Category deep-dive: Use of crypto in terrorist financing expanded in 2024

Editor’s note: The following post is an excerpt from our 2025 Crypto Crime Report, which we are breaking down by threat category over the coming weeks. In part one and part two, we took a look at crypto transaction volumes and how sanctioned entities drove illicit crypto volume in 2024, respectively.

To read the 2025 Crypto Crime Report in full and download your copy, click here.

{{horizontal-line}}

In 2024, terrorist organizations continued to rely on traditional financial systems — cash, banks, money service businesses, and hawalas — to move funds. But evidence of the growing use of cryptocurrency by terrorist groups is clear. Of particular concern is cryptocurrency’s growing role for ISIS’ affiliate in Afghanistan, Islamic State Khurasan Province (ISKP), one of the most significant transnational terrorist threats today.

ISIS continued to grow its use of cryptocurrency

Over the past year, ISKP has been linked to numerous attacks, foiled plots, and arrests in countries such as Russia, Turkey, Iran, Germany, France, Austria, Italy, and the United States. In several cases, cryptocurrency played a central role. 

• In March 2024, ISKP carried out a deadly attack in Moscow that was partially financed with cryptocurrency. 
• In June 2024, a German individual, who sent USD 1,700 of cryptocurrency to ISKP, was arrested after applying to work as a security guard at a major European soccer tournament — the type of event ISKP has repeatedly urged its supporters to target. 
• In the same month, Turkish authorities announced that they had arrested ISIS financiers operating within the country and seized cryptocurrency wallets.
• In December 2024, a UK-based individual was sentenced to prison for sending more than GBP 16,000 worth of cryptocurrency to ISKP.

Over the past year, TRM has identified hundreds of transactions linked to ISKP, ranging between USD 100 to USD 15,000. These transactions have flown through regulated exchanges, high-risk exchanges, and individual cryptocurrency traders, some of whom may knowingly facilitate ISKP’s activities. 

TRM also identified on-chain links between ISKP-affiliated addresses and Syria-based fundraising campaigns for ISIS members and families held in camps, which remain a significant driver of cryptocurrency use by ISIS supporters around the world. TRM works diligently to identify addresses that various terror financing campaigns are using so that law enforcement can trace and disrupt campaigns and actors. 

{{BlogAd-2025CryptoCrimeReport-Report-2}}

Hamas, GazaNow, and Mujahideen Brigades received thousands of dollars in cryptocurrency donations

In Gaza, where the conflict between Israel and Hamas entered its second year, cryptocurrency donations continued to flow into addresses associated with Hamas, GazaNow, and the Mujahideen Brigades.

While Hamas had announced in the spring of 2023 that they had stopped accepting cryptocurrency donations — largely due to the success of Israel and the United States in targeting their cryptocurrency infrastructure — TRM data indicated that the group still received tens of thousands of dollars in cryptocurrency donations, albeit more discretely. 

Additionally, the Hamas-linked entity, GazaNow, still solicited cryptocurrency donations, despite being targeted by Israel and sanctioned by OFAC and other agencies around the world. GazaNow has raised tens of thousands of dollars since the October 7, 2023 attack by Hamas. 

Other fundraising campaigns that have raised tens of thousands of dollars include one for the Mujahideen Brigades, the military wing of the Palestinian Mujahideen Movement, which was sanctioned by the United States in November of 2018. 

Stablecoins remained the primary choice for terrorist financing organizations 

Shifts related to terrorist financing organizations’ reliance on stablecoins, identified by TRM beginning in 2022, persisted in 2024. TRM analysis indicates that, despite growing interest in Monero, stablecoins remain the primary choice for terrorist financing organizations. 

While ISKP, for example, promotes Monero in the magazine produced by its media unit, TRM assesses that ISKP predominantly utilizes stablecoins to move and store funds. Furthermore, fundraising campaigns tracked by TRM still overwhelmingly prefer stablecoins, although it remains to be seen whether the rising prices of Bitcoin and other cryptocurrencies will have a long-term impact on their choices.   

As it relates to Monero, in the fall of 2023, ISKP’s official media arm launched its inaugural donation drive with Monero as the chosen currency. First announced in the magazine “Voice of Khurasan,” produced by ISKP’s media unit, al-Azaim, calls for donations using Monero have since become a regular occurrence. TRM has identified fundraising campaigns linked to other ISIS affiliates, including in India and the Philippines, that have also solicited donations in Monero. While these developments are of concern, widespread adoption of Monero remains unlikely in the short term given the technical challenges and restrictions associated with its use, including the delisting of privacy coins by major exchanges. 

Threat actors displayed increased operational security 

Terrorists and their supporters began to display growing sophistication in their use of cryptocurrency, with the numerous arrests of individuals in 2024 being a likely driver of improved TTPs. This included:

• Growing use of unhosted wallets and mixers. Terrorists and their supporters have been sharing tips online regarding best practices and services or websites that provide the most protection.  
• Use of fake credentials to bypass Know Your Customer (KYC) controls imposed by exchanges.
• Growing interest in privacy coins such as Monero.

As terrorists’ use of cryptocurrency grows in sophistication, ongoing monitoring, threat intelligence, and advanced technical capabilities will be required to identify their activity on the blockchain.  

{{horizontal-line}}

Next up in this series: We take a closer look at the prolific and growing threat of ransomware attacks with a crypto nexus, and how the digital battlefield evolved in 2024.

Ready to dive into the full 2025 Crypto Crime Report? Get your copy here.