The Evolution of Terrorist Financing, 25 Years After 9/11

Key takeaways

• The cash and hawala networks that defined the early-2000s terrorist financing world never went away — they have been layered over by cryptocurrency, with AI only now beginning to appear at the edges
• Ideologically distinct groups have converged on one on-chain playbook: USDT on TRON, a fresh deposit address per donor, and constant rotation over encrypted channels
• Crypto now helps fund attacks themselves, not just organizations — the March 2024 Crocus City Hall attack in Moscow drew part of its funding from cryptocurrency
• For those combatting terrorist financing, visibility is the defining advantage of the current era. Value on a public ledger is permanent and attributable, and stablecoins add an issuer freeze lever that adversaries are now testing methods to erode.
• The 2025 designation of eight cartels and transnational gangs as Foreign Terrorist Organizations (FTOs) pulled the professional laundering economy of the Americas into the counter-terrorist-financing mandate
• Generative AI has not surfaced in any documented terrorist-financing case

{{horizontal-line}}

25 years ago, terrorist financing moved through a system authorities could barely see into. The 9/11 plot cost an estimated USD 500,000, and it traveled on instruments available in 2001: bank wires, cash carried through airports, and hawala, the trust-based broker network that settles with no cross-border record.

The counter-terrorist-financing regime built to address those challenges prioritized things like sanctions designations, suspicious-activity reporting, and pressure on correspondent banks.

A quarter-century later, a growing share of terrorist money moves across cryptocurrency infrastructure.

The trust-based hawala economy of the early 2000s still operates beneath a cryptocurrency layer now dominated by stablecoins. That visibility gives investigators an advantage, but adversaries are already looking for ways around it. Now, the first signs of generative AI are only beginning to surface. The next few years will depend on how quickly enforcement can act on what it sees on-chain as terrorist networks experiment with harder-to-freeze assets, more difficult-to-trace transactions, and potentially AI-assisted fundraising.

How the financing rails have evolved since 9/11

Before 9/11, al-Qaeda and the networks around it moved most of their money through hawala, bulk cash carried by couriers, and charitable fronts. Hawala works on trust: a broker in one country hands out cash on the word of a broker in another, and the two square up later by offsetting other transfers between them. No money crosses a border, and there is no wire, no bank record, nothing for an investigator to subpoena.

By 2019, Hamas — more precisely its military wing, the Izz al-Din al-Qassam Brigades — was among the first terrorist organizations to embrace cryptocurrency, soliciting Bitcoin donations. As ISIS's physical caliphate collapsed and its activity dispersed into affiliates across Afghanistan, Somalia, Nigeria, and the Sahel, the operational need changed. Affiliates had to push small sums to scattered cells across borders where formal banking barely functions. Cryptocurrency met that need.

What began there has since spread. In early 2023, the UN Analytical Support and Sanctions Monitoring Team reported that ISIS's Somalia-based al-Karrar office routinely moved roughly USD 25,000 per month in cryptocurrency directly to Islamic State Khorasan Province (ISKP) in Afghanistan, a finding consistent with TRM's own data, which increasingly shows ISIS affiliates transferring funds among themselves on-chain. Cryptocurrency was also central to fundraising for ISIS members and families detained in Syria, still one of the most persistent drivers of crypto use among the group's supporters.

The dominant instrument is USDT on the TRON network: stable in value, negligible in fee, and final within seconds. Increasingly, fundraisers generate a fresh deposit address for each donor and rotate constantly, distributing those addresses over encrypted messaging to frustrate clustering, blacklisting, and interdiction.

Crypto donations are frequently converted back to local currency through regional exchanges and informal brokers, the same cash-out endpoint that mattered in 2001. Until recently, terrorist groups used crypto mainly for general fundraising and operating costs. Now, crypto is moving further into the facilitation of attacks themselves. For example, ISIS affiliates in Africa have openly solicited cryptocurrency to buy weapons and drones, and Yemen's Houthis have gone further, using it to procure dual use goods that are used in uncrewed aerial vehicles (UAVs) and counter-UAV equipment, including from a Russian broker reselling Chinese-made systems.

The March 2024 Crocus City Hall attack in Moscow marked a further evolution. ISKP, which carried out the attack that killed approximately 145 people, used cryptocurrency as part of the financing for the operation itself. But even as terrorists’ specific use cases for cryptocurrency expand, those transactions remain visible on-chain for analysts to investigate indefinitely.

Terrorist funds still move through the same regional exchanges, brokers, and professional launderers that serve cartels, traffickers, and fraudsters. In 2025, the designation of eight cartels and transnational gangs as FTOs pulled that shared laundering economy formally into the counter-terrorist-financing mandate.

Crypto's visibility is an enforcement advantage

When terrorist financing moves onto a blockchain, investigators gain visibility they do not have with cash. Transactions on public ledgers can be traced and, in the case of stablecoins, funds can often be frozen. Cash is the genuinely hard target. Banknotes moving through informal networks leave less to investigate.

On a public ledger, the opposite holds. That visibility can translate directly into enforcement action. Coordinated public-private action froze roughly USD 475 million tied to Central Bank of Iran wallets across two Office of Foreign Assets Control (OFAC) actions in 2026, with the stablecoin issuer executing the freeze.

The Financial Action Task Force (FATF) has flagged the prospect of proprietary stablecoins engineered to resist freezing and seizure, keeping the speed of digital settlement while removing the very points at which authorities can act. TRM expects continued experimentation with cross-chain swaps and privacy coins toward that end.

Enforcement is landing on the same rails

Since March 2025, the US Justice Department has recovered roughly USD 560,000 across five separate actions against Hamas-aligned flows, each describing the same rotating-deposit-address pattern. The number of law enforcement actions — arrests and seizures — taken against groups and individuals using cryptocurrency for material support to terrorism has risen steadily since 2020, as shown below.

Prosecutors have also unwound sham charities that raised money on mainstream crowdfunding platforms and moved the proceeds onward in crypto. According to the charging documents, one fake charity allegedly routed around USD 30,000 through some 80 transactions to a Palestinian Islamic Jihad member, and another allegedly sent more than USD 116,000 to a Hamas member.

Keeping the advantage: Analytics, attribution, and training

The share of terrorist financing that moves through crypto will likely keep growing. Generative AI has not appeared in any documented financing case so far; if it does, it will most likely show up first in low-signal forms, such as synthetic identities or mass-produced multilingual appeals. Two developments are worth watching: freeze- and trace-resistant assets, whose adoption remains uneven, and the growing overlap between cartel and terrorist money laundering now that both fall under the same designations.

Visibility on its own changes little. Converting it into disruption takes three capabilities working together.

• Analytics. A blockchain is a live, machine-readable intelligence stream, and AI investigative agents can now reason across ledger data, threat intelligence, and victim reports to produce in minutes what once took an analyst weeks. That extends credible triage to frontline officers who have never opened a block explorer.
• Attribution. Anyone can read a ledger; few can say who controls a given address. Attribution, built from continuous open-source collection across roughly 200 blockchains, is the decisive capability.
• Training. Most jurisdictions still fail at the moment an investigator receives a wallet address and does not know the next step. Standardized training across agencies, departments, and jurisdictions is the only way to address the problem.

Across 25 years, terrorist financing has evolved in step with terrorism and counterterrorism themselves, moving from banknotes and hawala and expanding to include stablecoins on public ledgers. The constant is that value must eventually convert into material, movement, and shelter, and each conversion is a point of exposure.

In 2001, terrorist money moved through a system authorities could barely see into. Today, counterterrorism practitioners hold a rare edge, because much of that money moves on a blockchain ledger they can read. That edge is narrow and it is not self-sustaining: it holds only where analytics, attribution, and trained investigators arrive together, and only for as long as it takes adversaries to adopt assets built to resist freezing. The work of the next several years is to spend that edge before it closes.

{{horizontal-line}}

Frequently asked questions (FAQs)

1. Is cryptocurrency now the primary way terrorist groups raise money?

No. Cash and informal value transfer such as hawala remain the quiet, hard-to-see endpoint. What has changed is that a growing and increasingly documented share of terrorist value moves through cryptocurrency, which, because it is visible on public ledgers, is also more prosecutable than the cash economy it sits alongside.

2. Which assets and networks do designated groups use most?

The dominant instrument TRM observes is USDT (a stablecoin) on the TRON network, chosen for stability, low fees, and near-instant settlement. Groups typically generate a fresh deposit address per donor and rotate frequently. Bitcoin and, episodically, privacy coins such as Monero also appear, usually under enforcement pressure.

3. If terrorists are using crypto, isn't that a failure of oversight?

Not straightforwardly. Value on a public blockchain leaves a permanent, attributable record and, in the case of stablecoins, can be frozen by the issuer — neither of which is true of cash. The migration of any share of terrorist value onto public ledgers is, on balance, an enforcement opportunity, provided investigators have the tools, attribution data, and training to act on it.

4. Is AI already being used to finance terrorism?

Not in any documented case to date. Across authoritative reporting, crypto fundraising is recorded with no attribution to generative AI. TRM assesses this reflects incentives rather than inability, and that the first uses — likely low-signal ones such as synthetic identity packages and multilingual appeal generation — may be under way below the threshold of current detection.

5. What does it take to turn blockchain visibility into actual disruption?

Three capabilities working together: analytics to read the ledger at speed, attribution to identify who controls an address, and trained investigators who know what to do when they receive one. Attribution is the decisive differentiator, and trained personnel are the most common bottleneck.