm was acquired by Lukka in 2023, with the acquisition publicly announced May 21, 2024. By the time SatoshiShield's structured verification cycle reached Coinfirm in May 2026, it was no longer an independent vendor — but it had a well-documented independent surveillance history (2016–2023) worth preserving as a research artifact. This record exists so that future researchers, white paper authors, and contributors investigating industry consolidation patterns have a structured Coinfirm record to reference rather than only the Lukka-flavored consolidation entry.

Provenance

• Underlying evidence collection: performed during the Lukka verification on 2026-05-26
• Domain block coverage: shipped under the Lukka inclusion in SatoshiShield v1.5.0
• domains.csv attribution: rows for coinfirm.com are filed under organization Lukka Inc. (formerly Coinfirm sp. z o.o.)
• No fresh fieldwork was performed for this record. Where this document refers to evidence, the underlying source is either Coinfirm's own historical materials, third-party reporting predating the acquisition, or the Lukka verification record.

Company background

Coinfirm was one of the early entrants in the blockchain surveillance market, predating most current competitors except Chainalysis and Elliptic. Its founding team came out of Royal Bank of Scotland's anti-money-laundering function, and the firm built its initial product around European compliance frameworks (5AMLD, later MiCA-aligned) before expanding to global coverage.

The firm operated for approximately seven years as an independent entity before the Lukka acquisition. During that period it raised approximately $10–15 million across multiple rounds, established public partnerships with major European banks (notably Banco Santander for blockchain-based remittance compliance), and built a customer base concentrated in regulated financial institutions and major cryptocurrency exchanges.

Product line (pre-acquisition)

• AML Platform — Primary product. Address screening, transaction monitoring, risk scoring, ownership clustering. Used by exchanges, banks, and payment processors for compliance and law-enforcement support.
• Trudatum — Data integrity and document-verification product. Later spun out as a separate company; not part of the current Lukka portfolio.
• C-Risk — Risk-scoring product layered on top of the AML Platform; surfaced numerical risk scores for addresses and transactions.
• Reclaim Crypto — Asset-recovery service for victims of cryptocurrency theft. Combined surveillance capability (tracing stolen funds across the blockchain) with legal-coordination services.
• AMLT (utility token) — Launched 2017 on the Ethereum blockchain. Used for community-contributed risk intelligence in a participate-and-earn model. Token economy is now largely defunct post-acquisition; no significant trading volume.

Disclosed customers (pre-acquisition)

• Major European and global banks (specific names protected by Coinfirm's customer NDAs; Banco Santander was the most-publicized partnership)
• Major cryptocurrency exchanges
• Various government and regulatory agencies (FATF travel-rule integration; European national FIUs)
• The customer pattern matched Chainalysis and Elliptic's: B2B compliance and law-enforcement, not B2C

Step 1 — WHOIS / RDAP

Evidence detail: see the related verification record Step 1. The Lukka verification confirmed coinfirm.com is now operationally a Lukka-controlled domain per Lukka's own published Terms of Use.

Step 2 — SSL Certificate

Evidence detail: see the related verification record Step 2. Certificate authority and Subject Alternative Names checked as part of the Lukka subdomain enumeration. No surprises — the certificate now identifies Lukka as the controlling organization.

Step 3 — SecurityTrails / Passive DNS

Evidence detail: see the related verification record Step 3. Historical DNS records for coinfirm.com predating the acquisition show independent infrastructure; current records show consolidation with Lukka infrastructure.

Step 4 — Behavioral Evidence

Method: vendor-documentation route per Contributor Guide §4.4. Coinfirm's surveillance behavior is documented in:

• Coinfirm's own historical product documentation (archived on Wayback Machine for the pre-acquisition period)
• The Lukka acquisition press release (May 21, 2024), which describes the acquired product line in surveillance-specific terms
• Lukka's current product pages, which now describe the integrated Coinfirm-derived surveillance capability
• Banco Santander's announcements regarding the Coinfirm partnership (financial compliance context)

The historical surveillance pattern was the canonical one: API queries to Coinfirm endpoints logged the calling IP against the queried address, producing risk scores and entity attributions for compliance use.

Step 5 — Privacy Harm Assessment

Inclusion criteria met (5 of 6):

• [x] Blockchain Analytics — primary product was address screening and transaction monitoring
• [x] Address Screening API — AML Platform was an API-first product used by exchange compliance teams
• [x] IP-Logging Infrastructure — canonical IP-logging pattern documented across the surveillance industry; no reason to believe Coinfirm's API differed
• [x] KYC/AML Intelligence — explicit AML positioning was the firm's primary market identity
• [x] Deanonymization-adjacent — entity attribution and ownership clustering for compliance use
• [ ] Wallet Telemetry — Coinfirm was a B2B vendor; no consumer wallet integration documented

Specific harm: during its independent existence (2016–2023), Coinfirm's API endpoints logged the IP addresses of querying exchanges, banks, and compliance teams against the Bitcoin addresses being screened, producing a record of "which institution is interested in which address at which time." Post-acquisition, this surveillance pattern continues under the Lukka brand at the same coinfirm.com domain.

Step 6 — Inclusion Criteria Conclusion

Domain meets inclusion criteria. The original standalone candidate case was sound on the merits; the acquisition simply moved the corporate parent.

Step 7 — Functional Impact Test

Performed as part of the Lukka verification on 2026-05-26.

• [x] Both lukka.tech and coinfirm.com wildcards added to test Pi-hole instances (the test resolver and the test resolver)
• [x] Sparrow Wallet → Bitcoin Knots RPC: PASS
• [x] Electrum → public Electrum server (throwaway, clearnet): PASS
• [x] BlueWallet (mobile): PASS
• [x] mempool.space and blockstream.info: PASS
• [x] Preserved-paths negative test (coinbase.com, netcoins.ca, graphsense.org): PASS

No Bitcoin wallet impact observed from blocking coinfirm.com. The firm's B2B surveillance API is not embedded in any consumer Bitcoin wallet.

domains.csv entries (as shipped in v1.5.0)

The coinfirm.com rows in the project's domains.csv were shipped under the Lukka inclusion:

*.coinfirm.com,Lukka Inc. (formerly Coinfirm sp. z o.o.),Blockchain Analytics,1,Coinfirm was an independent European blockchain analytics firm founded 2016 focused on AML / compliance / sanction screening / entity due diligence / on-chain investigations. Acquired by Lukka in 2023 (announced May 21 2024). Coinfirm product team remained in place post-acquisition; products integrated into Lukka's portfolio. Per Lukka's own Terms of Use coinfirm.com is a Lukka-operated domain.,https://lukka.tech/lukka-acquires-coinfirm-bringing-audited-data-to-blockchain-analytics-compliance-and-investigations/,2026-05-26,Coinfirm was originally a separate Tier 1 candidate. The acquisition makes Coinfirm functionally a Lukka product line. Original standalone Coinfirm vault candidate file should be marked defunct/acquired.
coinfirm.com,Lukka Inc. (formerly Coinfirm sp. z o.o.),Blockchain Analytics,1,Root domain of the Coinfirm legacy product surface — now Lukka-operated.,https://lukka.tech/lukka-acquires-coinfirm-bringing-audited-data-to-blockchain-analytics-compliance-and-investigations/,2026-05-26,

regex.txt pattern shipped:

(\.|^)coinfirm\.com$

Sources

• Coinfirm acquisition press release (Lukka, May 21, 2024): https://lukka.tech/lukka-acquires-coinfirm-bringing-audited-data-to-blockchain-analytics-compliance-and-investigations/
• Coinfirm historical product documentation (Wayback Machine, pre-2023 captures)
• Banco Santander blockchain-remittance compliance announcements (2017–2019)
• Lukka verification record: the related verification record
• Companies file: the company profile

Notes and historical context

Coinfirm is one of the clearest single examples of the industry consolidation thesis documented in the IRS Procurement Stack case study and referenced in the SatoshiShield white paper. The pattern — established independent surveillance vendor acquired by a larger institutional-data firm during a market consolidation phase — mirrors the CipherTrace / Mastercard acquisition in 2021 and is likely to repeat with other Tier 2 vendors in the next several years.

The Lukka acquisition specifically illustrates the horizontal integration pattern: a firm whose core business is institutional crypto accounting and tax data (Lukka's pre-acquisition identity) absorbing a surveillance specialist (Coinfirm) to offer end-to-end "accounting + compliance + surveillance" packages to institutional customers. This is a different consolidation pattern than the vertical "blockchain analytics firm absorbed into payment network" pattern that CipherTrace illustrates.

For future white paper or case study work, Coinfirm is the strongest available example of a surveillance vendor whose customer base concentrated in European compliance use cases rather than US federal contracts. The Banco Santander partnership is a uniquely documented public example of a Tier 1 European bank explicitly relying on a blockchain surveillance vendor for compliance — most equivalent US relationships are protected by NDAs.