How Hamas and terrorist groups use crypto donations

As Israel grapples with the aftermath of an attack orchestrated by Hamas, we look at the role of crypto in terrorism financing.

On Oct. 7, Palestinian militant group Hamas launched a devastating attack against Israel, killing at least 900 people and taking captive more than 130 others. The dawn incursion, aimed at several populated areas, including Tel Aviv and Ashkelon, caught Israeli security off guard as the country celebrated a religious holiday.

In response, Israel declared war against Hamas, hitting more than 1,000 targets in the tiny enclave of Gaza believed to be Hamas gathering places. 

According to the Gaza Health Ministry, at least 680 civilians have died due to Israel’s retaliatory actions.

Even as the battle rages on, many wonder how a criminal group like Hamas can access the funds required to plan and execute an attack of such scope and magnitude.

Previously, the Sunni Islamist militant group was known to accept cryptocurrency to fund their activities. Still, they discontinued this method in April 2023, citing increased threats to their donors and concerns for their safety.

Considering that the primary focus of counter-terrorism measures is to monitor money movement, how Saturday’s assault caught Israeli intelligence-gathering agencies completely unaware has led to speculation that Hamas may have gone back to channeling their funds through crypto.

Why did virtual currencies become so popular among malicious actors, and what measures can law enforcement authorities take to inhibit crypto transactions that could potentially aid attacks in the future?

Cryptocurrencies and anonymity

While governments have been relatively successful at tracking the movement of funds through traditional means such as bank accounts and cross-border payment processors, concerns have emerged over the increasing use of cryptocurrencies.

These systems are built around public ledgers known as blockchains, which are overseen by online peer-to-peer networks. Such networks track transactions and preserve a complete and validated record of them.

However, there is growing concern in the media that multiple terrorist groups may have untraceable, limitless sources of digital money, like Bitcoin (BTC), that could be used to subvert the achievements of anti-money laundering and terrorism funding regulations.

Policymakers also share this concern about potential terrorist use of digital currencies, especially in light of the recent emergence of numerous privacy-preserving cryptocurrencies like Monero (XMR), Zcash (ZEC), and Oasis Network (ROSE).

How private are crypto transactions?

Cryptocurrency facilitates direct peer-to-peer online transactions, suggesting that only the two parties involved need to know about a transaction. It bypasses the need for banks, governments, or any middlemen.

But despite seeming like an ideal model for privacy, the emergence of on-chain forensic platforms with tools for analyzing illegal crypto activity and the proliferation of blockchain detectives like ZachXBT, who routinely trace crypto transactions, demonstrate a different reality.

As Bitcoin and other digital currencies have gained popularity among mainstream investors, the notion of private transactions has become increasingly fragile. If these transactions can be traced, then cryptocurrencies can be more accurately considered pseudonymous than anonymous. 

It’s also worth noting that while cryptocurrencies do offer a degree of anonymity, no one can claim complete anonymity at this stage.

Can terrorists exploit crypto’s pseudonymous nature?

While the use of virtual currencies in cybercrime and money laundering is well documented, there’s still limited evidence to suggest they are used extensively for terrorism financing. It begs the question: Why aren’t terrorists using crypto as much as other illegal operatives?

A past report by the European Union’s Special Committee on Terrorism (TERR) suggested the answer is complex and multifaceted, much like the nature of terrorist organizations themselves.

According to the report, terrorist entities are not a homogenous group. They range from lone wolves, inspired but not necessarily linked to a central group, to small cells and facilitation networks to more organized entities like Al-Qaeda. Some even controlled territories, such as ISIS and Al-Shabaab.

Their financing methods are equally varied, encompassing fundraising through donations or crime, transferring money through banking systems or physically moving cash, and storing funds for future usage.

Given this broad spectrum, it’s crucial to understand how specific terrorist entities might exploit virtual currency for distinct objectives. 

For example, would crypto offer unique advantages to lone wolves or small cells as opposed to other funding avenues they currently use? Could crypto be a practical or necessary funding method for larger groups aiming to hold territory?

In TERR’s assessment, when considering lone wolves or small cells, the financial resources needed for an attack are typically minimal, and cryptocurrencies don’t necessarily offer these actors substantial advantages over conventional methods like cash, credit cards, or self-funding.

However, crypto could occasionally allure certain online lone actors and small cells.

For large-scale groups such as al-Qaeda, ISIS, and Hezbollah, crypto may not be necessary or beneficial for most operations. ISIS, for example, primarily financed its activities in Syria and Iraq through enforced taxation. 

Moreover, many cryptocurrencies’ inherent volatility and usability issues likely make them unreliable for transferring or storing funds in substantial volumes.

Nonetheless, while digital currencies may not be an ongoing resource, terrorist organizations might see them useful for sporadic international peer-to-peer transfers among group members or as a means to fund specific crowdfunding initiatives.

These fundraising efforts could be directed toward acquiring weapons, facilitating travel, conducting propaganda, or purchasing necessities.

A recent study by Elliptic, a blockchain analytics firm, revealed that crypto-based fundraising by leading terrorist organizations had gathered sums ranging from a few hundred dollars to over $1 million.

Per Elliptic’s data, ISIL, Al-Qaeda, and Hamas have collectively made upwards of $3 million via crypto fundraising drives. 

The firm’s research also identified a correlation between crypto use and geopolitical events. For instance, wallets associated with the Palestinian Islamic Jihad (PIJ) seem to coincide with periods of heightened conflict between Israel and militants in the West Bank and Gaza.

Evidence of crypto use in terrorism financing

Law enforcement authorities have raised alarms over the potential misuse of digital currencies by bad actors. They have noticed a trend where groups associated with terrorism advocate for crypto donations through their websites and associated social media accounts.

Additionally, they have stumbled upon online conversations among militants discussing the use of crypto for purchasing weapons and training their less tech-savvy compatriots in its use.

The case of Ali Shukri Amin

One of the earliest instances of individuals trying to provide material support to terrorists using crypto was the case of Ali Shukri Amin.

On Aug. 28, 2015, Amin, a then-17-year-old from Manassas, Virginia, received a lengthy sentence of 11 years coupled with a lifetime of supervised release and internet activity monitoring for his role in conspiring to support ISIL, a designated foreign terrorist organization.

Amin confessed to using social media to advise ISIL on obscuring its funding using Bitcoin. Through more than 7,000 posts, the teenager outlined strategies for ISIL supporters to use cryptocurrencies to send funds to the group.

In an article titled “Bitcoin wa’ Sadaqat al-Jihad” (Bitcoin and the Charity of Jihad), Amin detailed how Islamic militants could leverage Bitcoin to fund their activities.

He covered the basics of crypto and how to maintain anonymity while using them, particularly recommending Dark Wallet, a crypto wallet known for its robust privacy features.

Although Amin’s attempts to raise Bitcoin for ISIS proved unsuccessful, his case signified a potential threat from digitally-savvy youth comfortable using novel financial technologies.

Ibn Taymiyyah Media Center

Another example of jihadist networks experimenting with crypto was observed in 2016. The Ibn Taymiyyah Media Center (ITMC), affiliated with the Mujahideen Shura Council (MSC), started an online initiative dubbed “Jahezona” (“Equip Us” in Arabic), which introduced an option for Bitcoin donations and provided detailed directions on how to use the technology.

According to Chainalysis, ITMC actively promoted the initiative on diverse platforms such as Twitter (now X), YouTube, and Telegram, with a provision for donations to be made via Bitcoin to a specified address.

Despite only one Bitcoin address being initially made public, Chainalysis reportedly discovered an additional 27 addresses related to the campaign.

Initially, “Equip Us” only saw two transactions, amounting to about $540. However, by March 2018, the Bitcoin address had roughly $8,000 from more than 50 separate donations.

The average donation was around $164, with the largest single contribution slightly less than $2,500 and only two other entries exceeding $1,000.

While this may not seem substantial over two years, security analysts point out that acts of terror can be executed inexpensively using common materials, so any amount given to such groups has the potential for deadly consequences.

Hamas (Izz ad-Din al-Qassam Brigades)

In 2019, the military arm of Hamas, Izz ad-Din al-Qassam Brigades (AQB), initiated one of the most complex terrorism funding campaigns using Bitcoin. They adopted different wallet systems to manage contributions, finally implementing a technique that created a unique address for each donor—a first for any terrorist group.

Upon investigating AQB’s on-chain activities, Chainalysis divided the group’s transactions into three phases based on the wallet type used for donations.

The initial phase involved a single Bitcoin address linked to a US-based exchange. However, upon being discovered by law enforcement, AQB switched to a private wallet for increased anonymity.

In the final phase, the militant group integrated a more advanced wallet into their website, generating a unique Bitcoin address for each donor. They also provided detailed instructions on how to donate anonymously.

In its instructional video, AQB provided two ways donors could send Bitcoin. The first method involved using a hawala, a popular money transfer service in the Middle East. Donors could give their cash to a hawala, who would then convert and send the equivalent amount in Bitcoin to AQB using the provided donation address. 

The second method guided donors on how to create their own private wallets from which they could send their donations. The video even listed the recommended wallets and exchanges where Bitcoin can be obtained. 

AQB’s guidelines were comprehensive, even advising donors to use public wifi to create their private wallets to avoid revealing their IP addresses.

Despite the majority of donations being small, with a median value of just $24, a few significant contributors led to the campaign raising tens of thousands of dollars in Bitcoin. 

However, the group discontinued its crypto funding campaign in April 2023, citing increased threats to their donors and concerns for their safety.

Counter-terrorism measures

In August 2020, the U.S. Department of Justice (DOJ) announced several successes in disrupting crypto-enabled terrorism funding.