Fundraising Campaigns for ISIS Families: Analyzing the Use of Cryptocurrency

‍Key Findings

Three years after the fall of ISIS’s physical caliphate, fundraising campaigns for ISIS families detained and held in internment camps remain a significant driver of crypto use and innovation among ISIS supporters. To better understand how these campaigns raise and move cryptocurrency funds, TRM conducted an analysis of content published by about a dozen fundraising campaigns over the last month and on-chain crypto movements.

We found that fundraising campaign operators responsible for the campaigns display varying levels of sophistication, accepting a wide range of cryptocurrencies. The campaigns raise anywhere from twenty dollars to tens of thousands, with individual donations ranging from tens to hundreds of dollars. While these figures remain relatively low, the increasing adoption of cryptocurrency by ISIS supporters requires ongoing monitoring and analysis to continuously assess the potential use of these campaigns as a channel of funding for ISIS.  

Background

Almost immediately following ISIS’ territorial defeat in the northeastern Syrian town of Baghouz in March 2019, online fundraising campaigns on messaging and social media platforms, including Telegram, WhatsApp and Facebook, were launched in support of the women and children taken to internment camps. Fundraisers state on their online channels, groups and accounts that the funds are sent to the camps to improve the detainees’ conditions and/or to secure their release, typically by bribing camp guards for amounts ranging from $5000 to $12,000. 

• Thousands of individuals were captured after the fall of ISIS; the men were taken to prisons and the women and children were taken to internment camps such as Roj and al-Hol (aka al-Hawl), which remain a dangerous breeding ground for the group’s ideology. 

While these campaigns typically avoid displaying overt support to ISIS to avoid detection and suspension by social media platforms and messaging apps, a closer look at their online content confirms their ideology and that the funds collected are meant for ISIS women and families. Among the identifiers are the use of specific religious terminology and images exclusively used by ISIS, references to Baghouz and/or glorifying ISIS attacks. The campaigns are often promoted by ISIS supporters online and are primarily in Arabic and/or English. Some campaigns are in other languages including Russian, French and German, indicating that they are focused on foreign women who had moved to ISIS territory before its collapse. 

‍

One campaign praised ISIS’s January 20, 2022 attack on a prison in Syria, which killed dozens, referring to the attackers as “Lions.” Another was less discrete and published a pledge of allegiance to ISIS’s new leader, Abu al-Hasan al-Hashimi. 

Movement of funds on-chain

The campaigns tracked by TRM Labs operate on multiple blockchains and employ a wide range of techniques, tactics and procedures (TTPs) for moving funds. These include the use of shared addresses (hosted and unhosted), preferred wallet providers, temporary addresses, privacy coins, and cashout mechanisms. While most campaign operators appear unsophisticated in their use of cryptocurrency, a few display concern for security when collecting donations. This includes the use of temporary addresses and the solicitation of the privacy-oriented coins, including Monero. 

Based on proprietary sources and analysis, TRM Labs has identified multiple methods of cryptocurrency on-ramping/off-ramping platforms utilized by campaign operators and donors. Donors have been observed using unhosted wallets, compliant exchanges, non-compliant exchanges, and in some cases, crypto ATMs. Some crypto ATMs maintain lower standards of KYC collection and are often associated with high-risk activity. 

Campaign operators remain critical in the fundraising ecosystem as they promote campaigns, coordinate payments from donors in real time, and serve as an intermediary for payment offramps. The campaign operators have been identified primarily utilizing compliant exchanges as a source to send collected donations. Compliant exchanges are used as an outlet to transition donations into fiat or other cryptocurrencies. Additionally, some campaigns were identified as being nested in and interacting with wallets operated by Syria-based high risk exchanges, BitcoinTransfer and Bitcoin Xchange, which are also occasionally used as a transition point. Both exchanges are located in territories controlled by the US-designated Haya’at Tahrir al-Sham (HTS).

While Bitcoin remains the primary cryptocurrency used, other blockchains were also available, including Ethereum, Monero, and Tron. Within Ethereum and Tron blockchain usage, USDT has been the primary cryptocurrency utilized in fundraising. TRON USDT usage has been identified as a secondary method for fundraising likely due to its price stability and lower transaction fees. The use of USDT TRON is likely to increase, with some fundraising campaign administrators stating that it is better for donations. 

Outlook

Fundraising campaigns are likely to continue until women and families—especially foreign women— are repatriated to their home countries.  While these funds are ostensibly to be used for humanitarian purposes, they may be a potential financial resource for the terrorist group itself, which retains extensive networks in the camps. According to the US Department of Treasury’s 2022 National Terrorist Financing Risk Assessment report:

“[ISIS] also leverages their support network within refugee camps, such as al-Hawl in northern Syria and others, to receive donations from supporters in the international community. External donations to refugee camps come into the region through various means—such as money remitters and virtual asset service providers (VASPs) —and then exit the regulated financial system as cash via hawaladars, where they are subsequently sent to the camp. To solicit donations, ISIS supporters in these camps often use various social media platforms and disguise their appeal as humanitarian aid. In Africa, extortion and kidnapping for ransom remain key sources of funding for ISIS, but recent reports also indicate that revenues from the extortion of artisanal gold mining-related activities is increasing.Virtual assets are being sent directly to ISIS supporters located in northern Syria, often to Idlib, or indirectly via Turkey, where ISIS is able to access them at virtual asset trading platforms."

Investigators at TRM Labs will continue to assess the legitimacy of these donation campaigns, and monitor both the sources and destinations of the funds raised.

About TRM Labs

TRM provides blockchain intelligence to help financial institutions, cryptocurrency businesses, and public agencies detect, investigate, and manage crypto-related fraud and financial crime. TRM's risk management platform includes solutions for transaction monitoring and wallet screening, entity risk scoring - including VASP due diligence - and source and destination of funds tracing. These tools enable a rapidly growing cohort of organizations around the world to safely embrace cryptocurrency-related transactions, products, and partnerships.

‍