Why Terrorist Groups Are Shifting From USDT to Monero — and What It Means for Compliance

U.S. authorities have uncovered the financial network of ISIS-K, one of the most technologically sophisticated branches of ISIS. The group was also identified as being behind the March 2024 Crocus City Hall attack in Moscow. GetBlock AML Research takes a closer look at the terrorist organization’s crypto infrastructure.

Key takeaways

• On July 1, 2026, the U.S. Treasury’s Office of Foreign Assets Control (OFAC) updated its Specially Designated Nationals (SDN) list to include 134 cryptocurrency addresses linked to the terrorist group Islamic State Khorasan Province (ISIS-K / ISKP). According to U.S. authorities, these wallets processed more than $2 million in total.
• For several years, ISIS-K actively used USDT to collect and move funds, with individual transfers typically ranging from $10 to $15,000. Since late 2023, the group has also openly solicited donations in Monero through its propaganda magazine Voice of Khurasan.
• Investigators have been monitoring ISIS-K’s crypto activity since at least 2022. Among other findings, they were able to trace funds connected to the March 2024 Moscow concert hall attack, which killed more than 125 people. Within hours of the attack, analysts identified transfers to a crypto wallet controlled by ISIS-K.
• Despite several successful law enforcement actions — including the 2025 arrest of Özgür Altun near the Afghanistan–Pakistan border, a figure believed to be central to the group’s financial and media operations — the fundraising system continued to operate. In fact, it appears to have become even more decentralized, spreading across multiple ISIS-K units.
• This is the second time OFAC has imposed sanctions specifically targeting ISIS-K’s crypto infrastructure. The first came in July 2023, when Maldivian national Ali Shafieu and a wallet tied to ISIS-K media operations were sanctioned.

The full list of blocked addresses is available on the OFAC SDN website.

Why new sanctions were introduced

On July 1, 2026, OFAC officially expanded its SDN sanctions list by adding 134 cryptocurrency addresses that, according to the agency, were used by ISIS-K to move more than $2 million.

This is not the first time U.S. authorities have focused on the group’s use of crypto. Back in July 2023, OFAC sanctioned Maldivian citizen Ali Shafieu along with a crypto wallet under his control. Shafieu worked in ISIS-K’s media division and served as the group’s representative for the Maldivian branch in coordination with ISIS-K leadership in Afghanistan. Transaction analysis later showed that his wallet was connected to other crypto addresses used by ISIS-K and ISIS media networks.

As the Afghanistan-based branch of ISIS, ISIS-K has become one of the most prominent terrorist organizations using cryptocurrency to finance its operations. Since at least 2022, analysts have tracked how the group and its supporters collected donations and moved funds on-chain — including activity linked to the financing of the 2024 Moscow attack.

Diagram of ISIS-K donation flows. Source: Chainalysis

A central role in the group’s media and fundraising efforts is played by the Al-Azaim Foundation for Media (AFM). This media arm publishes Voice of Khurasan in multiple languages, using it both to attract supporters worldwide and to solicit donations.

The shift toward privacy coins

In the fall of 2023, ISIS-K began openly asking supporters to donate in Monero, one of the most privacy-focused cryptocurrencies. Since then, such appeals have appeared regularly in Voice of Khurasan.

That said, USDT remained the group’s main financial tool. Blockchain data shows that most transfers still moved through the stablecoin, often in thousands of separate payments worth roughly $10,000 to $15,000 each. This structure allowed the organization to maintain a steady stream of funding through relatively small transfers that were less likely to attract attention.

Structure of ISIS-K transactions. Source: Chainalysis

Terror Attacks and Foiled Plots

ISIS-K did not use cryptocurrency solely to raise and move money — it also used it to finance terrorist operations.

One of the most prominent examples was the March 2024 attack on a concert hall in Moscow. Four Tajik nationals carried out the assault, killing more than 125 people. Within hours of the attack, investigators were able to trace funds from a cryptocurrency wallet used to finance the perpetrators to another wallet later identified as being under ISIS-K control.

Another case emerged in June 2024, when German authorities announced the arrest of a man holding German, Polish, and Moroccan citizenship. Among the charges against him was the transfer of nearly $1,700 in cryptocurrency to an address linked to ISIS-K.

From Syria to Nigeria: how ISIS uses cryptocurrency, and where Bitcoin Xchange comes in

The blockchain has helped uncover the ties between cryptocurrency fundraising campaigns, exchangers in Syria, and intermediaries in several countries around the world. A telltale pattern has emerged in which the same addresses were used across multiple donation drives at once

Читать дальше

According to investigators, the suspect had also attempted to secure employment during UEFA Euro 2024, which took place in Germany in June and July. In the months leading up to the tournament, ISIS-K had used its propaganda channels to urge supporters to carry out attacks on sporting events, including major football matches.

Operations to Disrupt the Network

In May–June 2025, a joint operation by Pakistani and Turkish law enforcement led to the arrest of Özgür Altun, also known as Abu Yasir al-Turki, near the Afghanistan–Pakistan border.

Investigators believe Altun coordinated a significant share of ISIS-K’s media operations and played a central role in organizing the group’s crypto financing network. Authorities say he was in possession of a substantial amount of digital assets at the time of his arrest.

His wife, Ayşe Altun, was also accused of using cryptocurrency to finance the families of ISIS fighters, including those located in Syria.

After Altun’s arrest, new operational security instructions for the group’s supporters began circulating online. Despite the loss of one of its key coordinators, the fundraising system did not collapse. Instead, there were growing signs that the financial infrastructure had become more decentralized and had started operating through multiple semi-independent ISIS-K units.

Another major blow to the group’s financial network came in 2023, when one of ISIS-K’s main financiers was arrested in Istanbul, Turkey.

A Small Victory in a Much Larger Fight

For several years, ISIS-K has remained one of the most technologically sophisticated terrorist organizations when it comes to using cryptocurrency.

How Mexico's Sinaloa cartel launders money through crypto. OFAC exposes the cash-out scheme

Around 97% of Chinese suppliers of chemicals used to make fentanyl accept payment in cryptocurrency. The volume of such transactions continues to grow alongside the global market for synthetic drugs

Читать дальше

OFAC’s sanctions expansion on July 1, 2026 highlights the scale of the financial network the group has built since 2022. The addition of 134 crypto addresses and the identification of more than $2 million flowing through them reflects years of activity: the use of USDT for transfers typically ranging from $10,000 to $15,000, the shift toward publicly soliciting donations in Monero through Voice of Khurasan, and the financing of operations including the 2024 Moscow concert hall attack.

Law enforcement actions to date — from the arrest of a key financier in Istanbul in 2023 to the detention of Özgür Altun near the Afghanistan–Pakistan border in 2025 — have succeeded in removing individual organizers and financial coordinators from the network. But they have not dismantled it entirely. On the contrary, the available evidence suggests that after each disruption, the structure became even more decentralized, with responsibilities distributed across multiple ISIS-K units.

The investigation tied to the arrest of a suspect in Germany ahead of Euro 2024, as well as the rapid tracing of funds after the Moscow attack, showed that blockchain analytics can allow investigators to respond almost as quickly as the criminal networks themselves.

The latest expansion of the sanctions list adds to the growing body of evidence showing how ISIS-K raises donations, moves funds, and attempts to conceal its financial activity through different cryptocurrencies and digital platforms. At the same time, the case underscores that despite the increasingly sophisticated financing methods used by terrorist groups, the transparency of most blockchains remains one of the most effective tools for identifying and disrupting such networks.