TRM Finds Mounting Evidence of Crypto Use by ISIS and its Supporters in Asia

Recent reports published by the US Treasury Department and the United Nations have observed increasing cryptocurrency use by ISIS and its supporters across Asia, with some alleged perpetrators arrested by national law enforcement.

Consistent with these reports, TRM Labs has found mounting on-chain evidence over the past 12 months that pro-ISIS networks in Tajikistan, Indonesia, Pakistan and Afghanistan have used cryptocurrencies to help conduct their activities. Almost all of the transactions associated with the cases below were conducted using Tether (USDT) on the Tron network (TRX), a growing trend that TRM is observing in this space.

Tajikistan

In Tajikistan, TRM Labs identified multiple pro-ISIS groups using cryptocurrency, including to recruit fighters to join ISIS’s affiliate in Afghanistan (ISKP). One such fundraising campaign, which has been active for over a year, controlled an address that received around USD 2 million in USDT on Tron in 2022. Having identified the campaign and traced its funds on the blockchain, TRM Labs notified the exchange used by the group to cash out some of their funds. Aided by its know-your-customer (KYC) controls, the exchange identified the person operating the account and alerted the local authorities, who went on to disrupt their activities. On June 22, 2023, Turkish authorities arrested Shamil Hukumatov, a senior ISIS fundraiser, who was allegedly behind the fundraising campaign.

ISKP has long sought to recruit Tajiks to join ISKP in Afghanistan and to launch attacks against the Tajik government. In 2022, ISKP launched its first attacks in Tajikistan.

Indonesia

Over USD 517,000 was sent in 2022 by individuals using an Indonesia-based exchange to addresses identified by TRM Labs as belonging to pro-ISIS fundraising campaigns in Syria and the local exchanges that facilitate their activities. The fundraising campaigns claim to support and help free ISIS families held in Syrian camps. Dozens of transfers were made regularly throughout the year, usually in increments of around USD 10,000. All these transfers were made using USDT on Tron. 

Notably, in May 2022, the US Treasury Department’s Office of Foreign Asset Control (OFAC) sanctioned five Indonesian nationals for facilitating money transfers from Indonesia to ISIS members in Syria.

Pakistan

A media unit linked to ISIS’s affiliate in Pakistan (ISPP) began promoting its ability to accept donations in the second half of 2022. ISPP was formed in 2019 and has carried out multiple attacks in Pakistan, which typically target local security forces. Addresses identified by TRM Labs as being controlled by the group had a total volume of around USD 40,000 over the last 12 months. 

They appear to have sought to exploit the earthquakes that struck Turkey and Syria in February 2023 to raise funds. An individual who did not identify themselves as being part of ISPP posted several cryptocurrency addresses on an ISIS messaging server, claiming that they were to receive donations to help the survivors of the earthquake. Those addresses, however, were previously flagged by TRM Labs as being linked to ISPP. 

Afghanistan

The al-Azaim Foundation for Media Production (al-Azaim) is the media unit of the ISIS affiliate in Afghanistan (ISKP). Among the most prolific of ISIS-linked media units today, al-Azaim is a significant driver of ISIS recruitment, especially in South and Central Asia, producing content in at least half a dozen languages. 

In December 2022 TRM Labs identified cryptocurrency addresses controlled by al-Azaim. Despite showing less than USD 10,000 of activity, the addresses proved that al-Azaim was using cryptocurrency to fund its operations and/or to receive funds from supporters, something that the group has never publicly stated. 

Perhaps unsurprisingly, given the on-the-ground links between ISIS affiliates in Pakistan and Afghanistan, TRM Labs identified on-chain links between addresses controlled by al-Azaim and addresses controlled by the Pakistan-based group. 

Syria Links

The above case studies, from all over Asia, have one thing in common: on-chain links to pro-ISIS fundraising campaigns in Syria, which remains a key hub of cryptocurrency use by ISIS and its supporters. Much of that comprises donations to ISIS families in camps like al-Hol and Roj, and the local cryptocurrency exchanges that facilitate their activities. Finding these campaigns, tracing the donations on the blockchain and identifying the donors is critical to map out and potentially disrupt pro-ISIS networks around the world.

‍