TRM Labs says Monero usage remains above pre-2022 levels as darknet markets shift toward XMR, while unusual node behavior may offer investigators network-level clues.