How terrorists use crypto: real cases and the example of Hamas

It is not only large companies and funds that are beginning to incorporate digital assets into their financial structures. Terrorist organizations are also starting to use cryptocurrencies. GetBlock AML Research reveals the schemes used by terrorists to collect donations in cryptocurrency and launder them for further use.

Example: Hamas

One investigation revealed that Hamas’ cyber division, known as the “Shadow Unit,” used Telegram to ask people to make donations to the organization’s military wing, the Al-Qassam Brigades. One post directly provided crypto wallet addresses, while another suggested writing to an email address for more details.

After the request was sent, instructions were sent to the email address. They stated:

“If you have no experience working with cryptocurrency, ask a friend for help or contact a money transfer office in your country that works with digital currencies. Only use the information in this message for the transfer. Do not reveal your identity to ensure your safety.”

A TRON network address was used for donations, specifying a transfer in USDT tokens. USDT is a stablecoin pegged to the US dollar. Unlike bitcoin or other coins, the price of stablecoins hardly changes, making them convenient for quick transfers.

Researchers also noticed that terrorists try to cover their tracks. The wallet addresses specified in the letters often work for only one transfer and then change. This makes it difficult to track the movement of funds. For example, one US Department of Justice document stated that 34 transfers totaling more than 25 000 USDT passed through one of these addresses in 10 days.

Moreover, the investigation noted that one of the addresses showed “behavior” characteristic of small exchange services or brokers that work with cash and cryptocurrency. This means that terrorists could use such companies to convert cryptocurrency back into cash.

Example: Lebanon

Small exchange services and private brokers in Lebanon have become part of such schemes. Cryptocurrencies are officially restricted in this country, and banks are required to report suspicious transactions involving them. But against the backdrop of economic crisis and inflation, many residents have begun to use cryptocurrency as a way to preserve their money. In a country where the economy is becoming increasingly “cash-based” and dollarized, small exchange points have begun to appear, often in the form of kiosks in cities.

It is precisely these services that terrorist organizations sometimes use. For example, an Israeli asset seizure order listed a wallet belonging to the owner of Cashout, an exchange linked to Lebanon. Its website (now defunct) offered to cash out money from various apps and receive cash directly.

The Cashout app, through which illegal transactions were carried out

In another case, investigators found the address of a wallet through which thousands of transactions had passed. It actively transferred funds to one of the major crypto exchanges, which also indicates the operation of a small exchange company. Moreover, this address was shown as a QR code in a photo taken at one of the Lebanese exchange services.

Such examples show that even if small brokers and exchangers are unaware of who they are helping, they can become a channel for financing terrorism. Therefore, the authorities need to introduce checks and controls for them.

Other schemes

Some intermediaries try not only to transfer donations to terrorists, but also to earn money from cryptocurrency fraud. For example, they participate in pump and dump schemes, where the price of a coin is artificially inflated and then crashes, leaving investors with losses.

There are other channels as well. For example, for several years now, there have been cases of cryptocurrency being used in the traditional hawala system, an informal money transfer network popular in the Middle East and Asia. There, payments are often made in stablecoins and then converted into cash. It is known that even refugee camps could receive donations through such schemes.

“Pig butchering”: another $47 million belonging to scammers has been frozen

A scheme for laundering criminal proceeds obtained by fraudsters through a sophisticated scam has been uncovered

Read more

What compliance specialists need to consider

• If the state prohibits cryptocurrency transactions, they go underground, where they are even more difficult to track.
• Small exchange services and brokers may not know that they are participating in terrorist financing, so they must be required to conduct checks and provide reports.
• Investigators need to be able to distinguish between legitimate and suspicious transactions so as not to waste resources.
• New technologies, such as the integration of cryptocurrencies with banking systems and cards, can increase the risks.

Thus, terrorist groups are increasingly using cryptocurrencies and exchange services for their operations. It is difficult to control this, but it is possible if the state closely monitors small businesses involved in transfers and cooperates with international partners.