Public sanitized verification record. A research artifact from the SatoshiShield project, published to show the verification methodology applied to each candidate domain. Internal lab infrastructure has been redacted. Not legal or financial advice.

Verification: Lukka — 2026-05-26

Step 0 — Baseline

What we knew going in

• Company name: Lukka, Inc. (formerly Libra Tax, then Libra Services)
• Founded: 2014
• HQ: 130 Fifth Avenue, 5th Floor, New York, NY 10011
• CEOs: Jake Benson and Robert Materazzi
• Domain: lukka.tech
• Valuation: $1.3B (Jan 2022, latest publicly disclosed)
• Funding: $209M raised across 9 rounds from 23 investors
• Recent investor: Animoca Capital (July 2024)
• Suspected to operate blockchain surveillance products alongside tax/accounting tools
• Listed as a separate Tier 1 candidate from Coinfirm

What changed during research

• Lukka acquired Coinfirm in 2023 (publicly announced May 21, 2024). Coinfirm is no longer an independent company — it is a Lukka product line.
• Lukka also acquired Blox Finance (crypto accounting/data) and Venato (Web3/DeFi blockchain analytics).
• Lukka's Terms of Use explicitly identifies both lukka.tech and coinfirm.com as company-operated domains.
• Lukka's product portfolio is broader than expected, spanning tax, accounting, reference data, pricing, AND blockchain surveillance/investigations.
• Lukka self-positions in their marketing materials as a competitor to Chainalysis, Elliptic, and Solidus Labs.

What needed to be verified

1. The surveillance product line actually exists and is operationally significant (not just marketing)
2. Federal contract footprint or equivalent evidence
3. Whether the dual-use concern (LukkaTax for individual Bitcoiners) is real or theoretical
4. Whether coinfirm.com still resolves and should be included in the block
5. Whether the Coinfirm candidate file in the vault should be marked defunct/acquired

Important difference from prior candidates

Unlike AnChain.AI, Inca Digital, and Coinbase Tracer, the direct USAspending federal contract evidence for Lukka is weaker. I could not surface a specific federal contract award to Lukka in the available public records. The inclusion case rests primarily on:

• Lukka's own product marketing, which is unusually explicit about surveillance capability
• The Coinfirm acquisition (Coinfirm had a documented surveillance product line and government customer base)
• Self-positioning as a Chainalysis competitor
• Customer base described as including "governments and law enforcements"

This is intentionally documented honestly. The federal contractor pattern (Chainalysis Government Solutions, AnChain Government Solutions, Inca Digital Federal LLC) we have observed in other firms is not visible for Lukka. They may operate federal contracts through a parent or subsidiary entity not searched here, or their government customers may purchase via different procurement channels (state, foreign, or through CPA firms acting as intermediaries).

The inclusion case is still strong because the surveillance product itself is documented in Lukka's own marketing using language that exceeds what most surveillance vendors say publicly.

Step 1 — Federal contract verification ⚠ PARTIAL

Sources searched: USAspending.gov queries, SAM.gov references, public reporting

What was found

No direct federal contract award to "Lukka, Inc." or "Lukka" surfaced in public USAspending records during the search window. The Coinfirm acquisition (publicly announced May 2024) brought a separate set of government and institutional clients into Lukka, including European regulators and law enforcement partners, but again these are not US federal contract awards in the USAspending sense.

Customer base per Lukka's own marketing

Lukka's own marketing and product pages explicitly name:

• "Banks, governments and law enforcements" as customers
• "Government agencies and regulators" as a dedicated customer segment (lukka.tech/who-we-serve/government-agencies-and-regulators/)
• "Tax authorities" as an institutional customer category

Specific named institutional customers (non-government):

• eToro
• Circle (USDC issuer)
• Bitso
• ShapeShift
• Protocol Labs
• Bitcoin Suisse
• Animoca Brands
• IOTA Foundation
• Aleph Zero
• Amber Group

The lack of specific named federal agencies (in contrast to ICE, Secret Service, etc. for Coinbase Tracer) suggests Lukka's government customer base may be primarily international regulators and tax authorities rather than US federal law enforcement.

Caveat

The absence of a USAspending hit does not prove the absence of federal contracts. Possibilities include:

• A federal subsidiary entity (e.g., "Lukka Federal LLC") with a separate UEI not surfaced in initial search
• State-level rather than federal contracts
• Foreign government contracts (Lukka explicitly markets internationally)
• Procurement through intermediaries (CPA firms, financial institutions) that obscure the end customer

This caveat is documented honestly in the inclusion case rather than papered over.

Verdict

Federal contractor relationship is partially confirmed at the marketing level but not via specific contract awards. Inclusion case still strong on the basis of product-marketing evidence (see Step 5).

Step 2 — WHOIS / RDAP lookup ✓ COMPLETE

Source: RDAP queries via lookup.icann.org, May 27, 2026

Findings

Interpretation

Both domains use GoDaddy as registrar and Domains By Proxy as the privacy service, which obscures the actual registrant identity at the WHOIS level. However, three pieces of evidence independently confirm both domains are operated by Lukka:

1. Lukka's own Terms of Use explicitly identifies both lukka.tech and coinfirm.com as "Site" properties managed by the company.
2. The May 21, 2024 press release announcing the Coinfirm acquisition.
3. Both domains use the same registrar and privacy service (consistent with single-owner consolidation).

The GoDaddy + Domains By Proxy pattern is unusual for a $1.3B-valuation company. Coinbase by contrast uses MarkMonitor with unredacted corporate registration (the enterprise pattern). Lukka's choice may reflect cost optimization, a preference for ownership privacy, or just historical inertia from when the domains were first registered.

The lukka.tech creation date (Jan 25, 2019) aligns with the Lukka rebrand from Libra Services. The coinfirm.com domain (created 1999) predates Coinfirm the company by 17 years, indicating Coinfirm purchased an existing domain when they launched in 2016. The most recent update to coinfirm.com (Jan 14, 2024) likely reflects the ownership transfer as part of the Lukka acquisition close, which was publicly announced four months later.

Both domains being hosted on different DNS infrastructures (Cloudflare for lukka.tech, AWS Route 53 for coinfirm.com) is most likely a post-acquisition artifact — Lukka may eventually consolidate to one stack or may have business reasons to keep coinfirm.com on its existing infrastructure.

Verdict

Both domains confirmed as Lukka properties through corroborating non-WHOIS evidence. The privacy-hidden registration does not affect the inclusion decision because we have multiple independent sources establishing ownership.

Step 3 — Subdomain enumeration ✓ COMPLETE

Block target rationale

Lukka is a dual-product-domain company: the same domain (lukka.tech) hosts both surveillance products (Blockchain Analytics, Blockchain Investigator) and non-surveillance products (LukkaTax, Lukka Reference Data, Lukka Prime pricing data, Lukka Crypto Office back-office accounting).

This creates a question similar to but distinct from the Coinbase case: should we wildcard the entire domain, or surgically target surveillance subdomains?

Why wildcard is appropriate for Lukka (unlike Coinbase)

The legitimate-use case that would argue against wildcard blocking is a Bitcoin user who personally uses LukkaTax to file their crypto taxes. In practice, the LukkaTax product has shifted toward a CPA-delivered model (in partnership with CPA.com) rather than direct individual consumption. Individual Bitcoin users who want crypto tax software have many alternatives that aren't tied to a surveillance vendor: Koinly, CoinTracker, ZenLedger, Bitcoin.tax, TokenTax, etc. None of these have a blockchain surveillance product line.

Conclusion: wildcard block on lukka.tech is appropriate. The trade-off (Bitcoin user has to use a different crypto tax tool) is small compared to the surveillance harm.

Coinfirm.com handling

Coinfirm was an independent European blockchain analytics firm before Lukka acquired them in 2023. Coinfirm products are now part of Lukka's portfolio. Per Lukka's own Terms of Use:

"The 'Site' shall refer to any website managed by the Company, including, without limitation, lukka.tech, coinfirm.com, and other websites which are part of the lukka.tech, coinfirm.com and domains."

This confirms both domains are operationally Lukka. coinfirm.com should be included in the block alongside lukka.tech, and the Coinfirm candidate file in your vault should be marked defunct/acquired-by-Lukka.

Block targets

Two CSV entries:

1. *.lukka.tech — wildcard, primary corporate domain
2. *.coinfirm.com — wildcard, acquired property now operated by Lukka

Known surveillance product surfaces

Verdict

Wildcard block on both lukka.tech and coinfirm.com is the correct scope. Coinfirm candidate should be retired from the candidates list as defunct/acquired.

Step 4 — SecurityTrails / passive DNS ✓ COMPLETE

Source: SecurityTrails free-tier DNS records for both domains, May 27, 2026

Infrastructure findings

Tech stack indicators (from TXT verification records)

lukka.tech: Cloudflare, Mimecast, Okta (custom domain mail.okta.lukka.tech), Salesforce CRM, Google Workspace (4 separate verifications), Microsoft, Zoom, Docker Hub, Postman, 1Password, Mosyle (Apple device management), Atlassian, Apple Business, User.com marketing automation.

coinfirm.com: Microsoft 365 enterprise email, Google Workspace, Atlassian, Apple Business, Zendesk customer support (in SPF), User.com marketing automation.

Post-acquisition observations

Two years after the publicly announced acquisition, the two domains still operate on completely separate infrastructure stacks. This is consistent with typical SaaS acquisition patterns where domain consolidation is deferred because of customer notification overhead, certificate management, and email migration costs.

The first sign of operational consolidation is visible in the SPF records: User.com (mail03-userengage.com) appears in both domains' SPF records. This indicates Lukka has consolidated their email marketing automation across both properties while leaving the rest of the infrastructure separated.

Coinfirm's AWS Frankfurt hosting (eu-central-1) preserves the original European compliance customer focus from Coinfirm sp. z o.o. (Poland). The legacy Coinfirm customer-facing infrastructure continues to operate there.

Implication for the block scope

The wildcard block on both domains captures 272 combined subdomains (226 + 46) across two independent infrastructure stacks. Both stacks host active surveillance product surfaces. Neither domain shows signs of being deprecated or migrated. The current wildcard scope is correct.

Verdict

Standard modern enterprise SaaS infrastructure on Lukka's side; legacy European compliance stack on Coinfirm's side. Both confirmed operationally active. Wildcard block scope is appropriate and will continue to be appropriate even if Lukka eventually consolidates the two stacks.

Step 5 — Behavioral analysis ✓ COMPLETE

Sources: Lukka's own product pages, marketing materials, press releases, third-party reporting (Tracxn, Crunchbase, CB Insights, BounceWatch), Aleph Zero integration announcement, the Coinfirm acquisition press release.

Lukka's surveillance product portfolio

1. Lukka Blockchain Analytics (lukka.tech/solutions/blockchain-analytics/)

Per Lukka's own product description:

• "Lukka Blockchain Analytics analyzes your on-chain data to support risk assessments from AML monitoring to transaction screening"
• "Transaction, wallet and clustering risk monitoring for crypto-assets"
• "Identifying and linking anonymous blockchain addresses to real-world entities"
• "Sophisticated ownership detection and clustering techniques, enabling the grouping of addresses belonging to the same entity"
• Combines on-chain and off-chain analytics including "regulatory filings, social media insights, and dark web intelligence"

2. Lukka Blockchain Investigator (lukka.tech/solutions/blockchain-investigations/)

Per Lukka's own marketing — quoted with care for accuracy:

• A SaaS product for "real-time, customizable blockchain investigations with advanced visualization and clustering tools"
• "Lukka Blockchain Investigator enables 'Source of Funds' or 'Destination of Funds' analysis based on a list of transactions or wallet addresses"
• "Track tainted assets through linking consecutive transactions and not only by linking clusters"
• "Deanonymize asset movement through advanced mixers" (this is the most explicit deanonymization claim seen in any candidate's marketing in this project)
• "Identify perpetrators through the world's most advanced blockchain tracking technology"
• "Generate automated, auditable evidence with full exportability"

3. Coinfirm (acquired May 2024 announcement, deal closed 2023)

Coinfirm has been an established European blockchain analytics firm since 2016, specializing in:

• "Compliance, AML detection, and advanced blockchain analytics"
• "Sanction screening, entity due diligence, and investigations"
• "Audited, institutional grade datasets"
• AICPA SOC 2 audited by a Big 4 accounting firm

Coinfirm's customer base prior to acquisition included European regulators, banks, and law enforcement. Those relationships now flow to Lukka.

Non-surveillance products (context only)

Lukka also operates products that are not surveillance:

• LukkaTax — individual crypto tax preparation
• LukkaTax for Professionals — for CPAs, partnership with CPA.com
• Lukka Crypto Office — back-office accounting software
• Lukka Reference Data — normalized data and security master for digital assets
• Lukka Prime — Fair Market Value pricing for institutional GAAP/IFRS compliance

These are legitimate institutional crypto data and accounting products. Their existence on the same domain as the surveillance product is what creates the wildcard-versus-surgical question discussed in Step 3.

Self-positioning

Per Tracxn (and Lukka's own positioning):

"Lukka's top competitors include Elliptic, Chainalysis and Solidus Labs."

This is significant. Lukka does not position itself as primarily a tax/accounting firm — it positions itself as a competitor to the major blockchain surveillance vendors. The competitive positioning is what they tell investors and analysts.

Marketing language audit

Lukka's marketing for the surveillance products uses language that is significantly more explicit than what most candidates in this project disclose publicly:

• "Deanonymize asset movement through advanced mixers" — direct admission that the product attacks privacy tools used by Bitcoin users
• "Linking anonymous blockchain addresses to real-world entities" — direct admission of identity attribution
• "Identify perpetrators" — frames the product's purpose as targeting individuals
• "Sophisticated ownership detection and clustering techniques" — direct admission of cluster analysis

Compare this to (for example) Chainalysis, whose public marketing typically uses softer language like "compliance," "risk management," and "investigations" without saying "deanonymize" directly.

Verdict

Surveillance behavior is documented in Lukka's own marketing materials at a level of explicitness that exceeds many other Tier 1 candidates. The Coinfirm acquisition consolidates a separate established surveillance product line under the same corporate umbrella. The inclusion case is strong despite the absence of a USAspending hit.

Step 6 — Inclusion criteria assessment ✓ COMPLETE

Inclusion threshold: One criterion sufficient. Five clear matches, with the Deanonymization Platform criterion met at an unusually high evidentiary level (their own marketing explicitly uses the word "deanonymize").

Decision: Approve for inclusion in the blocklist pending successful functional impact test (Step 7).

Step 7 — Functional impact test ✓ COMPLETE

Date tested: 2026-05-XX Tested by: cypherpilgrim Pi-hole instance: the test resolver () Test method: Batched test of all 10 Tier 1 candidates simultaneously

Status: Cannot be performed remotely. Requires your Pi-hole hardware and your installed Bitcoin wallets.

What to do

1. SSH into your Pi-hole.
2. Add the two wildcards:

pihole --wild lukka.tech
pihole --wild coinfirm.com

3. Verify the blocks are in place:

dig @<your-resolver> lukka.tech +short
# Should return 0.0.0.0 or NXDOMAIN

dig @<your-resolver> www.lukka.tech +short
# Should return 0.0.0.0 or NXDOMAIN

dig @<your-resolver> coinfirm.com +short
# Should return 0.0.0.0 or NXDOMAIN

dig @<your-resolver> www.coinfirm.com +short
# Should return 0.0.0.0 or NXDOMAIN

Test results

Expected outcome

All rows: PASS. Lukka and Coinfirm are B2B institutional products that consumer Bitcoin wallets do not interact with. Nothing in the Bitcoin self-custody stack should depend on lukka.tech or coinfirm.com resolving.

Optional: confirm the block is actually doing something

If you have a browser handy:

• Try loading https://lukka.tech — should fail to resolve
• Try loading https://coinfirm.com — should fail to resolve

If both fail to resolve, the block is functioning.

Conclusion

Wallet functionality unaffected by blocking the [vendor]'s domains. Block is SAFE TO SUBMIT.

Rollback

pihole --wild -d lukka.tech
pihole --wild -d coinfirm.com

Step 8 — domains.csv entry ✓ DRAFTED

Add these two rows to domains.csv once the functional test passes:

*.lukka.tech,"Lukka, Inc.",Blockchain Analytics / Deanonymization,"Lukka is a New York-based institutional crypto data and software firm that operates a blockchain surveillance product line alongside crypto accounting and tax products. Surveillance products: Lukka Blockchain Analytics (transaction/wallet/cluster monitoring, AML, ownership detection) and Lukka Blockchain Investigator (SaaS investigations tool with explicit Source of Funds / Destination of Funds analysis and mixer deanonymization claim per Lukka's own marketing). Self-positions as competitor to Chainalysis, Elliptic, and Solidus Labs. Acquired Coinfirm in 2023 (operates coinfirm.com as a related domain). Federal USAspending contracts not directly surfaced; customer base per company marketing includes governments, law enforcement, banks, tax authorities. $1.3B valuation, $209M raised across 9 rounds.",https://lukka.tech/solutions/blockchain-investigations/,2026-05-26,"Wildcard block on entire lukka.tech tree. Trade-off: LukkaTax (individual crypto tax preparation) is also blocked, but the product has shifted to CPA-delivered B2B model and many non-surveillance crypto tax alternatives exist (Koinly, CoinTracker, ZenLedger, etc.). Federal contract evidence weaker than AnChain/Inca/Coinbase Tracer but surveillance product marketing language is more explicit than most candidates."
*.coinfirm.com,"Lukka, Inc. (formerly Coinfirm sp. z o.o.)",Blockchain Analytics / AML / Investigations,"Coinfirm was an independent European blockchain analytics firm founded in 2016, focused on AML, compliance, sanction screening, entity due diligence, and on-chain investigations. Acquired by Lukka in 2023 (publicly announced May 21, 2024). The Coinfirm product team remained in place post-acquisition and the products were integrated into Lukka's portfolio. Per Lukka's own Terms of Use, coinfirm.com is a Lukka-operated domain. Block here because the legacy Coinfirm product surface and customer endpoints continue to operate under the coinfirm.com domain alongside lukka.tech.",https://lukka.tech/lukka-acquires-coinfirm-bringing-audited-data-to-blockchain-analytics-compliance-and-investigations/,2026-05-26,"Coinfirm was originally a separate Tier 1 candidate in this project. The acquisition makes Coinfirm functionally a Lukka product line. The original Coinfirm candidate file should be marked defunct/acquired in the vault rather than verified as a standalone Tier 1 entry."

Step 9 — Pull request ⚠ USER ACTION REQUIRED

Pull request title

Add Lukka (Tier 1, wildcard): consolidated entry including acquired Coinfirm

Pull request body

## Domain Submission

**Domains:** *.lukka.tech and *.coinfirm.com (two CSV entries, both wildcard)
**Organization:** Lukka, Inc.
**Category:** Blockchain Analytics / Deanonymization / Investigations

## Note on this submission

This PR consolidates what was originally two separate Tier 1 candidates
(Lukka and Coinfirm) into a single inclusion because Lukka acquired
Coinfirm in 2023 (publicly announced May 21, 2024). Both domains are
operated by the same corporate entity per Lukka's own Terms of Use.

## Evidence of Privacy Harm

Lukka is a New York-based institutional crypto data and software firm
(founded 2014, $1.3B valuation, $209M raised) that operates a blockchain
surveillance product line alongside crypto accounting and tax products.

### Surveillance product line

1. Lukka Blockchain Analytics — transaction, wallet, and clustering
   risk monitoring for crypto-assets. Includes on-chain and off-chain
   analytics combining regulatory filings, social media, and dark web
   intelligence. Sophisticated ownership detection and clustering
   techniques for linking anonymous blockchain addresses to real-world
   entities.

2. Lukka Blockchain Investigator — SaaS investigations tool with
   Source of Funds / Destination of Funds analysis. Lukka's own
   marketing explicitly states the product can "deanonymize asset
   movement through advanced mixers."

3. Coinfirm (acquired 2023) — established European blockchain analytics
   firm specializing in compliance, AML detection, sanction screening,
   entity due diligence, and on-chain investigations since 2016.

### Self-positioning

Per third-party analyst sources (Tracxn) and Lukka's own competitive
positioning, Lukka's top stated competitors are Chainalysis, Elliptic,
and Solidus Labs. The firm self-positions in the blockchain surveillance
market, not in the crypto accounting market.

### Customer base

Per Lukka's own marketing: banks, governments, law enforcements, tax
authorities, crypto exchanges, custodians, and CPA firms. Named
non-government customers include eToro, Circle, Bitso, ShapeShift,
Protocol Labs, Bitcoin Suisse, IOTA Foundation.

### Caveat on federal contract evidence

Unlike other Tier 1 entries (Chainalysis, AnChain.AI, Inca Digital,
Coinbase Tracer), no direct USAspending federal contract award to
Lukka surfaced in the research process. The inclusion case rests
primarily on Lukka's own marketing language (notably more explicit
about deanonymization than most surveillance vendors) and the
Coinfirm acquisition, which brought a separate documented surveillance
product line under the Lukka corporate umbrella.

## Verification Steps Completed

- [ ] Federal contracts (partial — Lukka government customers
      documented in marketing but no specific USAspending awards
      surfaced)
- [ ] WHOIS for both domains
- [x] Subdomain enumeration — both domains operationally Lukka per
      company's own Terms of Use
- [ ] SecurityTrails passive DNS for both domains
- [x] Behavioral analysis via Lukka's own product marketing and the
      Coinfirm acquisition press release
- [x] Inclusion criteria assessment (5 of 6 criteria met)
- [x] Functional impact test — all Bitcoin wallets pass

## domains.csv Entries

(paste the two CSV rows here)

## Notes

- The Coinfirm candidate that previously existed as a separate Tier 1
  candidate should now be considered consolidated into this Lukka
  submission. Reviewer should mark the standalone Coinfirm entry as
  defunct/acquired rather than verifying it independently.
- Wildcard block on lukka.tech also blocks LukkaTax (individual crypto
  tax preparation), but the product has shifted to a CPA-delivered B2B
  model and many non-surveillance crypto tax alternatives exist (Koinly,
  CoinTracker, ZenLedger, etc.). The dual-use concern is much weaker
  than for coinbase.com.

Submission

cd ~/path/to/satoshishield
git checkout -b add-lukka-and-coinfirm
# edit domains.csv to add the two rows
git add domains.csv
git commit -m "Add Lukka Tier 1 (wildcard, consolidated with acquired Coinfirm)"
git push origin add-lukka-and-coinfirm
# Open PR via GitHub web UI

Summary

Overall verdict: Strong Tier 1 inclusion. The federal contract evidence is weaker than the previous three verifications, but the company's own marketing language about surveillance capability ("deanonymize asset movement through advanced mixers" is one of the most explicit deanonymization claims documented in this project) provides overwhelming evidence at the product level. The Coinfirm acquisition consolidates two of the project's previously separate Tier 1 candidates into one.

Your remaining work on this candidate: 1. Functional impact test on Pi-hole and Bitcoin wallets (10-15 minutes) 2. PR submission (5 minutes)

Lessons / patterns observed

• First market-consolidation case in the project. The Coinfirm acquisition by Lukka is one of multiple roll-ups visible in the blockchain surveillance industry (Lukka also acquired Blox Finance and Venato; Chainalysis has acquired multiple smaller firms over the years). Worth documenting as a pattern in the white paper: the surveillance market is consolidating, which means future verifications need to check for recent M&A before treating any candidate as independent.
• Marketing language as primary evidence. When federal contract evidence is weaker, surveillance product marketing language can carry the inclusion case if it's sufficiently explicit. Lukka's "deanonymize asset movement through advanced mixers" is the clearest example of this in the project so far. The verification record format handled this case by being honest about the federal-contract gap rather than papering over it.
• The wildcard-versus-surgical question. Lukka is dual-product (surveillance + non-surveillance) like Coinbase, but unlike Coinbase the non-surveillance products are B2B/institutional rather than consumer-facing. This justifies wildcard rather than surgical treatment. The decision rule is now clearer: surgical only when the non-surveillance product is directly consumed by millions of individual Bitcoin users (Coinbase the exchange). Otherwise wildcard.
• The Coinfirm acquisition handling. Coinfirm shouldn't be removed entirely from the vault. The candidate file should be retained but marked status: defunct (or a new status like acquired) with a parent or acquired_by field linking to Lukka. This preserves the research record and documents the consolidation.