New Evidence Confirms ISIS Affiliate in Afghanistan Accepting Cryptocurrency Donations

While ISIS supporters have solicited cryptocurrency donations for years, especially in Syria, TRM Labs recently uncovered evidence of direct cryptocurrency use for fundraising by an official ISIS affiliate.

ISIS’s affiliate in Afghanistan, known as the Islamic State in Khurasan (ISKP or ISIS-K), is accepting cryptocurrency donations amid ramped up propaganda and recruitment efforts. TRM Labs identified a Bitcoin, Ethereum and TRX (Tron) address controlled by ISKP’s media unit, the al-Azaim Foundation for Media (AFM). AFM promotes ISKP ideology and militant activity in Afghanistan, Pakistan, Tajikistan and beyond, publishing content in at least ten languages including English, Hindi, Urdu and Russian. 

At the time of writing, the TRX address that TRM identified had incoming transactions amounting to less than $1000 in USDT. The Bitcoin and Ethereum addresses associated with AFM appear to be unused. Addresses created for one-time use by a donor are a common security measure taken by some terrorist financiers to limit detection of the organization’s main holding addresses.

Yet while the volume identified remains low, the discovery of the addresses provides further evidence that ISIS and its supporters in Central Asia are increasingly turning to virtual assets to move and raise funds. TRM Labs previously identified pro-ISIS Tajik groups using cryptocurrency to both recruit fighters for ISKP and to support Tajik ISIS families held in internment camps in Syria.  

According to the US Department of Treasury, ISIS has increasingly used virtual assets service providers to finance its subordinates in central and south Asia. Overall, cryptocurrency is likely a very small but growing source of funding for ISKP.

Who is ISKP?

Formed by fighters from Tehrik-i-Taliban Pakistan, al-Qaeda and other jihadist groups, ISKP was formally introduced as ISIS’s Afghanistan affiliate in 2015. It has more recently recruited Taliban defectors disgruntled by their government’s deal with the United States. 

The group was behind the August 2021 attack on Kabul airport that killed more than 180 people, including 13 US service members. While its focus remains regional, in March 2022, US officials warned that ISKP “could establish an external attack capability against the United States or its allies in twelve to eighteen months.”

Potential ISKP Connection with Syria and Turkey 

An address associated with AFM was found to have links to pro-ISIS fundraising campaigns and a cryptocurrency exchange service that TRM Labs previously identified as facilitating many of those campaigns.The exchange is based in Idlib, Syria—an area controlled by a designated terrorist group— and maintains a presence in Turkey, a key hub for ISIS financial networks. In November 2021, the US Treasury designated an individual for facilitating international financial transactions on behalf of ISKP using a Turkey-based Hawala business.

Since late 2021, ISIS Core, located in Syria and Iraq, “probably has transferred tens of thousands of dollars” to its Afghanistan-based affiliates, according to the US Treasury. The on-chain links identified by TRM Labs between AFM and pro-ISIS cryptocurrency activity in Syria suggest that, while Hawala likely remains the preferred method of moving money across borders, cryptocurrency may be also being increasingly used to make such transfers.

As terrorist groups look to expand their means of transferring money, the identification of addresses associated with terrorist groups and their supporters and tracking their blockchain activity will become ever more important when looking to understand their financial networks.