How Hamas and terrorist groups use crypto donations

As Israel grapples with the aftermath of an attack orchestrated by Hamas, we look at the role of crypto in terrorism financing.

On Oct. 7, Palestinian militant group Hamas launched a devastating attack against Israel, killing at least 900 people and taking captive more than 130 others. The dawn incursion, aimed at several populated areas, including Tel Aviv and Ashkelon, caught Israeli security off guard as the country celebrated a religious holiday.

In response, Israel declared war against Hamas, hitting more than 1,000 targets in the tiny enclave of Gaza believed to be Hamas gathering places.

According to the Gaza Health Ministry, at least 680 civilians have died due to Israel’s retaliatory actions.

Even as the battle rages on, many wonder how a criminal group like Hamas can access the funds required to plan and execute an attack of such scope and magnitude.

Previously, the Sunni Islamist militant group was known to accept cryptocurrency to fund their activities. Still, they discontinued this method in April 2023, citing increased threats to their donors and concerns for their safety.

Considering that the primary focus of counter-terrorism measures is to monitor money movement, how Saturday’s assault caught Israeli intelligence-gathering agencies completely unaware has led to speculation that Hamas may have gone back to channeling their funds through crypto.

Why did virtual currencies become so popular among malicious actors, and what measures can law enforcement authorities take to inhibit crypto transactions that could potentially aid attacks in the future?

Cryptocurrencies and anonymity

While governments have been relatively successful at tracking the movement of funds through traditional means such as bank accounts and cross-border payment processors, concerns have emerged over the increasing use of cryptocurrencies.

These systems are built around public ledgers known as blockchains, which are overseen by online peer-to-peer networks. Such networks track transactions and preserve a complete and validated record of them.

However, there is growing concern in the media that multiple terrorist groups may have untraceable, limitless sources of digital money, like Bitcoin (BTC), that could be used to subvert the achievements of anti-money laundering and terrorism funding regulations.

Policymakers also share this concern about potential terrorist use of digital currencies, especially in light of the recent emergence of numerous privacy-preserving cryptocurrencies like Monero (XMR), Zcash (ZEC), and Oasis Network (ROSE).

You might also like: Blockchain forensics: How authorities track crypto transactions

How private are crypto transactions?

Cryptocurrency facilitates direct peer-to-peer online transactions, suggesting that only the two parties involved need to know about a transaction. It bypasses the need for banks, governments, or any middlemen.

But despite seeming like an ideal model for privacy, the emergence of on-chain forensic platforms with tools for analyzing illegal crypto activity and the proliferation of blockchain detectives like ZachXBT, who routinely trace crypto transactions, demonstrate a different reality.

As Bitcoin and other digital currencies have gained popularity among mainstream investors, the notion of private transactions has become increasingly fragile. If these transactions can be traced, then cryptocurrencies can be more accurately considered pseudonymous than anonymous.

It’s also worth noting that while cryptocurrencies do offer a degree of anonymity, no one can claim complete anonymity at this stage.

Can terrorists exploit crypto’s pseudonymous nature?

While the use of virtual currencies in cybercrime and money laundering is well documented, there’s still limited evidence to suggest they are used extensively for terrorism financing. It begs the question: Why aren’t terrorists using crypto as much as other illegal operatives?

A past report by the European Union’s Special Committee on Terrorism (TERR) suggested the answer is complex and multifaceted, much like the nature of terrorist organizations themselves.

According to the report, terrorist entities are not a homogenous group. They range from lone wolves, inspired but not necessarily linked to a central group, to small cells and facilitation networks to more organized entities like Al-Qaeda. Some even controlled territories, such as ISIS and Al-Shabaab.

Their financing methods are equally varied, encompassing fundraising through donations or crime, transferring money through banking systems or physically moving cash, and storing funds for future usage.

Given this broad spectrum, it’s crucial to understand how specific terrorist entities might exploit virtual currency for distinct objectives.

For example, would crypto offer unique advantages to lone wolves or small cells as opposed to other funding avenues they currently use? Could crypto be a practical or necessary funding method for larger groups aiming to hold territory?

In TERR’s assessment, when considering lone wolves or small cells, the financial resources needed for an attack are typically minimal, and cryptocurrencies don’t necessarily offer these actors substantial advantages over conventional methods like cash, credit cards, or self-funding.

However, crypto could occasionally allure certain online lone actors and small cells.

For large-scale groups such as al-Qaeda, ISIS, and Hezbollah, crypto may not be necessary or beneficial for most operations. ISIS, for example, primarily financed its activities in Syria and Iraq through enforced taxation.

Moreover, many cryptocurrencies’ inherent volatility and usability issues likely make them unreliable for transferring or storing funds in substantial volumes.

Nonetheless, while digital currencies may not be an ongoing resource, terrorist organizations might see them useful for sporadic international peer-to-peer transfers among group members or as a means to fund specific crowdfunding initiatives.

These fundraising efforts could be directed toward acquiring weapons, facilitating travel, conducting propaganda, or purchasing necessities.

A recent study by Elliptic, a blockchain analytics firm, revealed that crypto-based fundraising by leading terrorist organizations had gathered sums ranging from a few hundred dollars to over $1 million.

Per Elliptic’s data, ISIL, Al-Qaeda, and Hamas have collectively made upwards of $3 million via crypto fundraising drives.

The firm’s research also identified a correlation between crypto use and geopolitical events. For instance, wallets associated with the Palestinian Islamic Jihad (PIJ) seem to coincide with periods of heightened conflict between Israel and militants in the West Bank and Gaza.

You might also like: Crypto might fluctuate due to Israel-Palestine war, analyst says

Evidence of crypto use in terrorism financing

Law enforcement authorities have raised alarms over the potential misuse of digital currencies by bad actors. They have noticed a trend where groups associated with terrorism advocate for crypto donations through their websites and associated social media accounts.

Additionally, they have stumbled upon online conversations among militants discussing the use of crypto for purchasing weapons and training their less tech-savvy compatriots in its use.

The case of Ali Shukri Amin

One of the earliest instances of individuals trying to provide material support to terrorists using crypto was the case of Ali Shukri Amin.

On Aug. 28, 2015, Amin, a then-17-year-old from Manassas, Virginia, received a lengthy sentence of 11 years coupled with a lifetime of supervised release and internet activity monitoring for his role in conspiring to support ISIL, a designated foreign terrorist organization.

Amin confessed to using social media to advise ISIL on obscuring its funding using Bitcoin. Through more than 7,000 posts, the teenager outlined strategies for ISIL supporters to use cryptocurrencies to send funds to the group.

In an article titled “Bitcoin wa’ Sadaqat al-Jihad” (Bitcoin and the Charity of Jihad), Amin detailed how Islamic militants could leverage Bitcoin to fund their activities.

He covered the basics of crypto and how to maintain anonymity while using them, particularly recommending Dark Wallet, a crypto wallet known for its robust privacy features.

Although Amin’s attempts to raise Bitcoin for ISIS proved unsuccessful, his case signified a potential threat from digitally-savvy youth comfortable using novel financial technologies.

Ibn Taymiyyah Media Center

Another example of jihadist networks experimenting with crypto was observed in 2016. The Ibn Taymiyyah Media Center (ITMC), affiliated with the Mujahideen Shura Council (MSC), started an online initiative dubbed “Jahezona” (“Equip Us” in Arabic), which introduced an option for Bitcoin donations and provided detailed directions on how to use the technology.

According to Chainalysis, ITMC actively promoted the initiative on diverse platforms such as Twitter (now X), YouTube, and Telegram, with a provision for donations to be made via Bitcoin to a specified address.

Despite only one Bitcoin address being initially made public, Chainalysis reportedly discovered an additional 27 addresses related to the campaign.

Initially, “Equip Us” only saw two transactions, amounting to about $540. However, by March 2018, the Bitcoin address had roughly $8,000 from more than 50 separate donations.

The average donation was around $164, with the largest single contribution slightly less than $2,500 and only two other entries exceeding $1,000.

While this may not seem substantial over two years, security analysts point out that acts of terror can be executed inexpensively using common materials, so any amount given to such groups has the potential for deadly consequences.

Hamas (Izz ad-Din al-Qassam Brigades)

In 2019, the military arm of Hamas, Izz ad-Din al-Qassam Brigades (AQB), initiated one of the most complex terrorism funding campaigns using Bitcoin. They adopted different wallet systems to manage contributions, finally implementing a technique that created a unique address for each donor—a first for any terrorist group.

Upon investigating AQB’s on-chain activities, Chainalysis divided the group’s transactions into three phases based on the wallet type used for donations.

The initial phase involved a single Bitcoin address linked to a US-based exchange. However, upon being discovered by law enforcement, AQB switched to a private wallet for increased anonymity.

In the final phase, the militant group integrated a more advanced wallet into their website, generating a unique Bitcoin address for each donor. They also provided detailed instructions on how to donate anonymously.

In its instructional video, AQB provided two ways donors could send Bitcoin. The first method involved using a hawala, a popular money transfer service in the Middle East. Donors could give their cash to a hawala, who would then convert and send the equivalent amount in Bitcoin to AQB using the provided donation address.

The second method guided donors on how to create their own private wallets from which they could send their donations. The video even listed the recommended wallets and exchanges where Bitcoin can be obtained.

AQB’s guidelines were comprehensive, even advising donors to use public wifi to create their private wallets to avoid revealing their IP addresses.

Despite the majority of donations being small, with a median value of just $24, a few significant contributors led to the campaign raising tens of thousands of dollars in Bitcoin.

However, the group discontinued its crypto funding campaign in April 2023, citing increased threats to their donors and concerns for their safety.

Counter-terrorism measures

In August 2020, the U.S. Department of Justice (DOJ) announced several successes in disrupting crypto-enabled terrorism funding.

The first action, involving Hamas’ Al-Qassam Brigades, saw the Internal Revenue Service (IRS), Homeland Security Investigations (HSI), and the Federal Bureau of Investigation (FBI) collaborate to track and seize 150 crypto accounts linked to the terror group.

Concurrently, search warrants were executed on US-based donors. Law enforcement seized and covertly operated the al-Qassam Brigades’ website infrastructure, tricking supporters into donating to US-controlled Bitcoin wallets.

Charges were also brought against two Turkish individuals, Mehmet Akti and Hüsamettin Karataş, for operating an unlicensed money-transmitting business and laundering money.

The second incident of crypto use in terrorist funding involved a plan orchestrated by al-Qaeda and its associated terrorist factions, primarily stationed in Syria. According to the DoJ, these terrorist groups set up a money laundering system, utilizing Telegram and various social media platforms to call for crypto donations to support their terrorist objectives.

They occasionally masked their true intent by posing as charitable organizations despite their open and direct appeal for funds to sponsor violent terrorist attacks. For instance, one such “charity” asked for donations to furnish terrorists in Syria with weapons.

Following investigations by HSI agents, more than 150 crypto addresses linked to Al-Qaeda were seized.

Earlier this year, Israel reported that it had intercepted 189 cryptocurrency accounts on Binance, suspecting them to be linked to Islamist militant groups, including Hamas.

These accounts were managed mainly by three Palestinian cryptocurrency exchanges, all classified as terror groups.

Before this operation, Israeli authorities had confiscated nearly $140,000 worth of crypto from 80 Binance accounts tied to these sanctioned exchanges.

The actions followed a mandate by a Tel Aviv court approving the seizure of terror-linked crypto wallets by Israeli law enforcement.

Further to such enforcement triumphs, governments are also actively tightening their anti-money laundering and terrorism funding legislation to account for loopholes created by virtual currencies.

For instance, the EU adopted “strategic priorities” and enacted an action plan to strengthen its money laundering and terrorism financing framework in May 2020.

The steps considered by the EU’s directive include enhancing clarity in the ownership of businesses and trusts, bolstering measures against high-risk foreign nations, confronting risks associated with prepaid cards and cryptocurrencies, improving collaboration among national financial intelligence units, and fostering better cooperation and information exchange between AML supervisors and the European Central Bank.

The use of crypto in the funding of Hamas’ latest attack on Israel is still a matter of speculation. However, previously documented instances and the constantly shifting nature of virtual assets mean that governments, intelligence agencies, regulators, and law enforcement need to stay vigilant and keep abreast of advancements in the industry, especially in the realm of so-called privacy coins, which bad actors may feel would offer added cover for their illicit fund drives.

Read more: Israel actively freezes crypto accounts belonging to Hamas