Terrorist Financing: Six Crypto-Related Trends to Watch in 2023

Throughout 2022, TRM has tracked cryptocurrency and blockchain technology use by terrorist groups, their supporters and associated fundraising campaigns. While crypto adoption as a fundraising mechanism remains low overall, analysis of on-chain transactions and proprietary information reveals six notable trends that are likely to continue this year.

1. Fundraising Campaigns for ISIS Families Driving Cryptocurrency Use

Fundraising campaigns for ISIS families held in internment camps in northeastern Syria has been a significant driver of cryptocurrency usage among ISIS and its supporters. TRM identified dozens of fundraising campaigns that accepted cryptocurrency in 2022, raising between a few dollars to tens of thousands. Fundraisers generally claim that funds will be sent to the camps to improve the detainees’ conditions and/or to secure their release, by bribing camp guards. Over the last three years, multiple ISIS-associated individuals have been smuggled out of the camps using funds sent from supporters around the world. 

While it is unlikely that camps like al-Hol will close anytime soon, many countries from around the world are repatriating their citizens at increasing rates. This may eventually impact cryptocurrency fundraising volumes. However, with thousands continuing to be held in the camps, such fundraising campaigns are set to remain a fixture in the months to come.

2. Growth of USDT as TF Currency of Choice

Over the last year, TRM has observed a significant increase in the use of the Tron (TRX) blockchain among terrorist groups and associated fundraising campaigns, with some using it exclusively. The overwhelming majority of those actors used Tether (USDT) addresses to collect donations. Among the terror financing entities tracked by TRM in 2022, there was a 240% increase in the use of USDT —  against a mere 78% rise in BTC use. This trend is likely driven by price fluctuations associated with BTC as well as the lower fees associated with USDT on Tron. Other cryptocurrencies used by terror financing entities include Ethereum, Dogecoin, Monero and Zcash. 

However, an increase in Bitcoin prices following an early 2023 rally may cause threat actors to choose currencies with an upswing potential — a trend last observed in the terror financing space during the crypto bull run in 2021. 

3. Threat Actors Upgrading Operational Security

While the majority of the threat actors in the space lack sophistication, a growing number of entities and terror fundraising campaigns have clearly improved their operational security.  For example, TRM had identified threat actors employing a mixer to obfuscate sources of funding. Another actor warned prospective donors against using verified accounts and to instead use cold wallets for donations. This trend is likely to continue given the growing awareness among some threat actors in the space that cryptocurrency is not anonymous, reinforced by the recent arrests of multiple individuals charged with supporting terrorist groups using cryptocurrency.

Terrorist groups like Hamas, who have been the target of repeated disruptions in their fundraising campaigns, remain among the more sophisticated cryptocurrency users in the terrorism financing space. The group had long solicited donations through its website, using address generation techniques to limit exposure of its true cryptocurrency wallet. 

‍4. Tentative Embrace of Decentralized Exchanges

In 2022, multiple terror financing entities, including Syria-based cryptocurrency exchanges involved in terror financing campaigns, began exploring decentralized exchanges. Decentralized exchanges (DEXs) are peer-to-peer marketplaces where individuals can trade cryptocurrencies in a non-custodial manner. To date, TRM’s on-chain analysis suggests that DEFI use remains largely experimentation and conducted primarily by Syria and Gaza-based exchanges that are heavily involved in terror financing. These exchanges conduct dozens of transactions of under $50 between associated wallets. While these exchanges currently primarily rely on centralized VASPs, any disruptions to their activities will likely speed up their migration process. 

5. Experimentation with NFTs

In August 2022, an ISIS supporter created what appeared to be the first pro-ISIS NFT. The NFT, which was not sold, was an example of ISIS supporters experimenting with new technologies to spread their propaganda. While ISIS has not officially commented on the NFT or on the use of such technology, ISIS supporters have long maintained an important role in advancing ISIS propaganda and introducing new technologies and platforms later adopted by the group itself. ISIS supporters have been experimenting with decentralized technology for nearly two years, primarily using decentralized hosting sites to publish propaganda. 

While it is unlikely that NFTs will develop into an effective fundraising tool for ISIS in the near future, TRM is continuing to monitor the group and its supporters’ further experimentation with this technology throughout 2023.

‍6. Growing Interest in Cryptocurrency by Terrorist Groups in South and Central Asia

In December 2022, TRM identified the use of cryptocurrency to raise funds by al-Azaim Foundation for Media (AFM), the official media unit of ISIS’s affiliate in Afghanistan, known as the Islamic State in Khurasan (ISKP or ISIS-K). While the volume identified remains low, the discovery of the addresses provides further evidence that ISIS and its supporters in South and Central Asia are increasingly turning to virtual assets to move and raise funds. According to the US Department of Treasury, ISIS has increasingly used virtual assets service providers to finance its subordinates in central and south Asia. Overall, cryptocurrency appears to be a very small but growing source of funding for ISKP. TRM Labs previously identified pro-ISIS Tajik and Pakistani groups using cryptocurrency to spread propaganda and recruit fighters. 

Notably, an address associated with AFM was found to have links to pro-ISIS fundraising campaigns and a cryptocurrency exchange in Syria that TRM Labs previously identified as facilitating many of those campaigns. In November 2021, the US Treasury designated an individual for facilitating international financial transactions on behalf of ISKP using a Turkey-based Hawala business.

Since late 2021 ISIS Core, located in Syria and Iraq, may have transferred tens of thousands of dollars to its Afghanistan-based affiliates, according to the US Treasury. The on-chain links identified by TRM Labs between AFM and pro-ISIS cryptocurrency activity in Syria suggest that, while hawala likely remains the preferred method of moving money across borders, the use of cryptocurrency for that purpose is being increasingly explored.