Jihadist groups like Al Qaeda, Islamic State, and their sympathizers have been tapping into the heightened hostility and anger of Muslims over Israel’s aerial bombardment and military invasion of Gaza to bolster their financial resources through crowdfunding campaigns. In this context, the role of digital currencies like Tether and Bitcoin coupled with the use of decentralized crypto exchange platforms by militant jihadists groups to launder funds has come under intense scrutiny after the Hamas October 7 attack on Israel.
Recent monitoring by ICSVE suggests that entities linked to Islamic State (IS) and Al Qaeda (AQ) are building on past successes of exploiting sympathy for the Palestinians and now deeply exploiting the Israeli-Hamas conflict to boost their crowdfunding endeavors. Some pro-Al-Qaeda entities are even claiming to provide financial assistance to Palestinians in Gaza, primarily through cryptocurrency proceeds.
While legitimate resources are flowing to victims alongside illicit resources to militants, it should be noted that in 2005 Hamas leaders completely rejected Al-Qaeda leaders’ calls for Hamas to boycott elections and to enroll in global jihad with AQ claiming that even if they won, the West would never allow them to govern. Hamas prevailed in those elections as they were seen at the time as less corrupt than Fatah due to their Islamic ideology and roots, a reality that unfortunately did not bear out over time. Whether a transition has occurred in which Hamas is now aligning itself with al Qaeda, or ISIS, is still to be ascertained. Israelis claim an ISIS flag was found left behind in the October 7th raids and that ISIS-style beheadings occurred. Certainly, while Israeli governance moves further and further to the hard right and desperation in Gaza grows, alignment may have been occurring between Hamas and global jihadists. In response to Israel’s current heavy civilian bombardment and actions in the West Bank Hamas supporters have also now mounted foiled and actual attacks globally. Yet, it’s premature to claim Hamas as an international terrorist group on the level of ISIS or Al Qaeda, nor formally aligned with either. The flow of money however is often an indication where tides may be shifting in that regard.
Militant claims to be raising money for beleaguered Palestinians may be only claims and not actualities. Indeed, a prominent Al-Qaeda supporter advises AQ acolytes to exercise caution regarding Gaza-related aid fundraisers, stating, “The donations collected in the name of Gaza are very large. In order to ensure the sincerity and honesty of the parties that collect donations, ask them to publish pictures and videos of the items that they distribute to the displaced people in schools and other refuge places.”
Charity fundraising and provision of humanitarian aid and services by terrorist groups and their supporters is nothing new. Terrorist groups have long furthered their own financial gains by capitalizing on political turmoil, conflicts, or natural disasters and the failure of governments to provide adequate and timely aid. In March 2023, ICSVE documented Islamic State in Pakistan province’s Nashir Al Pakistan media fund raise on Telegram as they encouraged IS supporters to contribute crypto transfers under the guise of assisting earthquake victims in northwestern Syria. The group utilized currencies like Ethereum, Monero, and USDT to solicit donations. Apparently, their success warrants continuing these fundraising efforts for other fighters as well amidst the Israeli/Hamas conflict.
A crowdfunding initiative for Gaza, known as “Strive with your Money” has been gaining momentum. This campaign is ostensibly run by an independent jihadist ideologue of Palestinian origin and the former Sharia member of Hayat Taharir Al Sham, Sheikh Zubair Al Ghazi from the HTS-held province of Idlib, Syria. Since the campaign’s announcement in mid-October, there were claims made by Al Ghazi that $500,000 in Tether donations and fiat currency had been collected through crowdfunding efforts until mid-November, primarily from Central Asia and Russia, which could be confirmed by monitoring the transaction history of the provided Tron wallet for sending donations.
To lend legitimacy to the crowdfunding campaign, Al Ghazi disseminated in the Telegram channel receipts and screenshots of crypto transfers worth thousands of dollars. Videos shared by Al Ghazi document that the jihadist group Turkistan Islamic Party’s branch in Syria and Afghanistan also contributed around $34,000 in the form of cash handouts for relief assistance. Sheikh Al Ghazi’s channel also regularly disseminates propaganda from Hamas’s military wing, Al Qassam Brigades. Al-Qaeda’s jihadist literature, including that of the killed Al Qaeda veteran leader Abu Yahya Al Libi. With Hamas suspending bitcoin donations in March 2023 citing security concerns for its supporters and facing aggressive crackdowns by the US Treasury and Israeli government leading to the seizure of Hamas’s crypto assets, worth millions of dollars, crowdfunding campaigns like these potentially provide illicit financing via a humanitarian facade. Such campaigns, masquerading as charity initiatives, enable militant groups like Hamas to launder funds crucial for fueling the group’s terrorist activities, warfare, recruitment, and outreach efforts.
The donations collected are not insubstantial. From September to December the Islamic State in Pakistan’s province-linked bitcoin address on the other hand ostensibly laundered $30 million as outbound transfers as a part of the convoluted money laundering network. This occurred in part due to that in December 2023, in the pro-Islamic State media discourse, supporters circulated ISPP’s media, Nashir Al Pakistan’s, plea of sending donations for “IS Mujahideen” in Pakistan through Pakistan-based digital payment platforms like Easy Paiza and Jazz Cash and cryptocurrency by sharing the Bitcoin and Tether wallet addresses which were later deleted. In this context, it’s noteworthy that blockchain investigators have found crypto wallets have been used by terror entities using various channels, including stolen credit card vendors, dark web markets, Ponzi schemes, and crypto investment scams for laundering illicit money.
However, the allure of Bitcoin as the primary cryptocurrency for donations has significantly waned among jihadist groups, as the Tron network (TRC20) has surpassed Bitcoin in serving as a leading platform for crypto transfers associated with militant jihadist groups. Over a span of two years, ICSVE has observed a notable surge in the adoption of the TRON blockchain by militant jihadist outfits, especially ISIS, and related fundraising campaigns. Tether, a currency on the Tron blockchain, chosen for its rapid transfers, low transaction fees, and user-friendly protocol, has been the currency of preference for militant groups. Criminal and terrorist entities exploit TRON’s anonymity and fast transaction speeds to obfuscate the origins and destinations of unlawfully acquired funds. Cross-chain bridges ease the transfer of cryptocurrencies between blockchains, further facilitating money laundering to and from Tron.
Even pro-Al-Qaeda supporters, purporting to run fundraisers for Gaza, exhibit a preference for the Tron blockchain, favoring stablecoins like USDT—pegged to the US dollar—for accepting donations. Pro-Al-Qaeda supporter Al Murabit Al Maqdis circulated the recipient Tether address on Telegram pushing the supporters to donate for relief aid in Gaza. Between mid-October and December 2023, $14,000 was directed from the pro-Al-Qaeda linked-Tron crypto address to an address at the Seychelles based Kucoin centralized exchange with few incoming transfers into the pro-Al-Qaeda wallet addresses through the largest mainstream US-based exchange Binance. This largest crypto trading platform, having faced $4 million in fines for violating US anti-money laundering rules, is now under scrutiny for its role in facilitating money laundering for various terrorist groups. Reflecting this dynamic blockchain analysis platform, Chainanalysis highlighted that mainstream centralized exchanges have been the biggest recipient of illicit cryptocurrency, “taking in just under half of all funds sent from illicit addresses.”
While Tether has been a go-to currency due to the advantages it offers to threat actors, rival virtual currencies like Ethereum, and Monero have also been employed by jihadist groups and their networks for illicit financing and money laundering. In mid-November, supporters from the Islamic State in Khorasan province’s (ISKP) Uzbek and Tajik contingent came forward to donate to the group’s cause. They circulated a plea from ISKP’s official media unit, Al Azaim, soliciting untraceable and privacy-oriented Monero cryptocurrency donations. The plea shared details of the Monero wallet for “waging jihad with wealth.” ISKP’s pro-Tajik network is also crowdfunding for IS women detainees in internment camps in northeastern Syria. This effort also revealed the competition between crowdfunding for various jihadist causes, some seen as more legitimate than others, in that it lambasted Muslims for financially aiding civilians in Gaza without acknowledging the “sufferings” of the “mujahid IS families” languishing in the northeastern Syrian detention camps without any adequate access to food water or sanitation facilities.
The administrator of the pro-IS network wrote, “So what is the reason that they go out of their way in the case of Gaza, but in the case of Baghuz, they were silent? The answer is their defeatist, rotten aqida [creed]. People there sympathize in Gaza with the Hamas apostate group. This Ikhwan [brotherhood] democratic group of apostates whose leaders make the statement that they believe in Democracy. Have they forgotten where they should be sending help?” Transfers for this ISKP Tajik fundraiser could be sent to the beneficiary’s SBER account, a Russian state-owned bank, as well as through virtual assets like Bitcoins.
The Bitcoin address of the Tajik pro-ISKP network, monitored by ICSVE, sent suspicious transactions of $20,000 in November through a multi-currency wallet and crypto trading platform Total Coin, based in Berlin, Germany. In June 2022, pro-ISIS groups in Tajikistan raised around $2 million in Tether donations, leading to the arrest of senior IS financial facilitator Shamil Hukumatov in Turkey reflecting the widespread use of cryptocurrencies amongst these pro-IS networks.
Islamic State supporters have shown increasing interest in financially supporting IS with crypto donations. This trend is underscored by the recent case where Spanish police dismantled an IS supporter module that raised €200,000 worth of crypto for the terror group through international shipments tied to criminal activities in Europe. IS sympathizers on Rocket Chat discuss circumventing central exchanges like Coinbase to securely channel crypto donations for the terror group. Notably, some sympathizers have discussed the permissibility of using virtual cryptocurrencies under Sharia, with one endorsing Islamic coin—a cryptocurrency based on a profit-sharing model in line with Islamic law.
Similarly, Al-Qaeda sympathizers identified Zcash and Monero, the predominant players in the privacy coin space, as secure ways of transferring money. Along with the use of privacy-oriented tokens, mixing services like Tumblr that pool multiple crypto transactions together to cover the transaction tracks has become a preferred technique for terrorist groups prompting the US Treasury to categorize crypto mixers as a money laundering concern. US treasury’s FinCEN in October reiterated that mixing services have been employed by a “variety of illicit actors throughout the world,” referring to Hamas and Palestinian Islamic Jihad. Blockchain investigators have also unearthed the use of crypto mining by Al-Qaeda, Hamas, and IS for illicit financing and profitability. IS, in particular, has shared guides on crypto mining.
This study has elucidated how jihadist groups are adopting public-facing crowdfunding initiatives weaponizing social media and encrypted applications like Telegram to amass cryptocurrency funds and doing so globally, including in Western countries. Militant groups’ gradual embrace of decentralized crypto exchanges and DEfi protocols, with the use of crypto mining and privacy-oriented cryptocurrencies for enhanced operational security has allowed them to conceal the movement of their illicit funds. Beyond fundraising, there have been documented instances where terrorist groups are diversifying their sources of income through dark web market marketplaces, crypto investment scams, and extortion to evade sanctions and launder illicit funds. The conspicuously heightened adaptability and sophistication in the utilization of virtual assets by militant outfits present an enduring challenge for law enforcement in tracking and disrupting these terrorist-linked illicit financial networks. As militant jihadist groups persist in exploiting the intricacies of the crypto ecosystem, there is an urgent need for the systematic and vigilant monitoring of the IS and AQ-linked crowdfunding campaigns and other militant outfits to combat the intricate web of cryptocurrency-enabled terrorism financing, particularly while the conflicts and Israeli actions in Gaza and the West Bank prompt so many to donate to such militant groups.
