Five myths about cryptoterrorsim:
understanding trends and modus
operandi of terrorism financing through
cryptoassets
Cinco mitos sobre criptoterrorismo: entendendo tendências e o modus operandi do
nanciamento do terrorismo através de criptoativos
Cinco mitos sobre criptoterrorismo: entendiendo tendencias y modus operandi del
nanciamiento del terrorismo a través de criptoactivos
Jorge, M. Lasmar, PhD.
Rashmi Singh, PhD.
DOI: 10.5752/P.1809-6182.2024v21n1pX-X
ABSTRACT
is article debunks ve common myths about crypto terrorism, examining how terrorists
exploit digital assets. While the terrorist use of cryptocurrencies is limited and involves
small amounts, it extends beyond Bitcoin and leaves detectable traces. To address this
evolving threat eectively the misuse, not the assets, should be criminalized.
Keywords: Cryptocurrency; Crypto terrorism; Terrorism nancing
RESUMO
Este artigo desmistica cinco mitos comuns sobre o cripto terrorismo, examinando como
os terroristas exploram os ativos digitais. Embora o uso de criptomoedas por terroristas seja
limitado e envolva pequenas quantias, ele vai além do Bitcoin e deixa rastros detectáveis.
Para enfrentar essa ameaça em evolução de forma ecaz, deve-se criminalizar o uso
indevido, não os ativos em si.
Palavras-Chave: Criptomoeda; Cripto terrorismo; Financiamento do terrorismo
RESUMÉN
Este artículo desmiente cinco mitos comunes sobre el cripto terrorismo, examinando cómo
los terroristas explotan los activos digitales. Aunque el uso de criptomonedas por parte de
terroristas es limitado y abarca pequeñas cantidades, se extiende más allá de Bitcoin y deja
rastros detectables. Para abordar esta amenaza en evolución de manera efectiva, se debe
criminalizar el uso indebido, no los activos en sí.
Palabras clave: Criptomoneda; Cripto terrorismo; Financiamiento del terrorismo
Artigo
51 • Conjuntura Internacional • Belo Horizonte,
ISSN 1809-6182, v.21 n.1, p.51 - 68, abr. 2024
52 • Conjuntura Internacional • Belo Horizonte, ISSN 1809-6182, v.21 n.1, p.51 - 68, abr. 2024
Introduction
Cryptocurrencies are digital currencies,
i.e. a medium of exchange (used to acquire
goods or services) or a store of value, that use
cryptography (coded information) and block-
chain technology (a digital decentralized pu-
blic ledger) to conduct transactions through
a computer network. Unlike traditional cur-
rencies and assets, cryptocurrencies and other
crypto assets operate in a decentralized manner
and do not rely on central authorities such as
banks or governments. As a consequence, they
have been less subjected to control and regula-
tions although this is quickly changing.
However, in an era in which digital cur-
rencies are transforming global nance, the
complexities of terrorism nancing that relies
on crypto assets (crypto terrorism) presents
unprecedented challenges. While cryptocur-
rencies remain a technical and somewhat dis-
tant concept for many, recent advancements
in articial intelligence-powered blockchain
analysis have shed light on how terrorists ex-
ploit these digital assets. Despite this progress,
widespread misunderstandings and myths still
cloud public perception. By debunking these
misconceptions, we can better understand the
true trends and tactics of terrorism nancing
through cryptoassets. In this article, we explore
ve prevalent myths to gain a clearer unders-
tanding of how extremist groups utilize cryp-
tocurrencies, how their strategies are evolving,
and the implications for counterterrorism ef-
forts.
Myth 1: The Majority of
Terrorist Funding Comes from
Cryptoassets
Reality: Limited Adoption Compared
to Traditional Methods and
Cryptoassets Play a Minor Role
Terrorists and extremist groups use a wide
variety of methods to raise, move, and use funds
that usually mix licit and illicit sources. ese
methods employ varying degrees of professio-
nalism and complexity. Examples of terrorism
nancing from illicit sources include crimes
such as online and oine fraud, kidnapping,
extorsion, tax evasion, contraband, theft, and
the misuse of NGOs. Legal sources include
donations, self-nancing, and even the use of
licit companies (LASMAR, 2019). e use of
both legal and illegal sources as well as the si-
multaneous employment of dierent nancing
techniques is one of the dening characteristics
of terrorism nancing (FATF 2015). To avoid
disruption, diversity is key. Terrorist groups
make sure to employ several dierent mecha-
nisms to increase their chances of passing un-
noticed by the authorities and decrease the im-
pact of any disruption to one or more of their
nancial activities.
In this context, terrorist groups have been
increasingly interested in using cryptoassets
to raise, transfer, and use funds. For exam-
ple, Da’esh (also known as the Islamic State)
and Al-Qaida aliates have been using cryp-
tocurrency in Syrian areas under the control
of Hay’at Tahrir al-Sham. We also know that
Da’esh aliates in Asia increasingly rely on
cryptocurrencies (CTED, 2024). However, this
is not a new phenomenon. e rst evidence
53 • Conjuntura Internacional • Belo Horizonte, ISSN 1809-6182, v.21 n.1, p.51 - 68, abr. 2024
of terrorist nancing through cryptocurrencies
was found in 2014 when American authorities
found a Dark Web site called “Fund e Is-
lamic State Anonymously”, which encouraged
Da’esh sympathizers to donate Bitcoin (the
rst widely-used cryptocurrency) to the group.
From 2015 onwards, Da’esh stepped up eorts
to receive Bitcoin donations, after which other
extremist groups started doing the same, as can
be seen in Annex I (Timeline of High Prole
TF rough Cryptoassets) below.
e timeline demonstrates that terrorist
groups are looking into cryptoassets as another
tool of terrorism nancing. However, despite
all the high-prole cases in the media, these
instances remain relatively rare and of low vo-
lume, especially when compared to the nan-
cing of terrorism through traditional methods.
To date, most terrorist nancing continues to
rely on traditional oine methods, both in ter-
ms of sources and means of transfer (Chaina-
nalysis, 2024). In fact, the use of cryptoassets
for nancing terrorism remains limited, even
when focusing solely on the illicit cryptoasset
ecosystem. Within the cryptoasset ecosystem,
only a small portion is misused for criminal ac-
tivities. e company Chainanalysis estimates
that the share of all crypto transaction volumes
associated with illicit activity in 2023 remained
at 0,34% of the total on-chain transaction vo-
lume (Chainanalysis, 2024, p. 6). Of these illi-
cit uses, only a small part is used for terrorism
nancing. at is not to say, of course, that the
threat should be ignored. Any nancing of ter-
rorism, no matter how small, has serious social,
political and humanitarian consequences and
should be prevented and countered. Neverthe-
less, it is important to understand that cryp-
toassets can be abused in the same way that the
traditional nancial system can be exploited
for nefarious activities. us, it is important to
criminalize the misuse of cryptoassets and not
the cryptoassets themselves.
Source: e authors
54 • Conjuntura Internacional • Belo Horizonte, ISSN 1809-6182, v.21 n.1, p.51 - 68, abr. 2024
Myth 2: Terrorist Groups
move millions of dollars in
cryptocurrencies
Reality: Terrorist-related
cryptocurrencies transactions
amounts remain relatively low
Information about underworld and cri-
minal activities is never precise. Owing to the
nature of illicit activities, reliable information
is scarce and rarely available. us, it is di-
cult to obtain accurate estimates of the illicit
ow volume. Most studies that quantify illicit
ows rely on seizure data to build their estima-
tes. However, while this information can give
us some idea of the magnitude of the problem,
often seizure data is unreliably recorded at the
source. Moreover, a focus on seizures ignores
illicit ows that have not been intercepted by
the authorities.
e same applies when estimating the cri-
minal use of cryptoassets. Recent developments
in articial intelligence (AI) and blockchain
analysis techniques have advanced signicantly,
providing us with more precise information
(more on this below) about these transactions.
However, all the information we have on how
terrorists operate blockchain-hosted assets de-
pends on rst identifying which crypto address
belongs to a real-life terrorist entity. Hence, the
analysis is made in retrospect and can change as
more attributions (i.e., the linking of a virtual
address with a physical person or entity) are
made. us, for example, the existing estima-
tes for terrorist use of cryptoassets in 2022 can
change in 2032 if new terrorist-linked addres-
ses come to light in future investigations.
With that in mind, over the past few years
we have developed a much more comprehensive
picture of how terrorists use cryptoassets. After
the 07 October 2023 Hamas attacks in Israel,
the media was inundated with news about how
cryptoassets were used to nance terrorism.
One report widely circulated in the news clai-
ming that terror groups raised over $130 mil-
lion in cryptos in the past few years (Nocera;
Livni, 2023). However, the blockchain analysis
company that provided the data used in this
study strongly contested this (Idem). Accor-
ding to the company, this gure represents the
total amount circulated in and out of specic
addresses that received or sent funds but not all
of these funds were linked to known terrorist
entities (Chainanalysis, 2023a). erefore, this
gure is not only a gross exaggeration but also
serves to incorrectly criminalize all these ad-
dresses. It is important to understand that not
all the money that goes in or out of a crypto
address is necessarily related to terrorism. is
is because crypto-terrorist assets move within
the crypto ecosystem, which includes both
legal and illegal transactions. Both legal and
illegal transactions make use of what are legi-
timate virtual asset service providers (VASPs)
such as centralized exchanges.1 Consequently,
not all the money that a legal exchange mo-
ves are necessarily linked to terrorism, even if a
terrorist group uses it at some point. Imagine
that a terrorist group uses a legitimate bank to
make a money transfer, as in the case of the
1 According to the FATF, VASPS are “any natural or legal
person […] [that] conducts one or more of the following
activities or operations for or on behalf of another natural
or legal person: i. Exchange between virtual assets and at
currencies (i.e. government issued currencies); ii. Exchange
between one or more forms of virtual assets; iii. Transfer of
virtual assets; and iv. Safekeeping and/or administration of
virtual assets or instruments enabling control over virtual
assets; v. Participation in and provision of nancial services
related to an issuers oer and/or sale of a virtual asset.
(FATF, 2021, p.22).
55 • Conjuntura Internacional • Belo Horizonte, ISSN 1809-6182, v.21 n.1, p.51 - 68, abr. 2024
9/11 bombers who transferred their remaining
funds (26,000 USD) back to a al Qaeda facili-
tator in the UAE in the days before the attacks.
is does not mean that all transactions made
by or through that particular bank are linked to
terrorism and/or terrorism nancing (NCoTA,
2004, p.3).
To date, terrorist groups have been using
cryptoassets for two dierent kinds of transac-
tions: funding campaigns and running their
organizational. Both these objectives often in-
volve moving funds across international bor-
ders. is distinction is relevant as funding
campaings have so far been marked by very few
individual contributions/donations which are
generally of relatively small amounts. On the
other hand, transfers for organizational main-
tenance tend to be characterized by larger tran-
sactional sums. In the timeline, it is interesting
to note that before 2020 there are practically
only transactions linked to funding campaigns.
However, this changes in the post-2020 period
and the timeline now shows transactions lin-
ked to both funding campaigns and organiza-
tional maintenance. It is not clear why this shift
occurred. However, it is clear that after 2020
terrorist groups started making use of crypto
assets for transborder transfers to avoid sanc-
tions and monitoring. In this case, transactions
were usually made by specialized nanciers
that moved money for more than one terrorist
organization. Further, these transactions ten-
ded to involve higher amounts. In these cases,
it is technically true that terrorist groups have
moved millions of dollars through cryptos. Ne-
vertheless, the numbers are still on the lower
end (around 2 million USD) and represent not
only a fraction of the total amount of terrorism
nancing when compared with traditional me-
thods, but also a miniscule percentage of the
illegal crypto asset ecosystem, which itself re-
presents a very small portion of the same.
Myth 3: The Majority of
Terrorist Crypto-Funding
comes from Bitcoin
Reality: Terrorists Know that not
all Cryptocurrencies are Equally
Vulnerable
Not all cryptocurrencies are created equal
in terms of privacy and security, and terrorists
are well aware of these dierences. Dierent
cryptocurrencies have been developed, with
dierent needs and characteristics in mind.
Below are a few examples of dierent crypto-
currencies:
Bitcoin: is was the rst widely spread
and most recognized cryptocurrency. Owing
to its widespread use, it has relatively high li-
quidity.
Ethereum: is is the second-largest cryp-
tocurrency. Its blockchain also functions as a
platform for decentralized applications (dApps)
and has the capacity to host smart contracts.
dApps are programs that run on a decentrali-
zed network as opposed to a single computer
or server. Consequently, they facilitate peer-
-to-peer transfers of funds which allows more
privacy. Smart contracts are also built on the
Ethereum blockchain and can be used as a me-
chanism to provide security for peer-to-peer
transfers in the absence of an intermediary.
Stablecoins: cryptocurrencies pegged to
other assets such as government issued (i.e.,
at) currencies, gold, or oil. Tether and USD
Coins are examples of stablecoins. ese coins
oer the stability of traditional currencies whi-
56 • Conjuntura Internacional • Belo Horizonte, ISSN 1809-6182, v.21 n.1, p.51 - 68, abr. 2024
le retaining the benets of digital assets.
Smaller and Emerging Cryptocurrencies:
ese are lesser-known emerging digital as-
sets. ese cryptocurrencies may oer lower
visibility and reduced scrutiny by authorities,
making them attractive for illicit activities. For
example, Avalanche (AVAX), Polkadot (DOT),
and Ripple (XRP).
Meme coins: cryptocurrences inspired by
internet memes, characters or trends. Although
they are often created as satires, some meme
coins, such as Dogecoin (DOGE), Shiba Inu
(SHIB), and Pepe (PEPE), have achieved sig-
nicant value.
Privacy Coins: privacy-oriented cryptocur-
rencies such as Monero (XMR), Zcash (ZEC),
and Dash (DASH). ese coins use advanced
cryptographic techniques to obfuscate transac-
tion details, making it extremely dicult for
authorities to trace the origins, destinations,
and amounts involved in transactions.
It is common to hear the term Alt Coins.
e term Alt Coins simply refers to any cryp-
tocurrency that is not Bitcoin. It encompasses
stablecoins, meme coins, privacy coins, and all
other cryptocurrencies. It is also important to
note that when one refers to crypto assets, the
expression includes not only crypto currencies
but also other digital assets. ese other digital
assets include crypto-related funds (investment
funds related to cryptocurrency or blockchain)
and crypto tokens. e expression ‘token’ is
used to refer to a digital asset that represents
ownership, a specic value, or a utility – like a
free-meal coupon or a cassino chip. Although
cryptocurrencies are technically tokens, as they
function as digital representations of a value
designed to facilitate transaction, the expres-
sion ‘token’ is usually employed to designate a
digital representation of an interest that is built
on an existing blockchain (i.e. is not intrinsic
to that blockchain). is contrasts with cryp-
tocurrencies which are intrinsic to their own
blockchain. us, digital tokens act as a digital
“key” to a service or ownership and can have
dierent functions. For instance, a utility token
provides access rights or enables the purchase
of specic products or services; a security token
proves ownership in real-world assets, and; a
non-fungible token or NFT registers ownership
over a non-fungible asset, that is, a unique di-
gital items such as pictures, videos, or songs)
(Sharma, 2024).
Understanding the dierences and nuan-
ces between dierent cryptocurrencies is very
important. On the one hand, this variety res-
ponds to dierent market demands; on the
other hand, criminals and terrorists also ex-
ploit these distinctions according to their par-
ticular needs. Dierent types of criminals have
dierent needs (Chainanalysis, 2024; TRM,
2023). White-collar criminals, for example,
exploit cryptoassets for money laundering. For
them, cryptoassets such as Bitcoins, Alt coins,
and NFTs that are very volatile are attractive
because their price variations can be used to
justify gains or losses. Criminals involved in
illicit commerce use cryptoassets to sell their
products, but do not seek to accumulate cryp-
tocurrency. Individuals involved in activities
such as bribery, corruption, espionage, and
even the nancing of terrorism use the cryp-
to ecosystem as a means to make illicit pay-
ments. ese actors tend to want to preserve
their gains and thus favor stablecoins. Rogue
states and sanctioned entities use cryptocur-
rencies to move money across jurisdictions
and evade sanctions. ey also favor the use of
stablecoins. Cybercriminals and cyber-enabled
criminals who commit fraud and scams, thefts,
57 • Conjuntura Internacional • Belo Horizonte, ISSN 1809-6182, v.21 n.1, p.51 - 68, abr. 2024
hacks, ransomware attacks, etc. still prefer to
use Bitcoin. While Bitcoin accounted for 97%
of the crypto-illicit volume in 2016, with the
evolution of other currencies Bitcoin use plum-
meted to less than 3% of the crypto-illicit volu-
me in 2022 (TRM, 2023, p. 4).
When discussing the nancing of terro-
rism, it is important to understand that ter-
rorist groups do not rely solely on Bitcoin.
Although Bitcoin is the most well-known
cryptocurrency, terrorist organizations employ
a range of cryptoassets for various reasons, le-
veraging the unique features of dierent digital
currencies to suit their needs. When extremist
groups started exploiting cryptocurrencies in
2016, attempts to nance terrorism through
cryptocurrencies were almost exclusively made
using Bitcoin. However, as other digital cur-
rencies evolved, preferences changed. For ins-
tance, there is currently a clear preference for
assets in the TRON blockchain. According to
the TRM, in 2022, there was a 240% year-
-on-year increase in the use of Tether (a stab-
lecoin), compared to a 78% rise in Bitcoin use
(TRM, 2023, p.14). Tether accounted for 92%
of all terrorism nancing cases involving cryp-
tocurrencies by 2022 (TRM, 2023, p.4). A few
other interesting cases not involving Bitcoins
include an extremist group in South Africa
who tried to raise funds by creating their own
cryptocurrency in 2021, and an NFT minted
on an NFT trading website bearing the Da’esh
emblem in 2022. Minting is the process whe-
reby a unique digital asset is created so that it
can be bought, sold and traded. e NFT was
minted by a supporter, who also minted two
other NFTs using Da’eshs emblems. While
there was no proof that NFTs were part of a
Da’esh nancing campaign, they demonstra-
ted the potential misuse of NFTs by terrorist
groups. (DoT, 2024, P.14).
Myth 4: Cryptoassets Are
Untraceable and Impossible to
Seize
Reality: Tracing and Seizure are
Possible
ere is a widespread myth that crypto-
currencies are anonymous. ey are not. Cryp-
tocurrencies are pseudonymous, rather than
anonymous. is is an important distinction.
Most cryptocurrency transactions are not di-
rectly linked to an individuals identity. Howev-
er, as most cryptocurrencies blockchains work
as public ledgers, they hold open information
on all transactions that have ever taken place
in that chain. us, by analyzing information
on the blockchain, it is possible to link certain
transactions to specic individuals or entities (a
process called, attribution). In a sense, certain
cryptocurrency operations are more traceable
than at transactions.
Blockchain analysis makes it possible to
identify the sources and destinations of funds,
verify digital wallets (i.e. an app or online ser-
vice that allows you store funds, make transac-
tions and track payment histories), and cluster
addresses that belong to the same individual
or entity. By following transactions to an ad-
dress controlled by a VASP or gatekeeper (i.e.,
those who connect the digital and real world)
that has carried out due diligence and veried
the identity of the owner/controller of a wallet
address, it is possible to attribute those trans-
actions to a specic individual. is is feasible
even when the terrorist uses private wallets or
de-centralized applications (i.e., autonomous
58 • Conjuntura Internacional • Belo Horizonte, ISSN 1809-6182, v.21 n.1, p.51 - 68, abr. 2024
software programs that run on a blockchain
using decentralized computing in peer-to-peer
transactions). If an o-chain investigation or
threat intelligence discovers a suspect’s crypto
address, for example, it becomes possible to
draw connections between o-chain and on-
chain data points, and trace all transactions
related to the suspect. is is possible when,
for instance, a known terrorist group posts a
crypto address soliciting donations online.
Blockchain analysis techniques have sig-
nicantly evolved over the past few years. When
blockchain analysis rst emerged in 2010, it
involved organizing raw blockchain data to
help retail investors look up their cryptocur-
rency transactions. ese raw data include in-
formation such as the timestamp of the trans-
action, the sending and receiving addresses,
and the amount of cryptocurrency transferred.
However, the identities of those who own or
have control of the addresses are not public-
ly accessible. But, after the Mt. Gox hack in
20142, blockchain analytics tools have entered
the second generation. To overcome the limita-
tion of knowing who owns or controls address-
es, blockchain analysis has begun to combine
the raw blockchain data with other databases.
is information crossing allows blockchain
analysis instruments to link on-chain activities
to real-world entities. ese databases include
blacklists of sanctioned entities, criminal and
terrorist addresses, and other information that
allows law enforcement and nancial institu-
tions to detect known terrorists and trace the
sources and destinations of funds within spe-
cic cryptoassets. is signicantly advances
2 Mt. Gox was a Japanese exchange that handled over 70%
of all Bitcoin transactions in 2014. In April that year, the
exchanged was hacked and had about 850,000 Bitcoins
stolen leading to its bankruptcy.
attribution capacity by linking addresses to re-
al-world entities. With the advancement of ar-
ticial intelligence, the capacity to process vast
amounts of data and nd patterns has evolved
signicantly, and blockchain analysis has en-
tered a third generation (TRM 2024). us,
ownership analytics have evolved to map the
composition of an entitys addresses (i.e. iden-
tify all addresses linked to the same owner or
entity) and reveal nested relationships. It has
also become possible to analyze cross-chain
transactions and trace the source and destina-
tion of funds, even when an asset swaps across
dierent blockchains. However, one of the big-
gest advances was the capability to proactively
recognize transaction patterns that may indi-
cate illicit activities such as money laundering,
fraud, or even the nancing of terrorism. Ter-
rorist nance (and other crypto-related crimes)
usually operates in patterns that can become
signatures, and thus, a recognizable behavior
even if you do not know to whom the address
belongs (TRM 2024). A few examples of sig-
natures are (TRM 2024):
Common traits:
Funds are moved through a sequence of
transactions that share common traits, such as
amount, timing, or structure, and thus, seem
to be linked to the same entity.
Cross-chain swap:
A common technique among criminals
and terrorists is the transfer of an asset from
one blockchain to a dierent one to break their
direct trails.
Peel Chain
Cryptocurrencies from a single address are
fully dispersed in smaller amounts by successi-
ve transfers to other addresses.
Webow
Complex, web-like transactions that dis-
59 • Conjuntura Internacional • Belo Horizonte, ISSN 1809-6182, v.21 n.1, p.51 - 68, abr. 2024
perse funds through many nonlinear addresses
to then be collected again in another address.
is pattern is also known in network analysis
as “one to many” and “many to one” transac-
tions and are higly indicative of obfuscation
attempts.
Source: e authors from various sources
Consequently, crypto transactions are
highly traceable, representing a great oppor-
tunity for intelligence and law enforcement
agencies. Terrorists and criminals are aware of
this fact and employ other obfuscation tech-
niques to hide their transactions. In addition
to the techniques mentioned above, two other
techniques deserve attention: privacy coins and
mixers/tumblers.
Privacy coins are cryptocurrencies that
are designed to enhance the privacy of users
and transactions. Popular privacy coins inclu-
de Monero (XMR), Z-cash (ZEC), DASH
(DASH), 0x0.ai (0x0) and MimbleWimble
(MWC). Although each of these currencies
has dierent privacy features, with particular
appeals to dierent users, Monero is a good
example of how they operate. Monero uses
60 • Conjuntura Internacional • Belo Horizonte, ISSN 1809-6182, v.21 n.1, p.51 - 68, abr. 2024
‘ring signatures’ that group senders’ addresses
together, adopts methods to not publicly re-
veal the value of the transactions (known as
zero knowledge proof), and generates ‘stealth
addresses’ to receive funds and combine te-
chnology protocols to obscure IP addresses.
erefore, it is easy to understand why crimi-
nals are interested in private coins. Da’esh, for
example, launched a Monero Campaign. e
campaign titled” Jihad with Wealth” posted a
call for Monero donations: “Oh belivers! Shall,
I guide you to an exchange that will save you
from painful punishment? […] Please donate
with safe cryptocurrency Monero (XMR) for
waging jihad with wealth and nancing tho-
se who are waging the same with their lives.
(Daesh, s.d.).
However, as mentioned above, Tether re-
mains the main cryptocurrency of choice for
extremist groups. In fact, even among crimi-
nals, Monero and privacy coins are the cryp-
tocurrencies of choice for only very specic
criminals (TRM 2023). is is because privacy
coins increasingly have a liquidity problem as
many governments increase regulatory pressure
and move to criminalize their use. For instance,
privacy coins were banned in Japan and were
delisted from several major exchanges. Delis-
ting is relevant because exchanges are one of
the key mechanisms to transform crypto assets
into cash (o-ramping). Additionally, recent
advances in blockchain analysis tools allow
transactions to be traced, even when done with
privacy cryptocurrencies.
Another common technique involves the
use of mixers and tumblers. ese services mix
coins from several dierent transactions, join
potentially identiable assets with unidentia-
ble assets, and then pool them into a destina-
tion address. ese services are not necessarily
illegal, but in many cases they are used by cri-
minals to obfuscate the origins of the funds.
Mixers and tumblers are popular among crimi-
nal and terrorist group nanciers. Western go-
vernments have historically fought o mixers
and tumblers involved in money laundering
through regulatory measures and enforcement
actions. For example, the United States has
engaged in both the sanctioning and criminal
prosecution of persons involved in providing
this service. Notable cases include the OFAC
sanctioning of Blender.io and Tornado Cash
in 2022, the designation of Simbad.io, and a
seizure of 46 million USD in Bitcoin from Chi-
pmixer in 2023. However, as a report points
out, sophisticated criminal actors can quickly
adapt and nd other obfuscation services when
one is shut down (Chain 2024, p. 31).
Another misconception is that block-
chains are immutable; thus, it is impossible to
seize or freeze cryptocurrencies. Technology
has also evolved greatly in this area. Initially,
authorities had to physically hold the crimi-
nal’s private keys and transfer seized funds to
government-held wallets. However, as crypto
markets become more regulated, governments
can demand that centralized exchanges freeze
sanctioned assets under their custody. is is
not a perfect solution because these regulations
still cannot eectively reach crypto ATMs,
dApps, over-the-counter tradings (OTCs), and
exchanges that do not follow strict anti money-
-laundering and counterir the nancing of ter-
rorism and proliferation (AML-CFTP) proce-
dures. However, centralized exchanges are still
the easiest way to convert crypto assets into
cash (o-ramping). is practicality explains
why centralized exchanges remain the preferred
destination for funds sent from illicit addresses
(Chananalysis, 2024, p.24). Additionally, with
61 • Conjuntura Internacional • Belo Horizonte, ISSN 1809-6182, v.21 n.1, p.51 - 68, abr. 2024
the creation of blockchains that support smart
contracts, it has become possible to have native
blacklisted addresses, to freeze, or even to burn
and re-issue cryptoassets running on the chain.
Some smart contract administrators, such as
Tether (USDT), even can freeze sanctioned
funds on external DeFi (i.e. decentralized -
nances) applications.3 is is relevant because
it means that it is technically possible to freeze
assets held in an external wallet. In fact, seve-
ral Ethereum addresses that were transactioned
via the Tornado Cash dApp (a USA sanctioned
mixer service) were frozen by Circle (a USD
Coin, USDC, issuer) (Coinmarketcap, 2023).
In another operation in October 2023, Tether
announced that it froze 32 crypto wallets con-
taining $873,118 USD linked to “terrorism
and warfare” in Israel and Ukraine (Howcroft;
Wilson, 2023).
Myth 5: Terrorists are
technophobes – crypto assets
do not appeal to them.
Reality: Terrorist groups are
extremely tech savvy.
In some cases, the very idea of crypto cur-
rencies appeals to extremist ideologies. is is
the case with violent extremism due to xeno-
phobia, racism, and other forms of intolerance,
or in the name of religion or beliefs (XRIRB).
e idea of a de-centralized nancial system
3 Decentralized nance (DeFi) is an emerging nancial tech-
nology that oers services without relying on intermediaries
such as brokerages, exchanges, or banks. It functions in a
peer-to-peer manner by using smart contracts on a block-
chain. In 2023, Tether backlisted 704 contracts and froze
over $150 million USD, Acala froze 16 wallets containing
around $3 billion USD, and Circle froze criminal-related
Ethereum funds that interacted with Tornado Cash dApp
on external DeFi applications (PHILLIPS, 2023).
that functions independently of governments
is very appealing to extremist ideologies such
as Radical Anarchism, Anti-Government Ex-
tremist and Accelerationists, who question the
need for a government to exist in rst place.
Likewise, contrary to common beliefs,
terrorist groups tend to be tech-savvy. Extre-
mists have explored new technologies and their
vulnerabilities to advance their goals and objec-
tives since the invention of the dynamite, tele-
graph and railroads in the 1800s. ese groups
are usually quick to adopt new technologies
and adapt their modus operandi in response
to changes in their security environment. Here
are a few cases that illustrate this trend:
Hamas and the Use of
Cryptocurrencies
Hamas was one of the rst designated
terrorist organization to use cryptocurrencies.
In 2019, Hamass military wing, Izz-Al Din-Al
Qassam Brigades, launched campaigns to fund
its military activities using cryptocurrencies.
Hamas tested soliciting bitcoins via Telegram
and directly on its alqassam.net website. Sin-
ce then, we have seen rapid evolution and in-
creased sophistication in Hamass fundraising
campaigns via cryptocurrencies. We can clearly
identify three phases in Hamass cryptocurren-
cy fundraising sub-campaigns (Chainanalysis,
2020):
First Phase:
Initially, sites linked to Al Qassam Briga-
des began to publish donation requests, pro-
viding a QR code linked to a unique Bitcoin
address. However, because the address was lin-
ked to an exchange in the United States, US
authorities quickly froze accounts and investi-
gated the individuals involved.
62 • Conjuntura Internacional • Belo Horizonte, ISSN 1809-6182, v.21 n.1, p.51 - 68, abr. 2024
Second Phase:
From then on, Hamas began to publish
addresses linked to private wallets, not under
the custody of exchanges. However, authorities
still manage to map transactions using block-
chain analyses.
ird Phase:
Finally, the group became quite sophis-
ticated by incorporating wallets and payment
methods on their own sites. us, Hamas star-
ted to create a unique address for each donor
and diversify transactions with cryptocurren-
cies other than Bitcoin. In April 2023, the
group even recommended that its supporters
not donate Bitcoin to avoid being compromi-
sed and announced the end of their Bitcoin
donation campaign (Chainanalysis, 2023b).
In this phase, the group also experimented
with decentralized nances (DeFi), teaching its
donors how to create private wallets to make
donations. Detailed videos were also released,
teaching how to use money exchangers (e-Ha-
wala operators) to make transactions or how to
maintain anonymity through the use of public
Wi-Fi networks, recommended wallets, and
exchange lists.
Since then, the US has announced the
freezing of 150 crypto accounts linked to at
least three major global fundraising campaigns
by the Izz-Al Din-Al Qassam Brigades. ese
campaigns used sophisticated cyber-tools. Is-
raeli authorities have also closed dozens of cryp-
tocurrency addresses linked to Hamas with a
volume of tens of thousands of dollars. Seizures
have demonstrated increasing technical sophis-
tication by using various channels, chains, and
cryptocurrencies to avoid detection. Currently,
the group prefers to use payment channels on
their websites rather than to share cryptocur-
rency addresses.
Additionally, with the beginning of the
conict between Israel and Hamas in Octo-
ber 2023, GAZANOW, a group that actively
supports Hamas – requested donations to a
cryptocurrency address that received around
$5,000 USD. Since then, the group has star-
ted contacting its supporters through direct
messages on Instagram, which has interrupted
the campaign. Other campaigns like “Tofan
al-Aqsa” have been requesting donations via
X (formerly Twitter). us far, the campaigns
have obtained few resources. Israel announced
on October 10, 2023, the freezing of crypto-
currency accounts belonging to Hamas. e
US Treasury Department’s Oce of Foreign
Assets Control (OFAC) imposed sanctions on
ten members, agents, and nancial facilitators
of Hamas. e sanctions were also directed
at two Gaza-based money service businesses4
(MSBs), Buy Cash Money and Money Trans-
fer Company. According to OFAC, Buy Cash
has been used to transfer funds by aliates of
terrorist groups, including Hamas, Al-Qaeda,
and Da’esh, and to facilitate cryptocurrency
fundraising for Hamas (OFAC 2023).
Al-Qaeda in France
In 2019, the French Financial Intelligence
Unit (Tracn) uncovered a new complex ter-
rorism nancing scheme used by Al-Qaeda to
circumvent the traditional supervisory mecha-
nisms. Supporters of the group would anony-
mously buy prepaid vouchers for amounts un-
der €200, mainly in tobacco stores, and send
voucher information to combatants in warzo-
nes. Combatants than used the vouchers to buy
4 Businesses, including traditional banks but not only, that
provide services in transmitting, converting, or exchanging
money.
63 • Conjuntura Internacional • Belo Horizonte, ISSN 1809-6182, v.21 n.1, p.51 - 68, abr. 2024
cryptocurrencies on virtual exchange platfor-
ms. Subsequently, the money was transferred
through dierent Bitcoin address clusters to a
VASP in the warzone, which then converted
the cryptocurrency into cash. After the inves-
tigations, 63 donors and two facilitators were
arrested in France, and the related crypto-asset
wallet was seized.
Other Terrorist-Designated Groups
and Their Use of Cryptocurrencies
Other terrorist-designated groups have
also launched fundraising campaigns through
cryptocurrencies. In 2022, multiple entities
linked with the nancing of terrorism, inclu-
ding various cryptocurrency exchanges, started
experimenting with decentralized exchanges
(DEXs) which are peer-to-peer platforms whe-
re individuals trade cryptocurrencies directly
between themselves in a non-custodial way
(TRM, 2023, p.15). In June 2023, Israels Na-
tional Bureau for Counter Terror Financing
(NBCTF) froze $1.7 million worth of Hezbol-
lah-linked cryptocurrencies. e NBCTF tar-
geted over 40 USDT addresses on the TRON
network, connected to Hezbollah and associa-
ted with entities and exchanges in Iraq, Syria,
and the Gaza Strip. Typically, the funding
pattern of terror operations involves nancial
facilitators transferring funds to Hawala servi-
ces and OTC brokers, who then transfer the
funds to addresses controlled by Hezbollah
on various exchanges. ese facilitators often
provide services to multiple terrorist groups.
In Syria, for example, areas under Hay’at Tah-
rir al-Sham (HTS) control are consolidating
as hub for cryptocurrency where the exchan-
ges provide services to groups such as Da’esh,
Al-Qaida and its aliates (CTED 2024). e
same funding pattern has also been employed
by other organizations, such as the Palestinian
Islamic Jihad (PIJ) and Da’esh. Da’esh uses the
same pattern on on-going fundraising cam-
paigns for ISIS families in internment camps
in northeastern Syria. According to TRM Labs,
these campaigns ask for donations to impro-
ve the detainees’ conditions and have raised
varying amounts, from a few dollars to tens of
thousands (CTED 2024). Additionally, Da’esh
aliates and their supporters in South and
Central Asia have been increasingly using cryp-
tocurrency (idem). For example, the al-Azaim
Foundation for Media – a group aliated with
Da’esh in Afghanistan – held Bitcoin, Ethe-
reum and TRX (Tron) addresses that received
less than 1,000 USDT. Tajik Da’esh-aliated
groups also used cryptocurrencies to recruit
members and support Tajik families impriso-
ned in Syria (TRM 2022).
ese cases illustrate how the terrorist
use of cryptoassets groups has been evolving.
e growth in the use of Tether (USDT) and
other currencies such as Ethereum, Dogecoin,
Monero, and Zcash. e use of mixers and
cold wallets instead of veried accounts. e
increasing use of decentralized exchanges and
non-custodial peer-to-peer marketplaces as a
response to the increasing regulation of VASPs.
And the experiments with NFTs all demons-
trate how terrorist groups enhance their opera-
tional security as a response to the changes in
the crypto ecosystem.
Conclusion
e myths surrounding cryptoterrorism
signicantly cloud our understanding of how
digital currencies intersect with terrorist nan-
cing. While cryptocurrencies present unique
64 • Conjuntura Internacional • Belo Horizonte, ISSN 1809-6182, v.21 n.1, p.51 - 68, abr. 2024
challenges due to their pseudonymous nature
and the sophistication of privacy coins, the rea-
lity is that their use by terrorists is still relati-
vely limited compared to traditional nancing
methods. Understanding that most terrorist
funding does not originate from cryptoassets
is crucial. Despite high-prole cases, most ter-
rorist nancing relies on more conventional
methods. Similarly, while terrorists move funds
using cryptocurrencies, the amounts invol-
ved are typically smaller than reported and far
less than the sums moved through traditional
channels. In addition, it is important to recog-
nize that not all cryptocurrencies are equally
vulnerable to misuse. Although Bitcoin is of-
ten highlighted, other cryptocurrencies, parti-
cularly privacy coins and stablecoins, are also
used for their unique features. is diversity in
cryptoassets reects terrorists’ dierent needs
and tactics.
Advancements in blockchain analysis and
articial intelligence have signicantly enhan-
ced our ability to trace and seize illicit crypto
transactions. ese tools allow law enforcement
to link transactions to real-world identities and
to disrupt terrorist nancing networks. Howe-
ver, the race between obfuscation techniques
and analytical tools to counter these continues
and requires ongoing vigilance and innovation.
e notion that terrorists are technophobic is
both inaccurate outdated. Extremist groups are
adept at leveraging new technologies to achie-
ve their goal. e evolution of cryptocurrency
use, as demonstrated by groups such as Hamas,
underscores their capability to adapt and inno-
vate in response to counterterrorist measures.
In conclusion, while the threat of crypto-
terrorism should not be ignored, it is essential
to accurately contextualize its scale and scope.
Eective countermeasures involve a multi-fa-
ceted approach that combines regulation, in-
ternational cooperation, advanced technology,
and public-private partnerships. By dispelling
these myths, we can better focus our eorts on
realistic and impactful strategies to combat ter-
rorist nancing in the digital age.
65 • Conjuntura Internacional • Belo Horizonte, ISSN 1809-6182, v.21 n.1, p.51 - 68, abr. 2024
Annex I
66 • Conjuntura Internacional • Belo Horizonte, ISSN 1809-6182, v.21 n.1, p.51 - 68, abr. 2024
67 • Conjuntura Internacional • Belo Horizonte, ISSN 1809-6182, v.21 n.1, p.51 - 68, abr. 2024
68 • Conjuntura Internacional • Belo Horizonte, ISSN 1809-6182, v.21 n.1, p.51 - 68, abr. 2024
BIBLIOGRAPHY
CHAINANALYSIS. 2020. Terrorism Financing in Early Sta-
ges with Cryptocurrency But Advancing Quickly. Available at
https://www.chainalysis.com/blog/terrorism-nancing-cryp-
tocurrency-2019/ accessed 5/Aug/2024.
CHAINANALYSIS. 2023a. Correcting the Record: Inaccurate
Methodologies for Estimating Cryptocurrency’s Role in Terrorism
Financing. Available at https://www.chainalysis.com/blog/
cryptocurrency-terrorism-nancing-accuracy-check/ accessed
in 5/Aug/2024.
CHAINANALYSIS. 2023b. Hamas’ Al-Qassam Brigades An-
nounces End of Cryptocurrency Donation Eorts. Available at
https://www.chainalysis.com/blog/hamas-al-qassam-brigades-
-cryptocurrency-donations-shutdown/ accessed 5/Aug/2023.
CHAINANALYSIS 2024. e 2024 Crypto Crime Report: e
latest trends in ransomware, scams, hacking, and more. Chaina-
nalysis: S.l..
CTED 2024. CTED hosts Insight Brieng on “Latest trends in the
use of cryptocurrency by terrorist groups and their supporters”. Se-
curity Council Counter-Terrorism Committee, Counter-Ter-
rorism Committee Executive Directorate: New York. Available
at https://www.un.org/securitycouncil/ctc/news/cted-hosts-in-
sight-brieng-%E2%80%9Clatest-trends-use-cryptocurren-
cy-terrorist-groups-and-their accessed 5/Aug/2023.
DAESH. S.d. Jihad with Wealth. Voice of Khurasan. Islamic
State Khurasan Province: s.l..
DoT 2024. Illicit Finance Risk Assessment of Non-Fungible
Tokens. US Department of Treasure: Washington.
FATF. 2015. Emerging Terrorist Financing Risks. Financial
Action Task Force: Paris.
FATF. 2021. Updated Guidance for a Risk-Based Approach: Vir-
tual Assets and Virtual Asset Service Providers. Financial Action
Task Force: Paris.
HOWCROFT, E.; WILSON, T.. 2023. Tether Freezes Crypto
Linked To ‘Terrorism and Warfare’ in Israel and Ukraine. Re-
uters, October 17, 2023. Available at https://www.reuters.
com/technology/tether-freezes-873000-crypto-linked-terror-
ism-warfare-israel-ukraine-2023-10-16/#:~:text=Press%20
Releases-,Tether%20freezes%20crypto%20linked%20to%20
terrorism,warfare’%20in%20Israel%20and%20Ukraine&-
text=LONDON%2C%20Oct%2016%20(Reuters),the%20
company%20said%20on%20Monday Accessed 5/Aug/2024.
LASMAR, Jorge M. 2019. As Dinâmicas Financeiras do Ter-
rorismo in FAGUNDES, C.F.F.; LASMAR, J.M.; CHUY, J.
F. M. “Perspectivas do Terrorismo Contemporâneo”. Arraes:
Belo Horizonte.
NCoTA. 2024. e 9/11 Commission Report. e National
Commission on Terrorist Attacks: Washington.
NOCERA, Joe; LIVNI, Ephrat. 2023. Is Crypto Financing Ter-
rorism? In e New York Times, 28 October, 2023. Avaliable
at https://www.nytimes.com/2023/10/28/business/dealbook/
is-crypto-nancing-terrorism.html accessed 5/Aug/2024.
OFAC. 2023. Counter Terrorism Designations: Specially Desig-
nated National List Update, 10/18/2023. U.S. Department of
e Treasury, Oce of Foreign Assets Control: Washington.
Available at https://ofac.treasury.gov/recent-actions/20231018
accessed 5/Aug/2024.
PHILLIPS, Daniel. 2023. How can Cryptocurrencies be Frozen
on a Blockchain? Crypto Basics. Available at https://coinmar-
ketcap.com/academy/article/how-can-cryptocurrencies-be-
frozen-on-a-blockchain accessed in 5/Aug/2024.
SHARMA, Toshendra K. 2024. Security Tokens Vs. Utili-
ty Tokens: A Concise Guide. Blockchain Council. Available
at https://www.blockchain-council.org/blockchain/securi-
ty-tokens-vs-utility-tokens-a-concise-guide/ accessed in 5/
Aug/2024.
TRM. 2022. New Evidence Conrms ISIS Aliate in Af-
ghanistan Accepting Cryptocurrency Donations. TRM
Labs. Available at https://www.trmlabs.com/post/new-evi-
dence-conrms-isis-aliate-in-afghanistan-accepting-crypto-
currency-donations accessed in 5/Aug/2024.
TRM. 2023. Illicit Crypto Ecosystem Report. TRM Labs.
TRM. 2024. Detecting the Invisible: e Power of TRM Labs
Signatures™ in Blockchain Investigations. TRM Labs.