From Syria to Nigeria: how ISIS uses cryptocurrency, and where Bitcoin Xchange comes in

U.S. authorities have identified ISIS facilitators who were collecting cryptocurrency for the needs of the terrorist organization. GetBlock AML Research examines the structure of such groups and their methods of operation.

Key points:

• On June 22, OFAC (the U.S. Treasury's Office of Foreign Assets Control) added three individuals and six organizations to the sanctions list for facilitating ISIS financial operations, including Bitcoin Xchange — a Syrian money exchange and transfer company whose activity had been monitored since early 2022 as one of the principal cash-out channels for funds raised through ISIS crypto fundraising campaigns.
• Addresses linked to Bitcoin Xchange have a combined transaction volume (incoming and outgoing) of around $10 million and have taken part in hundreds of transactions tied to fundraising campaigns for ISIS.
• Syrian cryptocurrency exchangers and hawala operators have long been an integral part of fundraising schemes for ISIS. They act as a node where collected donations are accumulated and converted into cash for members of the organization, detainees, and their families held in the Al-Hol and Roj camps. They take a commission for their services.
• Particularly noteworthy is the fact that another Syrian exchange service was previously identified, allegedly linked to Bitcoin Xchange, which operates in Idlib and may have ties to operators based in Turkey.
• Also added to the sanctions list was Abdurrahman Miloud. OFAC's documents published two associated TRON network addresses, one of which interacted with fundraising campaigns linked to ISIS.

Bitcoin Xchange in Syria: how Abdelhakim Boukich built the infrastructure for ISIS

On June 22, OFAC imposed sanctions on three individuals and six organizations in Europe, the Middle East, and West Africa for facilitating ISIS financial flows. Among those on the sanctions list was Abdelhakim Boukich — a former Dutch citizen operating out of Syria — along with Bitcoin Xchange, the company he controlled and managed. The activities of Bitcoin Xchange and the wider ecosystem of cryptocurrency exchangers in the Idlib area have been under observation since early 2022.

Bitcoin Xchange is not an isolated player in this activity. It is part of a multi-layered financial infrastructure that ISIS-linked networks have relied on to sustain fundraising campaigns for their members, detainees, and families. Until recently, most of these people were held in displacement camps such as Al-Hol and Roj in northeastern Syria.

How terrorists use crypto: real cases and the example of Hamas

Terrorist organizations often use legal and semi-legal exchange services to launder cryptocurrency received from donations

Читать дальше

The ISIS funding scheme: how Telegram donations turn into cash at the Al-Hol and Roj camps

The scheme works in a fairly straightforward way: donors send cryptocurrency through fundraising campaigns spread on Telegram and other channels tied to ISIS and its supporters. Syrian exchangers and hawala operators receive these funds, convert them into cash, and deliver the money to the camps — typically keeping a commission of between 2% and 5%.

The Bitcoin Xchange crypto receipt scheme and its links to ISIS. Visualization: TRM Labs

What makes these networks particularly interesting to analysts is the way donation addresses are used. When the same address shows up across several seemingly unrelated campaigns — with different stated beneficiaries, different posting accounts, and different backstories — it almost always means that the address is controlled by a local exchanger or hawala operator, rather than by the specific organizer of the fundraising drive.

It is the exchanger that provides the financial infrastructure. The fundraising campaigns themselves are merely a layer on top of that infrastructure, serving as a channel for drawing in donations.

Are there “dirty” USDT? We take a detailed look at the issue

What is the status of USDT stablecoins involved in criminal activity? And how does Tether combat the illegal circulation of its coins? We explain in this article

Читать дальше

Monitoring of this exchanger layer began back in early 2022, when analysis of blockchain data revealed its role in enabling the cryptocurrency operations of ISIS-linked campaigns in Syria. Bitcoin Xchange was founded in late 2020 by Boukich and his Syrian partners. Over time, it began processing funds from donors in Norway, Belgium, the Netherlands, South Africa, and the United States, which then made their way to ISIS-linked individuals on the territory of Syria.

The new sanctions confirm what blockchain data has long pointed to: Syrian money transfer companies are the connecting link in ISIS's cryptocurrency financial system — the point where decentralized online fundraising campaigns are turned into real cash to be used in the displacement camps.

Nigerian bureaux de change and ISIS franchises in West Africa

The new sanctions stretch far beyond Syria. OFAC also added to the sanctions list Mukhtar Adamu Muhammad and three Nigerian currency exchange companies: Nine to Nine Exchange Bureau de Change, Manhattan Bureau de Change, and Generation Currency Bureau de Change, for facilitating financial transfers on behalf of ISIS in West Africa.

Several fundraising campaigns linked to ISIS and operating out of Nigeria have been identified, some of which also used the services of money transfer companies. This reflects the same structural trend described in the 2026 U.S. National Terrorist Financing Risk Assessment: sustained pressure from counter-terrorism operations has forced ISIS to lean ever more heavily on decentralized affiliates and regional units, with financial intermediaries providing the link between these structures — and increasingly turning to cryptocurrency to do so.

Why the Tron blockchain became infrastructure for the shadow crypto economy

“Pig butchering” scams rely on Tron thanks to near-zero fees and transaction speeds of about 3 seconds. This allows criminals to move stolen funds through dozens of wallets before the victim even realizes the money is gone

Читать дальше

The Abdurrahman Miloud case: how France is tied to ISIS finances

The inclusion on the sanctions list of Abdurrahman Miloud, a resident of France, adds another dimension to the story. Miloud carried out financial operations with ISIS-linked individuals in Syria, and also provided supporters of the organization with instructions and information on making explosives. The case is a reminder that financial support and operational facilitation in such networks are often closely intertwined.

Networks of exchangers like these leave traces in the blockchain data: in the addresses they reuse, in clusters of wallets, and in the characteristic transaction patterns that persist from one campaign to the next. The new sanctions are the result of years of blockchain data analysis and show what the technology offers for investigations: the movement of money can be tracked even when it passes through informal hawala networks, Syrian money transfer companies, and distributed crypto fundraising campaigns operating across several countries at once.

How compliance can identify addresses controlled by exchangers

In light of the new restrictions, compliance teams should revisit their workflows and conduct financial monitoring using the new data.

1. How are donation addresses controlled by exchangers identified?

The strongest indicator is the repeated use of the same address across multiple unrelated campaigns.

If the same address turns up in different campaigns with different stated beneficiaries, different posting accounts, and different backstories, then it is almost certainly controlled by a local exchanger or hawala operator rather than by the specific organizer of the fundraising drive.

The exchanger provides the underlying financial infrastructure, while the campaigns themselves are merely the mechanism for getting the word out and drawing in donations.

2. What obligations arise for financial institutions following the new OFAC sanctions?

All assets and property interests of individuals and organizations on the sanctions list that are located in the United States or controlled by U.S. citizens or companies must be blocked and reported to OFAC.

Transactions involving sanctioned persons are prohibited unless a specific license or exemption has been granted. In addition, financial institutions may face the risk of secondary sanctions if they knowingly carry out or facilitate significant transactions on behalf of sanctioned persons. Among other things, OFAC may restrict or fully prohibit their access to U.S. correspondent banking relationships.