TRM Labs reports growing evidence of crypto use, specifically Tether on the Tron network, by ISIS supporters in Asia.
The rise of cryptocurrency use by ISIS and its supporters across Asia became evident in recent reports by the United Nations and the US Treasury Department. Complementing these findings, TRM Labs has discovered an escalating amount of on-chain proof in the last year, indicating that pro-ISIS networks in countries such as Tajikistan, Indonesia, Pakistan, and Afghanistan, utilize cryptocurrencies for their operations. The primary transactions linked with these cases were executed using Tether (USDT) on the Tron network (TRX), a pattern TRM Labs increasingly notices in this area.
Evidence of Crypto Use by ISIS in Asia
Crypto Use by ISIS Supporters in Tajikistan
TRM Labs detected several pro-ISIS groups in Tajikistan who have adopted cryptocurrency, even to mobilize fighters to ally with ISIS’s affiliate in Afghanistan (ISKP). A notable fundraising campaign, active for over a year, managed an address that received roughly $2 million in USDT on Tron during 2022. Upon recognizing the campaign and tracking its blockchain funds, TRM Labs informed the exchange used by the group to withdraw some of their money. The exchange, leveraging its know-your-customer (KYC) controls, discovered the person managing the account and notified local authorities. This led to the arrest of Shamil Hukumatov, an alleged high-ranking ISIS fundraiser, by Turkish authorities on June 22, 2023.
ISIS Fundraising Activities in Indonesia
Someone transferred $517,000 in 2022 via an Indonesia-based exchange to addresses that TRM Labs associated with pro-ISIS fundraising campaigns in Syria. These campaigns professed to aid ISIS families trapped in Syrian camps. There were also regular transfers, typically around $10,000, made throughout the year using USDT on Tron. This usage of cryptocurrency by ISIS supporters gained international attention in May 2022 when the US Treasury Department’s Office of Foreign Asset Control (OFAC) imposed sanctions on five Indonesian nationals for enabling money transfers from Indonesia to ISIS members in Syria.
ISIS’s Crypto Operations in Pakistan
A media unit affiliated with the ISIS affiliate in Pakistan (ISPP) announced its ability to accept donations in late 2022. The group, formed in 2019, has been behind multiple attacks in Pakistan, primarily aimed at local security forces. Addresses associated with the group by TRM Labs recorded a total volume of around $40,000 over the last year. Following the earthquakes that struck Turkey and Syria in February 2023, an individual, not clearly associated with ISPP, published several cryptocurrency addresses on an ISIS messaging server, falsely claiming they would receive donations for earthquake survivors. However, TRM Labs had already marked these addresses as linked to ISPP.
Crypto Use in Afghanistan
The al-Azaim Foundation for Media Production, the media unit of the ISIS affiliate in Afghanistan (ISKP), allegedly engages in ISIS recruitment, particularly in South and Central Asia. The unit, one of the most active ISIS-linked media entities, creates content in multiple languages. TRM Labs discovered cryptocurrency addresses managed by al-Azaim in December 2022. Despite displaying less than $10,000 of activity, these addresses revealed the group’s use of cryptocurrency to finance its operations or receive funds from supporters. Moreover, there were on-chain connections between the addresses controlled by al-Azaim and the Pakistan-based group.
ISIS’s Links to Syria
The case studies across Asia share a common thread—on-chain connections to pro-ISIS fundraising campaigns in Syria. Syria remains a central hub of cryptocurrency use by ISIS and its supporters. Most of the donations go to ISIS families in camps like al-Hol and Roj, and the local cryptocurrency exchanges that facilitate these transactions. Mapping these campaigns, tracing blockchain donations, and identifying the donors is key to outlining and potentially disrupting global pro-ISIS networks.
The Changing Landscape of Crypto Crime
Cryptocurrency crime has evolved beyond Bitcoin. Back in 2016, Bitcoin was responsible for 97% of total illicit crypto volume. In 2022, it accounted for only 19%. Moreover, in 2016, two-thirds of crypto hack volume was on Bitcoin. This changed in 2022, with Bitcoin responsible for just under 3%, while Ethereum (68%) and Binance Smart Chain (19%) dominated the field. Bitcoin was the exclusive currency for terrorist financing in 2016, but by 2022, assets on the TRON blockchain largely replaced it, which accounted for 92%.
In 2022, an approximate amount of $9.04 billion was dispatched to various types of fraudulent schemes, with a large majority directed towards alleged Ponzi and/or pyramid schemes. Approximately $2 billion was lost in 2022 due to attacks on cross-chain bridges that allow cryptocurrencies to move from one blockchain to another. About $1.49 billion was spent on Darknet markets (DNMs) in 2022, with over 80% of the expenditure occurring on Russian-language DNMs.
These findings underscore a significant shift in illicit crypto activity. TRM Labs empowers everyone from law enforcement to compliance professionals to disrupt this new era of crypto crime. The transition away from Bitcoin blockchain onto other blockchains emphasizes the importance of mapping illicit financial flows on-chain. Investigators choose TRM because it allows them to follow the money and close cases, regardless of how sophisticated the attempt to obfuscate the flow of funds may be.
How Crypto Could Help Prevent Crime
Sensible regulation in the crypto landscape has been a key enabler in facilitating the tracking and surveillance of illicit activities. Through laws that require exchanges to implement know-your-customer (KYC) and anti-money laundering (AML) protocols, people can trace digital footprints back to individuals engaging in illegal activities.
These measures have significantly improved the transparency of transactions, making the crypto world safer and more secure. Unlike traditional cash transactions, which can be virtually untraceable, every cryptocurrency transaction is on a public ledger (blockchain), creating a trail that anyone can follow.
Therefore, while people did use cryptocurrencies for illegal activities in past, with robust regulation and oversight, they can become a safer and more accountable means of conducting transactions than cash.