This month’s report covers new terrorism financing issues and cases, ranging from the Islamic State (ISIL), the identification of crypto-enabled networks in North America and Europe, and Iranian financial and procurement operations. We also report on Hamas’ ongoing financing schemes, ISWAP’s taxation practices in West Africa, and the increasing involvement of organized crime in terrorism financing across South America.

Explore the latest on global terrorism financing—and don’t miss our in-depth long-reads section!

Our terrorist financing analysis course caters to researchers, intelligence, law enforcement, and compliance professionals to help them learn about terrorist financing and analyze suspicious patterns and activities more effectively. Sign up today!

North America

North Carolina resident Alexander White was sentenced to eight years in prison for providing material support to ISIL. White circulated propaganda and fundraised for well-known ISIL affiliates, while also attempting multiple financial transactions to support terrorist camps and funnel money to ISIL members and supporters.

The US Treasury sanctioned three individuals and six entities in West Africa, Europe, and the Middle East for facilitating ISIL financial transfers. In Syria, Abdelhakim Boukich and his company were sanctioned for converting cryptocurrency donations into cash for ISIL. Mukhtar Adamu Muhammad and three of his businesses in West Africa were also designated by the Treasury for supporting ISIL financing and fund transfers. The last sanctioned individual, France-based Miloud Abderrahmane, facilitated transactions with ISIL affiliates in Syria and provided guides and manufacturing instructions.

The US Treasury Department sanctioned nine individuals and entities tied to weapons procurement networks supporting Iran’s Islamic Revolutionary Guard Corps (IRGC) and Ministry of Defence and Armed Forces Logistics (MODAFL), including China- and Hong Kong-based facilitators and a Hong Kong company involved in clandestine banking.

Read more

June brought a fast-moving mix of live conversations, research coverage, policy developments, enforcement actions, and real-world security events across the illicit finance and counter-terrorism space.

Before we begin, let’s remember the terrorist attack of July 7th, 2005, in London, UK. Last year, we wrote a retrospective analysis on the financing of the attack. You can read that analyis here:

This month, as always, we published our latest Global Terrorist Financing Report, highlighting major developments from the past month.

Terrorist Financing Analysis

Become an expert on how terrorist groups move, store, and exploit funds. This bundle gives you access to the terrorist financing analysis course, plus a customizable analytic tool, relevant case studies, and other practical resources you need to detect, analyze, and disrupt illicit financing networks.

Join our community, tackle real-world exercises, and gain skills you won’t find anywhere else. Enroll now and take your expertise to the next level!

Articles

We kicked off the month with a live conversation between Jessica and Steven Reimer to discuss the No Money for Terror conference, her forthcoming book, and Steven’s fieldwork in Ghana. We then dug into a new Research Read on the effects of ransom payments on terrorist activity in West Africa. Next, we broke down FATF’s latest plenary, where counter-terrorist financing remained front and centre alongside concerns about the use of mainstream digital platforms for illicit activity. We also looked at the Europol-led disruption of the AUDI A6 cryptocurrency laundering service and what it reveals about illicit crypto infrastructure, including a Canadian connection. Finally, we closed with an emergency Secure Line podcast on the Montréal incel attack, unpacking the attacker’s manifesto and the debate over how it has been interpreted in the aftermath.

Stay informed with our latest analyses — explore our newest articles below:

Share

That’s a wrap for June! We’ll be back soon with more news and analysis. Subscribe to stay up to date.

Subscribe now

© 2026 Insight Threat Intelligence Ltd. All Rights Reserved.

This newsletter and its contents are protected by Canadian copyright law. Except as otherwise provided for under Canadian copyright law, this newsletter and its contents may not be copied, published, distributed, downloaded or otherwise stored in a retrieval system, transmitted or converted, in any form or by any means, electronic or otherwise, without the prior written permission of the copyright owner.

The best part (IMO) was that I got to introduce my strategic actor selection model: a model I developed that helps explain when and why states use criminal actors to conduct covert action like state-sponsored assassinations, sabotage, and more. You can read more about it at the link below, and a full paper developing the ideas more thoroughly (with case studies!) will be out sometime soonish through SOC-ACE.

In the meantime, happy listening, and be sure to let me know what you think in the comments! And if you find this insightful, please share with a friend and help grow this community.

Share

© 2026 Insight Threat Intelligence Ltd. All Rights Reserved.

This newsletter and its contents are protected by Canadian copyright law. Except as otherwise provided for under Canadian copyright law, this newsletter and its contents may not be copied, published, distributed, downloaded or otherwise stored in a retrieval system, transmitted or converted, in any form or by any means, electronic or otherwise, without the prior written permission of the copyright owner.

Prior to the attack, the perpetrator released a 104-page manifesto. This has been the subject of intense media scrutiny.

My Secure Line co-hosts and I decided to record an emergency podcast reflecting on the attack’s significance, but more importantly, how people understood the manifesto. We were all dismayed by how quickly the incel-misogynistic motivation was downplayed for other themes.

To be clear, any manifesto is usually a grab bag of grievances, ideas, and issues. These ideas might converge or diverge, but it’s all intended to shape narratives around an attack, and this case is no different.

I invite you to listen to the podcast in its entirety, because this is a critical issue for understanding terrorism today.

I want to be very clear here, however, about how I see this attack and the manifesto:

Share

I also want to add that it’s dismaying that no public official has come out and called this what it is: an act of terrorism. There will obviously be no terrorism charges laid in this case (the perpetrator is dead); however, it would be useful for political leaders to actually lead in this space and name this for what it is.1

Finally, I want to add that this is the first terrorist attack in Canada in over two years. The last one was in Edmonton in 2024.2 However, there have been a number of terrorism disruptions (arrests, peace bonds, etc). We had a very good run of preventing terrorism in this country — in fact, this two-year period was the longest we have gone without a terrorist attack in Canada since 2011. This is something our law enforcement and security services should be proud of, even as they review the Montréal shooting to identify areas where it might have been disrupted.

Subscribe now

© 2026 Insight Threat Intelligence Ltd. All Rights Reserved.

This newsletter and its contents are protected by Canadian copyright law. Except as otherwise provided for under Canadian copyright law, this newsletter and its contents may not be copied, published, distributed, downloaded or otherwise stored in a retrieval system, transmitted or converted, in any form or by any means, electronic or otherwise, without the prior written permission of the copyright owner.

In 2025, ransomware gangs stole roughly US$ 820 million from cryptocurrency exchanges, and, unbelievably, this was actually a decrease from the year before. These funds were stolen by criminal gangs for profit, state-enabled gangs (like many that operate freely in Russia), and also by state actors like North Korea. These funds go to further other criminal activity, and in the case of North Korea, to help fund its intelligence services and ballistic missile and WMD program.

To make full use of these funds, ransomware actors have to launder the money they steal, essentially hiding the fact that it was the proceeds from a hack, exploit, or other cyberattack, and making it appear as though it came from legitimate sources.

These laundering services are significant illicit finance enablers. While some argue that there is a legitimate use case (and legitimate activity) happening on these services, the vast majority of laundered funds are from illicit sources like ransomware attacks.

One of these services is AUDIA6.

AUDIA6 is a cryptocurrency laundering service that processed more than €336 million for ransomware gangs, and has been linked to more than 15 international cybercrime investigations. In June 2026, EUROPOL announced that an international law enforcement operation dismantled this crypto laundering service. Two individuals were arrested, 25 domains were taken down, 30 servers were seized, and €692,000 in crypto was frozen and over €86,000 in crypto was seized.

AUDIA6 also operated Dark2Web, a cybercrime forum where users paid to commission crimes against specific targets.

AUDIA6 operated as a “mixer as a service”. As part of this operation, the service used over 6,000 KYC (“know your customer”)-verified accounts. These accounts were essentially money mules (individuals or accounts that knowingly or unknowingly move money on behalf of someone else), and were used to rapidly launder stolen digital assets through centralized cryptocurrency exchanges. These accounts were either stolen or purchased identities.

AUDIA6 charged a 3-10% commission on its services, and maintained connections to a variety of high-risk exchanges such as Bitzlato and Garantex.

The investigation and disruption of AUDIA6 was led by the US Secret Service, the IRS, and the Polish Police, with help from other EU member states and international partners, including the RCMP. The involvement of the RCMP raised some questions for me, so I asked them about it. Keep reading to find out what they had to say about their involvement in this operation:

Financial Intelligence Fundamentals

Do you want to learn more about financial intelligence and how to use it in research, investigations, and analysis? Our financial intelligence fundamentals course is for you! This course is perfect for people new to financial intelligence and seasoned professionals. Enroll today

Read more

Mutual Evaluations Adopted

FATF adopted the mutual evaluation reports of Canada and Türkiye during the plenary. While the reports have not yet been released publicly, publication is expected in September–October. While Canada will not be on the grey list, according to the Globe and Mail, Canada could face enhanced follow-up to address deficiencies/areas for improvement, where we will have to demonstrate effectiveness and outcomes relating to all our deficiencies (one of which is likely to be a lack of terrorist financing prosecutions).

Changes to the Grey List

Algeria and Namibia Removed

FATF removed both Algeria and Namibia from its list of jurisdictions under increased monitoring (the “grey list”). Algeria’s removal is the country’s third exit from the list. Algeria had most recently been grey-listed in October 2024. While FATF standards evolve, which can lead to states being grey-listed over and over again, Algeria’s repeated grey-listing raises questions about the effectiveness of FATF recommendations for encouraging AML/CFT measures, and whether the current timeframe for mutual evaluations is sufficient.

Namibia, meanwhile, had been under increased monitoring since February 2024.

The removals indicate that both jurisdictions have addressed the strategic deficiencies identified by FATF and completed the action plans agreed upon with the organization.

Iraq Added to the Grey List

Iraq was added to the grey list for the second time, having previously been listed in 2008.

Several of Iraq’s outstanding deficiencies relate directly to terrorist financing. FATF identified the need for Iraq to demonstrate more effective terrorist financing investigations and prosecutions, strengthen technical compliance related to its terrorist financing offence, and develop a more robust understanding of terrorist financing risks within the non-profit organization (NPO) sector.

Bosnia and Herzegovina Added to the Grey List

Bosnia and Herzegovina was also added to the grey list, marking its second appearance after previously being listed between 2016 and 2018.

Among other measures, FATF has called on Bosnia and Herzegovina to demonstrate a more proactive approach to terrorist financing investigations, clarify the interpretation and application of its terrorist financing offence, and strengthen the implementation of targeted financial sanctions related to terrorism and terrorist financing.

Our terrorist financing analysis course caters to researchers, intelligence, law enforcement, and compliance professionals to help them learn about terrorist financing, and analyze suspicious patterns and activities more effectively. Sign up today!

Looking Ahead: FATF Focus on Terrorist Financing in Digital Ecosystems

FATF also signalled continued attention to evolving terrorist financing methods online. The organization announced an upcoming publication examining terrorist financing activity conducted through social media platforms, instant messaging applications, and streaming services.

The project reflects growing concern that terrorist actors are increasingly leveraging mainstream digital platforms to solicit donations, facilitate financial transfers, advertise fundraising campaigns, and connect supporters with financial facilitators. While cryptocurrencies often receive significant attention in public discussions of terrorist financing, FATF’s focus underscores the continued importance of conventional online platforms in facilitating financial support networks.

Key Takeaway

The latest plenary reinforces a broader trend in FATF’s approach to counter-terrorist financing: effectiveness matters. The grey-listing of Iraq and Bosnia and Herzegovina reflects continued scrutiny of countries’ ability to investigate, prosecute, and disrupt terrorist financing in practice, while FATF’s forthcoming work on social media and messaging platforms highlights increasing concern with the digital environments where terrorist financing activity now occurs. In terms of terrorist financing, this focus on effectiveness and outcomes will be translated to national regulators, which in turn will require greater identification of terrorist financing activity in regulated sectors. Fintechs, banks, money service businesses, and more, will all be under increased pressure to better detect and report suspected terrorist financing activity.

Share

© 2026 Insight Threat Intelligence Ltd. All Rights Reserved.

This newsletter and its contents are protected by Canadian copyright law. Except as otherwise provided for under Canadian copyright law, this newsletter and its contents may not be copied, published, distributed, downloaded or otherwise stored in a retrieval system, transmitted or converted, in any form or by any means, electronic or otherwise, without the prior written permission of the copyright owner.

Kidnapping for ransom has increased dramatically in the Sahel in recent months. This has affected both foreigners and locals. It is one of the ways that terrorists raise money as part of their financing strategies. As such, it is critically important to understand if, and how, ransom payments contribute to terrorism. This might seem obvious, but I think it’s a lot more complicated than a straight causal relationship. Have a read of my summary of this research to understand more:

Article: Tim Lohse and Andreas Nyga, “How Much Bang for the Buck? Exploring the Effects of Ransom Payments on Terrorist Activity in West Africa,” Terrorism and Political Violence 0, no. 0 (2025): 1–22, https://doi.org/10.1080/09546553.2025.2565449.

How ransoms fuel terrorism

Ransom payments are believed to finance terrorism and advance the ideological objectives of terrorist groups. This is an oft-repeated claim that I have also interrogated, and there is ample evidence of research asserting this claim. What is less well studied, however, is the claim itself: do ransom payments actually lead to more terrorism? There is, it might surprise you to learn, very little evidence to support the claim.

The authors posit that ransom payments might influence short-term (90 days) operational behaviour, essentially financing operational activity. They find that, in two instances following ransom payments to JNIM, there was a short-term increase in the number or intensity of attacks. As they are right to note, their findings have limited generalizability due to the limited number of cases and the time period. The authors also note that it is difficult to control for alternative financing methods or unobservable shocks that can influence terrorist activity (confounding and intervening variables).

Methods

The article uses a difference-in-differences method to assess the short-term effects of ransom payments on terrorist attacks. The method compares changes over time between a group that is exposed to the intervention and a group that is not. The study uses event data (from ACLED) between 2017 and 2023, and compares attacks by ISGS and JNIM. This builds on the basic descriptive statistics that I employed with my co-author Alex Wilner in our study on kidnapping for ransom and terrorist attacks.

Why you should care

Anyone involved in kidnapping-for-ransom negotiations, policy responses, or counterterrorist financing will find this article interesting. Many states have policies that explicitly prohibit the payment of ransoms for individuals kidnapped by terrorist groups, under the assumption that these payments will lead to more terrorism. However, this is not a proven fact. Further, there are many states that pay ransoms, as well as private actors, which undermines the effectiveness of the policy. We need to know if the policy is evidence-based in order to determine how strictly it should be enforced/advocated for.

It is important to note that while the authors find some support for kidnapping for ransom payments leading to more terrorism, this is far from the last word. There is much more work to be done to actually establish this relationship and tease out nuances in the relationship that might suggest different policy approaches depending on circumstances. (I.e. there might be some instances where a ransom payment won’t lead to more terrorism. It would be helpful to know this as ransoms are being negotiated, and other hostage release options are being considered!)

Our terrorist financing analysis course caters to researchers, intelligence, law enforcement, and compliance professionals to help them learn about terrorist financing, and analyze suspicious patterns and activities more effectively. Sign up today!

The future of KFR research

There is much work to be done on this topic. In particular, similar methods could be employed across a greater number of cases (many terrorist groups use kidnapping for ransom to raise funds). Longer time periods should also be studied; both of these would improve the external validity of these findings. Additional methods should also be considered to control for other variables, such as exogenous fund infusions, territorial control changes (and corresponding taxation base increases or decreases), and likely many other variables. It would also be really useful to know if the payment size affects levels of terrorism.

Read along with:

Jessica Davis and Alex Wilner, “Paying Terrorist Ransoms: Frayed Consensus, Uneven Outcomes & Undue Harm,” International Journal, September 26, 2022, 00207020221130308, https://doi.org/10.1177/00207020221130308.

Anja Shortland, Kidnap: Inside the Ransom Business (Oxford University Press, 2019).

Did you find this article useful? Be sure to like, subscribe, and share!

Share

© 2026 Insight Threat Intelligence Ltd. All Rights Reserved.

This newsletter and its contents are protected by Canadian copyright law. Except as otherwise provided for under Canadian copyright law, this newsletter and its contents may not be copied, published, distributed, downloaded or otherwise stored in a retrieval system, transmitted or converted, in any form or by any means, electronic or otherwise, without the prior written permission of the copyright owner.

Thank you , , and many others for tuning into my live video with !

If you want to see more of this, let us know in the comments, with likes, email or social media.

Get more from Jessica Davis, PhD in the Substack app

Available for iOS and Android

Get the app

This past month brought continued developments across illicit finance and counter-terror finance policy, with a focus on attribution challenges and evolving policy frameworks.

In case you missed it…

Jessica Davis published an article for The Line on Canada’s proposed Financial Crimes Agency under Bill C-29 and its implications for financial crime enforcement.

The Secure Line podcast, released three new episodes, covering Canada’s proposed lawful access legislation and the debate over privacy, security, and constitutional rights, the federal government’s planned Financial Crimes Agency and it’s implications for financial crime enforcement, and national security-themed summer read recommendations. Catch up on the latest episodes here.

As always, we published our latest Global Terrorist Financing Report, highlighting major developments from the past month.

Terrorist Financing Analysis

Become an expert on how terrorist groups move, store, and exploit funds. This bundle gives you access to the terrorist financing analysis course, plus a customizable analytic tool, relevant case studies, and other practical resources you need to detect, analyze, and disrupt illicit financing networks.

Join our community, tackle real-world exercises, and gain skills you won’t find anywhere else. Enroll now and take your expertise to the next level!

Articles

We started the month by examining alleged activity linked to Harakat Ashab al-Yamin al-Islamiya (HAYI) and Kata’ib Hizballah (KH) activity, comparing attack patterns across Europe and Canada to evaluate claims of a Canadian connection, and exploring the financing and strategic drivers beyond these networks. We also published a commentary on the No Money for Terror (NMFT) conference, examining how its increasingly maximalist global objectives may set unrealistic expectations for counter-terror finance efforts.

Stay informed with our latest analyses — explore our newest articles below:

Share

That’s a wrap for May! See you next month with more analysis and updates. Be sure to subscribe so you don’t miss out! This is news and analysis you won’t find anywhere else.

Subscribe now

© 2026 Insight Threat Intelligence Ltd. All Rights Reserved.

This newsletter and its contents are protected by Canadian copyright law. Except as otherwise provided for under Canadian copyright law, this newsletter and its contents may not be copied, published, distributed, downloaded or otherwise stored in a retrieval system, transmitted or converted, in any form or by any means, electronic or otherwise, without the prior written permission of the copyright owner.

This month, we highlight a surge in global terrorism-financing enforcement and disruption: US sanctions on Iran-linked networks; crypto-based cases in Türkiye and India; Hamas-linked fundraising and transfer activity across Europe and North America; and cartel-connected money laundering through crypto and shell networks. We also feature long reads on Islamic State financing in Central Africa and data-driven approaches to strengthening transaction monitoring for AML/CFT.

Dive in, share with a colleague, and explore our long-read picks for deeper analysis.

Financial Intelligence Fundamentals

Do you want to learn more about financial intelligence and how to use it in research, investigations, and analysis? Our financial intelligence fundamentals course is for you! This course is perfect for people new to financial intelligence and seasoned professionals. Enroll today

Read more

But first: next week, my friend and colleague will go live on Substack to share our latest insights, research, and, of course, gripes, on terrorist and counterterrorism financing. It promises to be a lively discussion, as Stephen and I have much to catch up on. You can sign up here:

CTF LIVE!

The “No Money for Terror” conference (NMFT) was the brainchild of French President Emanuel Macron, and first took place in 2018. Since that time, there have been meetings in Australia in 2019, New Delhi in 2022, and Munich in 2025. After every conference, communiques and press releases are issued with varying degrees of lucidity. Inevitably, they call on states to implement the FATF recommendations fully, and sometimes call on the FATF to take specific actions.

This is not unusual, as this conference stems from the G7 process. These meetings tend to result in negotiated statements. That’s not to say that these processes are toothless. They set high-level policy objectives that get translated into FATF action, state legislation, and much more, over long periods of time.

That’s not my problem. My problem is the maximalist objectives the conference and related press releases invite.

The very title of the conference invites criticism: “no money for terror". Further, following this year’s conference, the FATF President said: "We need to work decisively, and collectively, to cut off the financial blood supply to terrorists."

These are impossible tasks and statements like this set up the entire CTF regime for failure.

Now, you might think that I’m nitpicking here, and perhaps I am. But these are the statements against which success is measured. If the policy outcome is “no money for terror” or “cut off the blood supply to terrorists”, this implies that anything less than total elimination of terrorist financing is a failure.

The larger problem, of course, is that the goals of counter terrorist financing have always been either really grandiose or ill-defined. This is something that my next book deals with in detail. Part of the problem starts with how we define counterterrorist financing. I address this at length in my Terrorism and Political Violence article, available here. I broadly define CTF as a combination of policies and tools that can be broadly grouped together according to these categories:

Taken together, these are all the tools and policies that constitute “CTF”. None of these, on their own, constitutes a CTF strategy. To have a good CTF strategy, these tools need to be selected and adapted according to specific threats, and more importantly, coordinated with international partners. (Terrorist financing is an international problem, not a domestic one, and it necessitates international cooperation.)

Critically, none of these tools will ever end terrorist financing. They will add friction. They will reduce the amount of money available for terrorism. But stop terrorist financing? I wish.

If we want to evaluate CTF outcomes, we have to evaluate each and every one of these tools and policies, determine whether, when, and how they ‘work’ (defining “work” is also important), and how they can be improved. But we should not measure them against an impossible yardstick.

Our terrorist financing analysis course caters to researchers, intelligence, law enforcement, and compliance professionals to help them learn about terrorist financing, and analyze suspicious patterns and activities more effectively. Sign up today!

Back to the Conference….

Anyway, back to the NMFT statement. The statement identifies three priority areas for counterterrorist financing efforts:

1. Misuse of financial innovations for terrorist financing: terrorists are using virtual assets and digital payments, and investigations involving these assets are difficult. Terrorist financing also uses crowdfunding and social media and messaging apps. The NMFT communique calls on states to enforce FATF standards, to address gaps in regulating stablecoins and unhosted wallets, and to enforce the travel rule.1

2. Territorial control: including the capture of state funds by terrorists, ransom payments, and transnational nodes and facilitation networks. This is increasingly a problem in Africa, and specifically in Mali, with the expansion of JNIM’s activities.

3. Terrorism and organized crime: noting how terrorists use crime to raise money, and that some organized crime groups meet the legal threshold for listing as terrorist entities, and that some terrorists are providing crime-as-a-service (a likely reference to the Com network).

I don’t have a problem with any of these priorities; they are, in fact, huge problems in the world of terrorist financing. This covers pretty much all the highlights and is a focused list to engage the FATF and international partners.

It’s all well and good until someone suggests that we stop the flow of funds to terrorists or give no money for terror.

Maybe we can just agree on “less money for terror”? And less terrorism in general? What do you think? Join our live to have your say next week.

Share

© 2026 Insight Threat Intelligence Ltd. All Rights Reserved.

This newsletter and its contents are protected by Canadian copyright law. Except as otherwise provided for under Canadian copyright law, this newsletter and its contents may not be copied, published, distributed, downloaded or otherwise stored in a retrieval system, transmitted or converted, in any form or by any means, electronic or otherwise, without the prior written permission of the copyright owner.

Last week, the FBI released a criminal complaint1 against an alleged commander for Kata’ib Hizballah (KH), an Iranian proxy group financed and directed by Iran’s Islamic Revolutionary Guards Corps (IRGC). The complaint argues that Mohammad Baqer Saad Dawood Al-Saadi is a KH commander and, as part of his work for the group, directed Harakat Ashab al-Yamin al-Islamiya (HAYI).

HAYI has claimed responsibility for nearly twenty attacks in Europe since the start of the Iran-US-Israel conflict. The group first emerged in March 2026 and sought to portray itself as a Europe-based group, independent from KH; however, imagery and social media posts strongly suggested that it was in fact an IRGC-linked entity. That is not to say that the group is a proxy; in fact, I think it’s critical to make a distinction here. Iranian proxies (Hamas, Hizballah, KH, and the Houthis) are financed and directed by Iran and the IRGC. This does not mean that these groups only follow Iranian direction — in fact, they operate with varying levels of autonomy and financial control. But they are well-established groups with hierarchies, membership, and financial structures.

On the other hand, HAYI currently appears to be more of a recruitment network. The network identifies individuals who will commit acts of violence, vandalism, and terror for pay. This pattern of activity is very similar to how Iran contracts state-sponsored assassinations. In some cases, Iran uses criminal organizations to carry out attacks in areas where it has limited operational reach and capabilities. HAYI’s breadth of activity, but low-level tactics against soft targets, suggests activity more commensurate with a criminal surrogate than a full-fledged terrorist proxy group.

To understand how Iran chooses the type of threat actor to deploy, and its implications for Canada (and the broader HAYI network), keep reading:

Read more

This month, we highlight a surge in global terrorism-financing actions: U.S. sanctions on Iran-linked networks, crypto cases in Indonesia and Iran, Hamas-linked fundraising in Europe and North America, and cartel-linked money laundering through casinos and hawala. We also feature long reads on Hizballah’s finances and the human rights impacts of asset-freezing regimes.

Dive in, share with a colleague, and explore our long-read picks for deeper analysis.

Read more

In part 1 of this series, we explained the Iran sanctions context and how Iran began widespread use of cryptocurrency in 2018, largely as a response to those sanctions. We highlighted Iran’s role in mining Bitcoin, which creates liquidity for the regime while also leveraging its oil surplus.

In part 2 of the series, we explored how Iran uses cryptocurrency to finance the Houthis (Ansarallah). We illuminated the various companies, exchanges, and individuals involved in Iran-Yemen crypto threat finance, highlighting the many jurisdictions this network spans.

«in part 3 of the series…»

Today, we’re looking at the role of Iran’s illicit crypto finance network in financing Hamas. Hamas is part of Iran’s Axis of Resistance and has been funded by the regime to the tune of $100 million per year. While much of this is provided to Hamas through cash couriers, hawala transfers, and trade-based financing mechanisms, some of it is provided through cryptocurrency transactions.

Hamas’s relationship with cryptocurrency is an interesting one. The group was an early adopter of cryptocurrency, soliciting donations on its public website almost a decade ago. Hamas has used cryptocurrencies such as Bitcoin and stablecoins to store and transfer funds, and has raised hundreds of thousands (if not millions) by soliciting cryptocurrency donations from its members and supporters worldwide. To conceal the origin and final destination of cryptocurrency transactions, the Qassam Brigades’ website offered instructions in multiple languages on creating Bitcoin wallets and making untraceable donations to Hamas. To further enhance anonymity, Hamas also generated unique transaction links for individual Bitcoin wallets on its website, avoiding cryptocurrency exchanges that are more susceptible to tracking by authorities.

Hamas has not had complete freedom to operate in the cryptocurrency market. In June 2021, Israel’s National Bureau for Counter-Terrorist Financing (NBCTF) seized multiple cryptocurrency wallets linked to a Hamas fundraising campaign, some associated with the Qassam Brigade. One of these wallets belonged to Buy Cash Money and Money Transfer Company, a Gaza-based business providing money transfer and virtual currency exchange services. Buy Cash facilitated fund transfers for not only Hamas but also affiliates of other terrorist groups, such as Al Qaeda and ISIS. However, this was not the end of Hamas’s use of cryptocurrency. While Iran has a number of different means to move money to Hamas, the IRGC has also used cryptocurrency to fund the group.

In April 2023, Israel’s NBCTF seized 189 cryptocurrency accounts that were associated with three Palestinian currency exchanges, including Gaza and Türkiye-based exchange Al-Markaziya Li-Siarafa, which Israel designated for its support for Hamas. This exchange, previously known by a different name (Al-Mutahadun for Exchange), is alleged to be directly involved in facilitating tens of millions of dollars from the IRGC-QF to Hamas and Palestinian Islamic Jihad (PIJ). Al-Markaziya is owned by Zuhair Shamlakh, a Gaza-based money changer. He is alleged to have used a network of exchanges that sent digital tokens to operators abroad to settle hawala balances, as well as to wallets controlled by Hamas-affiliated money exchanges. Around 2020, this method of transfer became a central part of Hamas’s operational financial activity.

Another known Hamas financing network is the Herzallah network. This network is centered on the Gaza-based Herzallah Exchange and General Trading Company LLC, which has worked with Hamas to facilitate transactions through cryptocurrencies and has laundered funds for Hamas and PIJ. The exchange is owned by Muhammad Fallah Kamil Hirzallah, Na’im Kamil Raghib Hirzallah, and Salah Kamil Raghib Hirzallah. While there are no publicly identified transactions from Iran moving through this exchange, this remains a possible avenue for Iranian crypto funding of Hamas.

Financial Intelligence Fundamentals

Do you want to learn more about financial intelligence and how to use it in research, investigations, and analysis? Our financial intelligence fundamentals course is for you! This course is perfect for people new to financial intelligence and seasoned professionals. Enroll today

The attribution of wallets and the transactions moving through them is complicated. In some cases, wallets are wholly attributed to the IRGC even when they are used by multiple entities. In one case, the NBCTF designated two hot wallets used by the IRGC. Even though other (non-IRGC) funds likely moved through those wallets, the entire set of wallets was designated by Israeli authorities. When this type of action is reported by the media, it can lead to exaggerated estimates of terrorist financing, as the nuances of wallet control and use are sometimes lost, and all funds that have flowed through those wallets are incorrectly “attributed” to the IRGC. In reality, these wallets often represent informal exchanges, over-the-counter brokers, or hawalas, meaning that they serve a diverse set of clients, not just Hamas or other terrorist groups. As such, describing all the transactions flowing through the wallets as “terror finance” is misleading.

While there is evidence of direct cryptocurrency transactions between Iran-linked wallets, facilitators, and Hamas, transactions appear to have largely passed through informal exchanges or hawaladars providing cash-out services, making the scale of this activity difficult to quantify. Historically, Iran’s support to Hamas has primarily moved through cash couriers into Gaza, as well as other types of transactions to deposit funds into the group’s wider financial networks abroad.

However, with recent disruptions to traditional supply routes, Iran could increasingly turn to cryptocurrency to facilitate transfers. The change in regime brought about by the Iran-US-Israel war has removed significant layers of older regime members; the newer, younger leaders are likely to more fully embrace cryptocurrency as a means of transferring funds to its proxies, including Hamas. At the same time, Israel’s focused targeting of financial facilitators in Gaza has likely constrained the effectiveness of any such efforts, leaving the future role of cryptocurrency in Hamas’s financing both fluid and uncertain.

Share

This research is part of my post-doctoral work funded by the University of Calgary’s Faculty of Law.

© 2026 Insight Threat Intelligence Ltd. All Rights Reserved.

This newsletter and its contents are protected by Canadian copyright law. Except as otherwise provided for under Canadian copyright law, this newsletter and its contents may not be copied, published, distributed, downloaded or otherwise stored in a retrieval system, transmitted or converted, in any form or by any means, electronic or otherwise, without the prior written permission of the copyright owner.

Read more

In part 1 of this series, we explained the context of the Iran sanctions and how Iran began widespread cryptocurrency use in 2018, largely as a response to those sanctions. We highlighted Iran’s role in mining Bitcoin, which creates liquidity for the regime while also leveraging its oil surplus.

In part 2 of the series, we explored how Iran uses cryptocurrency to finance the Houthis (Ansarallah). We illuminated the various companies, exchanges, and individuals involved in Iran-Yemen crypto threat finance, highlighting the many jurisdictions this network spans.

Today, we’re exploring Iran’s use of financial tradecraft and how the regime integrates that with cryptocurrency to hide the source and destination of funds. As the economic impacts of the Iran-Israel-US war become apparent, it is clear that Iran’s economy has been badly damaged. Further, the war has caused a significant break in relations with other Gulf countries, notably the UAE, where Iran enjoyed relatively good freedom of movement, and made extensive use of the money service business sector to move money through MSBs, hawalas, and into the semi-formal system. With the UAE’s crackdown on Iranians (and their money service businesses), this part of Iran’s threat finance ecosystem is under significant strain, likely leading to an even greater move towards cryptocurrency.

Indeed, Iran stated that its tolls in the Strait of Hormuz would be paid at least in part in cryptocurrency. Reports suggest that Iran is accepting either Bitcoin or USDT; each has their own advantages and disadvantages. In practice, Bitcoin is a likely good option for Iran because the regime has extensive experience with it. However, Bitcoin also fluctuates in price, making it difficult to price assets (or services, such as tolls) in it. On the other hand, USDT is more stable (pegged to the US dollar) but is centrally controlled and can be frozen.

Tracing these transactions, as well as Iran’s other crypto transactions, is possible. Cryptocurrency alone does not guarantee anonymity. For Iranian actors and their proxies like Hamas, Hizballaha and the Houthis, successfully evading sanctions requires sophisticated financial tradecraft to conceal the source, destination, and purpose of funds. These actors blend blockchain-based tools with traditional illicit finance techniques, exploiting weaknesses in global regulatory regimes.^[i]

Our terrorist financing analysis course caters to researchers, intelligence, law enforcement, and compliance professionals to help them learn about terrorist financing, and analyze suspicious patterns and activities more effectively. Sign up today!

Key elements of this tradecraft include:

• Mixers and privacy tools: After a major asset seizure, Hamas began routinely using crypto mixers—services that blend cryptocurrency to obscure transactions.^[ii] A cryptocurrency mixer is a service that obscures the origins and destinations of digital assets by pooling together multiple users’ coins and redistributing them in a way that breaks the transaction trail. Some common mixers include Tornado Cash (for Ethereum) and Wasabi wallet (specific to Bitcoin). They’ve also increasingly engaged with privacy coins like Monero, which are designed to resist tracing efforts.

• Cross-chain protocols and book transfers: These techniques move value across different blockchains or within exchanges, often via internal (off-chain) transfers, making transactions difficult to trace on public ledgers. Some common cross-chain protocols include THORChain, which allows swapping assets directly across different blockchains, and the Ren Protocol, which facilitates the transfer of Bitcoin, Zcash, and other assets into Ethereum. (Also called “cross-chain swaps”.)

• Use of shell and front companies: Entities labelled as “general trading companies” facilitate or camouflage transactions, especially in trade-based money laundering (TBML) schemes. These companies act as intermediaries or conduits for moving value tied to illicit networks.

• Jurisdictional arbitrage: High-risk exchanges in Russia, China, Türkiye, and other permissive jurisdictions are regularly used for obfuscation, especially those with tiered KYC policies allowing significant transfers without identification.

• OTC brokers: These brokers, often regionally based, facilitate the off-ramping of cryptocurrency into state-issued currency. They operate outside formal exchange infrastructure, creating additional layers of opacity. ^[iii]

Iran uses significant financial tradecraft to hide much of its activity on the blockchain. Newer tools, such as Russia’s Ruble-backed stablecoin A7A5 might increasingly play a role in these obfuscation techniques, although for the time being, there is no evidence to suggest that Iran has had to adopt newer (and sometimes riskier) techniques; the current tools that it uses appear sufficient to allow it to move money internationally and provide funds to its intended recipients, including terrorist groups.

In collecting tolls from the Strait of Hormuz, Iran is likely to use these (and possibly other) tools to hide the funds and protect them from freezing and seizure. Practically speaking, given the sophistication of Iran’s cryptocurrency operations, Iran has almost complete freedom of movement in this space, and working with other partners like Russia, will likely remain largely immune from efforts to disrupt their crypto operations.

Finally, US and Israeli strikes against Iranian regime members have killed a significant tranche of Iranian leadership. These were primarily older, more traditional regime members. The segment of the regime pushing cryptocurrency adoption has likely been empowered by these strikes, and will further push the Iranian regime into cryptocurrency adoption for threat (and regime) financing.

Share

This research is part of my post-doctoral work funded by the University of Calgary’s Faculty of Law.

^[i] Saiz, “Sanctions in the Virtual Asset Industry: SIFMANet Roundtable Report,” 3.

^[ii] Julia Shapero, “Hamas Money Laundering Worries Spark Proposed New U.S. Crypto Rule,” Text, The Hill (blog), October 19, 2023, https://thehill.com/business/4265344-hamas-money-laundering-worries-spark-new-u-s-crypto-rule/.

^[iii] Application for a warrant to seize property subject to forfeiture (US District Court for the District of Columbia March 27, 2025).

© 2026 Insight Threat Intelligence Ltd. All Rights Reserved.

This newsletter and its contents are protected by Canadian copyright law. Except as otherwise provided for under Canadian copyright law, this newsletter and its contents may not be copied, published, distributed, downloaded or otherwise stored in a retrieval system, transmitted or converted, in any form or by any means, electronic or otherwise, without the prior written permission of the copyright owner.

In this month’s report, we explore compelling stories from Canada, Europe, and the Middle East in the complex world of terrorism financing. Our coverage includes unregistered digital finance companies, the funding and growth of ISIL cells, and Hizballah’s evolving stockpiles and revenue streams.

Dive in, share your thoughts with a colleague, and be sure to check out our long-read recommendations for deeper insights!

Our terrorist financing analysis course caters to researchers, intelligence, law enforcement, and compliance professionals to help them learn about terrorist financing and analyze suspicious patterns and activities more effectively. Sign up today!

Read more

While the world of terrorist financing and emerging threats kept moving fast this month, we had a bit of a quieter month here taking some time to wrap up some fiscal year-end projects. We will be back in full force next month. Be sure to subscribe so you don’t miss out!

Before we dive in…

CASIS recently announced its 2026 essay contest. You can get all the details here.

The Secure Line podcast, was back this month with two new episodes. Highlights include discussion on recent policy and intelligence developments, and why protecting research and innovation has become a core national security priority. Catch up on the latest episodes here.

As always, we published our latest Global Terrorist Financing Report, highlighting major developments from the past month.

Terrorist Financing Analysis

Become an expert on how terrorist groups move, store, and exploit funds. This bundle gives you access to the terrorist financing analysis course, plus a customizable analytic tool, relevant case studies, and other practical resources you need to detect, analyze, and disrupt illicit financing networks.

Join our community, tackle real-world exercises, and gain skills you won’t find anywhere else. Enroll now and take your expertise to the next level!

Articles

This month we did a deep dive into terrorist financial tradecraft, highlighting new data on how attacks are funded and the methods groups use to move and obscure money. We also released a commentary on Canadian terrorism trends, examining riding changes, shifting motivations, and the growing involvement of youth.

Stay informed with our latest analyses — explore our newest articles below:

Share

That’s a wrap for March! See you next month with more analysis and updates. Be sure to subscribe so you don’t miss out! This is news and analysis you won’t find anywhere else.

Subscribe now

© 2026 Insight Threat Intelligence Ltd. All Rights Reserved.

This newsletter and its contents are protected by Canadian copyright law. Except as otherwise provided for under Canadian copyright law, this newsletter and its contents may not be copied, published, distributed, downloaded or otherwise stored in a retrieval system, transmitted or converted, in any form or by any means, electronic or otherwise, without the prior written permission of the copyright owner.

It’s been quite the journey. What started with a few hardcore illicit finance nerds has grown to a community of over 8,000, with new subscribers every day. I’m always excited when someone else agrees to receive the newsletter or follows me on this platform, because I think we’re collectively one step closer to illicit finance being taken more seriously. And as regular readers of this newsletter know, countering the illicit finance threat is something I take very seriously.

This newsletter started as something I wanted to do to capture my thinking on illicit finance and security, share insights through something more enduring than the odd thread on Twitter (I refuse to use the new name because I think it’s dumb), and promote the courses and other activities that I do as part of Insight Threat Intelligence. It’s grown well beyond that and has actually become a revenue line for the business; it’s also become a source of some expenses, because I usually have at least one researcher working on the Global Terrorist Financing Report (our monthly roundup of terrorist financing news), as well as research for other newsletters.

When I first started out, I migrated old content from a blog I was running to help populate the back catalogue – a lot of that is still available on the site if you go way, way back. As with most Substackers, I started publishing free articles, but quickly added a paywall because, frankly, those news roundups are an annoying amount of work. Artificial intelligence has helped a bit, but we still need to check every story, verify details, and make sure it’s accurately represented, and I have yet to find an AI tool that does that to my satisfaction. All that to say: this newsletter remains labour-intensive, and I’m happy about that. The writing is the work.

Somewhere along the way, I started trying to write twice per week. That turned out to be too much — for both my readers and me. So now we focus on one article per week, and sometimes add a second if things are particularly newsy. I’m increasingly trying to take things slowly: reading, writing, and publishing with intention. In our information ecosystem, I think we can all use a bit of a break, and a focus on more signal, less noise.

Growth on this platform hasn’t been exponential for me. I feel like I’ve earned every one of my followers or subscribers; while Substack touts a network effect, I have yet to really experience it, and I haven’t had any posts go truly viral as I have elsewhere. But there’s something more organic and sustainable about this – I feel like every person is here because they want to be, not because they feel like they should be, or because the algorithm told them to be.

I think one of the things that I like the most about writing a regular newsletter is that it keeps the writing muscles sharp, even during long periods where I’m mostly researching, travelling, or giving talks, like right now, when over the period of three months I’m scheduled to be in three different countries and eight cities, some twice. It forces me to write, for better or for worse. Yes, this is pressure, but I also give myself grace, and if I really need to miss some weeks, that’s okay.

In recent years, I’ve experimented with publishing series. I’m not sure that these really work, but I like them because they give me a way to break up longer pieces of analysis and share them with readers, without overwhelming people with details, links, or forty-page documents. Feel free to let me know what you think about these series in the comments, by email, or however we communicate.

This platform itself isn’t without flaws. There are way too many Nazis on the platform, although I’d argue this is true of most social platforms these days. Substack also takes a pretty big cut of my profits, particularly compared to other platforms. Finally, Substack has started a Polymarket integration, which I think is criminal. (Note: it is not technically criminal now, but I’m willing to bet (haha) that it will become criminal within ten years when we see the full effects of the gaming and gambling epidemic. Maybe sooner, although policy change takes time.) This is all driven, of course, by Substack’s need to become profitable. It has no alternative viable path to profitability. Which, in my view, raises questions about the platform’s long-term viability.

To that end, I’ve migrated my content to a blog hosted on my website, which you can access at www.insightthreatintel.com. It has both a free and a paid section, and one of my wonderful team members maintains it, keeping it up to date with the latest news and analysis, pretty much at the same time as we release articles on Substack. This also gives some readers the chance to subscribe without supporting the Substack platform, which is an absolutely valid choice.

That’s not to say I’ll be disappearing from here anytime soon, but it is to say that I’m making plans (and maintaining newsletter lists!) so that if Substack disappears, I can still keep doing this work. Because that’s what matters, not the way it lands in your inbox.

Share

That’s enough reflection for one day. On to the good stuff. To celebrate my five years on this platform, I’m offering a huge discount for new subscribers: 50% off an annual membership. This is a rare sale (we almost never have them), and this is by far the largest discount I’ve ever given. It’ll be available for the full month of April, so if you want to take advantage, be sure to lock it in before the end of the month. And you know the drill: like, share, and subscribe to help us grow our community!

50% OFF!

© 2026 Insight Threat Intelligence Ltd. All Rights Reserved.

This newsletter and its contents are protected by Canadian copyright law. Except as otherwise provided for under Canadian copyright law, this newsletter and its contents may not be copied, published, distributed, downloaded or otherwise stored in a retrieval system, transmitted or converted, in any form or by any means, electronic or otherwise, without the prior written permission of the copyright owner.

We’ll be back with regular newsletters in April — we’re on a short hiatus as I wrap up some significant fiscal year-end projects, deliver some technical assistance, and generally just try to get caught up on life.

If you want something a little bit more hands-on, we also have a course based on the book, which you can access here:

Our terrorist financing analysis course caters to researchers, intelligence, law enforcement, and compliance professionals to help them learn about terrorist financing, and analyze suspicious patterns and activities more effectively. Sign up today!

Share

© 2026 Insight Threat Intelligence Ltd. All Rights Reserved.

This newsletter and its contents are protected by Canadian copyright law. Except as otherwise provided for under Canadian copyright law, this newsletter and its contents may not be copied, published, distributed, downloaded or otherwise stored in a retrieval system, transmitted or converted, in any form or by any means, electronic or otherwise, without the prior written permission of the copyright owner.