This month, we highlight a surge in global terrorism-financing actions: U.S. sanctions on Iran-linked networks, crypto cases in Indonesia and Iran, Hamas-linked fundraising in Europe and North America, and cartel-linked money laundering through casinos and hawala. We also feature long reads on Hizballah’s finances and the human rights impacts of asset-freezing regimes.

Dive in, share with a colleague, and explore our long-read picks for deeper analysis.

Read more

In part 1 of this series, we explained the Iran sanctions context and how Iran began widespread use of cryptocurrency in 2018, largely as a response to those sanctions. We highlighted Iran’s role in mining Bitcoin, which creates liquidity for the regime while also leveraging its oil surplus.

In part 2 of the series, we explored how Iran uses cryptocurrency to finance the Houthis (Ansarallah). We illuminated the various companies, exchanges, and individuals involved in Iran-Yemen crypto threat finance, highlighting the many jurisdictions this network spans.

«in part 3 of the series…»

Today, we’re looking at the role of Iran’s illicit crypto finance network in financing Hamas. Hamas is part of Iran’s Axis of Resistance and has been funded by the regime to the tune of $100 million per year. While much of this is provided to Hamas through cash couriers, hawala transfers, and trade-based financing mechanisms, some of it is provided through cryptocurrency transactions.

Hamas’s relationship with cryptocurrency is an interesting one. The group was an early adopter of cryptocurrency, soliciting donations on its public website almost a decade ago. Hamas has used cryptocurrencies such as Bitcoin and stablecoins to store and transfer funds, and has raised hundreds of thousands (if not millions) by soliciting cryptocurrency donations from its members and supporters worldwide. To conceal the origin and final destination of cryptocurrency transactions, the Qassam Brigades’ website offered instructions in multiple languages on creating Bitcoin wallets and making untraceable donations to Hamas. To further enhance anonymity, Hamas also generated unique transaction links for individual Bitcoin wallets on its website, avoiding cryptocurrency exchanges that are more susceptible to tracking by authorities.

Hamas has not had complete freedom to operate in the cryptocurrency market. In June 2021, Israel’s National Bureau for Counter-Terrorist Financing (NBCTF) seized multiple cryptocurrency wallets linked to a Hamas fundraising campaign, some associated with the Qassam Brigade. One of these wallets belonged to Buy Cash Money and Money Transfer Company, a Gaza-based business providing money transfer and virtual currency exchange services. Buy Cash facilitated fund transfers for not only Hamas but also affiliates of other terrorist groups, such as Al Qaeda and ISIS. However, this was not the end of Hamas’s use of cryptocurrency. While Iran has a number of different means to move money to Hamas, the IRGC has also used cryptocurrency to fund the group.

In April 2023, Israel’s NBCTF seized 189 cryptocurrency accounts that were associated with three Palestinian currency exchanges, including Gaza and Türkiye-based exchange Al-Markaziya Li-Siarafa, which Israel designated for its support for Hamas. This exchange, previously known by a different name (Al-Mutahadun for Exchange), is alleged to be directly involved in facilitating tens of millions of dollars from the IRGC-QF to Hamas and Palestinian Islamic Jihad (PIJ). Al-Markaziya is owned by Zuhair Shamlakh, a Gaza-based money changer. He is alleged to have used a network of exchanges that sent digital tokens to operators abroad to settle hawala balances, as well as to wallets controlled by Hamas-affiliated money exchanges. Around 2020, this method of transfer became a central part of Hamas’s operational financial activity.

Another known Hamas financing network is the Herzallah network. This network is centered on the Gaza-based Herzallah Exchange and General Trading Company LLC, which has worked with Hamas to facilitate transactions through cryptocurrencies and has laundered funds for Hamas and PIJ. The exchange is owned by Muhammad Fallah Kamil Hirzallah, Na’im Kamil Raghib Hirzallah, and Salah Kamil Raghib Hirzallah. While there are no publicly identified transactions from Iran moving through this exchange, this remains a possible avenue for Iranian crypto funding of Hamas.

Financial Intelligence Fundamentals

Do you want to learn more about financial intelligence and how to use it in research, investigations, and analysis? Our financial intelligence fundamentals course is for you! This course is perfect for people new to financial intelligence and seasoned professionals. Enroll today

The attribution of wallets and the transactions moving through them is complicated. In some cases, wallets are wholly attributed to the IRGC even when they are used by multiple entities. In one case, the NBCTF designated two hot wallets used by the IRGC. Even though other (non-IRGC) funds likely moved through those wallets, the entire set of wallets was designated by Israeli authorities. When this type of action is reported by the media, it can lead to exaggerated estimates of terrorist financing, as the nuances of wallet control and use are sometimes lost, and all funds that have flowed through those wallets are incorrectly “attributed” to the IRGC. In reality, these wallets often represent informal exchanges, over-the-counter brokers, or hawalas, meaning that they serve a diverse set of clients, not just Hamas or other terrorist groups. As such, describing all the transactions flowing through the wallets as “terror finance” is misleading.

While there is evidence of direct cryptocurrency transactions between Iran-linked wallets, facilitators, and Hamas, transactions appear to have largely passed through informal exchanges or hawaladars providing cash-out services, making the scale of this activity difficult to quantify. Historically, Iran’s support to Hamas has primarily moved through cash couriers into Gaza, as well as other types of transactions to deposit funds into the group’s wider financial networks abroad.

However, with recent disruptions to traditional supply routes, Iran could increasingly turn to cryptocurrency to facilitate transfers. The change in regime brought about by the Iran-US-Israel war has removed significant layers of older regime members; the newer, younger leaders are likely to more fully embrace cryptocurrency as a means of transferring funds to its proxies, including Hamas. At the same time, Israel’s focused targeting of financial facilitators in Gaza has likely constrained the effectiveness of any such efforts, leaving the future role of cryptocurrency in Hamas’s financing both fluid and uncertain.

Share

This research is part of my post-doctoral work funded by the University of Calgary’s Faculty of Law.

© 2026 Insight Threat Intelligence Ltd. All Rights Reserved.

This newsletter and its contents are protected by Canadian copyright law. Except as otherwise provided for under Canadian copyright law, this newsletter and its contents may not be copied, published, distributed, downloaded or otherwise stored in a retrieval system, transmitted or converted, in any form or by any means, electronic or otherwise, without the prior written permission of the copyright owner.

Read more

In part 1 of this series, we explained the context of the Iran sanctions and how Iran began widespread cryptocurrency use in 2018, largely as a response to those sanctions. We highlighted Iran’s role in mining Bitcoin, which creates liquidity for the regime while also leveraging its oil surplus.

In part 2 of the series, we explored how Iran uses cryptocurrency to finance the Houthis (Ansarallah). We illuminated the various companies, exchanges, and individuals involved in Iran-Yemen crypto threat finance, highlighting the many jurisdictions this network spans.

Today, we’re exploring Iran’s use of financial tradecraft and how the regime integrates that with cryptocurrency to hide the source and destination of funds. As the economic impacts of the Iran-Israel-US war become apparent, it is clear that Iran’s economy has been badly damaged. Further, the war has caused a significant break in relations with other Gulf countries, notably the UAE, where Iran enjoyed relatively good freedom of movement, and made extensive use of the money service business sector to move money through MSBs, hawalas, and into the semi-formal system. With the UAE’s crackdown on Iranians (and their money service businesses), this part of Iran’s threat finance ecosystem is under significant strain, likely leading to an even greater move towards cryptocurrency.

Indeed, Iran stated that its tolls in the Strait of Hormuz would be paid at least in part in cryptocurrency. Reports suggest that Iran is accepting either Bitcoin or USDT; each has their own advantages and disadvantages. In practice, Bitcoin is a likely good option for Iran because the regime has extensive experience with it. However, Bitcoin also fluctuates in price, making it difficult to price assets (or services, such as tolls) in it. On the other hand, USDT is more stable (pegged to the US dollar) but is centrally controlled and can be frozen.

Tracing these transactions, as well as Iran’s other crypto transactions, is possible. Cryptocurrency alone does not guarantee anonymity. For Iranian actors and their proxies like Hamas, Hizballaha and the Houthis, successfully evading sanctions requires sophisticated financial tradecraft to conceal the source, destination, and purpose of funds. These actors blend blockchain-based tools with traditional illicit finance techniques, exploiting weaknesses in global regulatory regimes.^[i]

Our terrorist financing analysis course caters to researchers, intelligence, law enforcement, and compliance professionals to help them learn about terrorist financing, and analyze suspicious patterns and activities more effectively. Sign up today!

Key elements of this tradecraft include:

• Mixers and privacy tools: After a major asset seizure, Hamas began routinely using crypto mixers—services that blend cryptocurrency to obscure transactions.^[ii] A cryptocurrency mixer is a service that obscures the origins and destinations of digital assets by pooling together multiple users’ coins and redistributing them in a way that breaks the transaction trail. Some common mixers include Tornado Cash (for Ethereum) and Wasabi wallet (specific to Bitcoin). They’ve also increasingly engaged with privacy coins like Monero, which are designed to resist tracing efforts.

• Cross-chain protocols and book transfers: These techniques move value across different blockchains or within exchanges, often via internal (off-chain) transfers, making transactions difficult to trace on public ledgers. Some common cross-chain protocols include THORChain, which allows swapping assets directly across different blockchains, and the Ren Protocol, which facilitates the transfer of Bitcoin, Zcash, and other assets into Ethereum. (Also called “cross-chain swaps”.)

• Use of shell and front companies: Entities labelled as “general trading companies” facilitate or camouflage transactions, especially in trade-based money laundering (TBML) schemes. These companies act as intermediaries or conduits for moving value tied to illicit networks.

• Jurisdictional arbitrage: High-risk exchanges in Russia, China, Türkiye, and other permissive jurisdictions are regularly used for obfuscation, especially those with tiered KYC policies allowing significant transfers without identification.

• OTC brokers: These brokers, often regionally based, facilitate the off-ramping of cryptocurrency into state-issued currency. They operate outside formal exchange infrastructure, creating additional layers of opacity. ^[iii]

Iran uses significant financial tradecraft to hide much of its activity on the blockchain. Newer tools, such as Russia’s Ruble-backed stablecoin A7A5 might increasingly play a role in these obfuscation techniques, although for the time being, there is no evidence to suggest that Iran has had to adopt newer (and sometimes riskier) techniques; the current tools that it uses appear sufficient to allow it to move money internationally and provide funds to its intended recipients, including terrorist groups.

In collecting tolls from the Strait of Hormuz, Iran is likely to use these (and possibly other) tools to hide the funds and protect them from freezing and seizure. Practically speaking, given the sophistication of Iran’s cryptocurrency operations, Iran has almost complete freedom of movement in this space, and working with other partners like Russia, will likely remain largely immune from efforts to disrupt their crypto operations.

Finally, US and Israeli strikes against Iranian regime members have killed a significant tranche of Iranian leadership. These were primarily older, more traditional regime members. The segment of the regime pushing cryptocurrency adoption has likely been empowered by these strikes, and will further push the Iranian regime into cryptocurrency adoption for threat (and regime) financing.

Share

This research is part of my post-doctoral work funded by the University of Calgary’s Faculty of Law.

^[i] Saiz, “Sanctions in the Virtual Asset Industry: SIFMANet Roundtable Report,” 3.

^[ii] Julia Shapero, “Hamas Money Laundering Worries Spark Proposed New U.S. Crypto Rule,” Text, The Hill (blog), October 19, 2023, https://thehill.com/business/4265344-hamas-money-laundering-worries-spark-new-u-s-crypto-rule/.

^[iii] Application for a warrant to seize property subject to forfeiture (US District Court for the District of Columbia March 27, 2025).

© 2026 Insight Threat Intelligence Ltd. All Rights Reserved.

This newsletter and its contents are protected by Canadian copyright law. Except as otherwise provided for under Canadian copyright law, this newsletter and its contents may not be copied, published, distributed, downloaded or otherwise stored in a retrieval system, transmitted or converted, in any form or by any means, electronic or otherwise, without the prior written permission of the copyright owner.

In this month’s report, we explore compelling stories from Canada, Europe, and the Middle East in the complex world of terrorism financing. Our coverage includes unregistered digital finance companies, the funding and growth of ISIL cells, and Hizballah’s evolving stockpiles and revenue streams.

Dive in, share your thoughts with a colleague, and be sure to check out our long-read recommendations for deeper insights!

Our terrorist financing analysis course caters to researchers, intelligence, law enforcement, and compliance professionals to help them learn about terrorist financing and analyze suspicious patterns and activities more effectively. Sign up today!

Read more

While the world of terrorist financing and emerging threats kept moving fast this month, we had a bit of a quieter month here taking some time to wrap up some fiscal year-end projects. We will be back in full force next month. Be sure to subscribe so you don’t miss out!

Before we dive in…

CASIS recently announced its 2026 essay contest. You can get all the details here.

The Secure Line podcast, was back this month with two new episodes. Highlights include discussion on recent policy and intelligence developments, and why protecting research and innovation has become a core national security priority. Catch up on the latest episodes here.

As always, we published our latest Global Terrorist Financing Report, highlighting major developments from the past month.

Terrorist Financing Analysis

Become an expert on how terrorist groups move, store, and exploit funds. This bundle gives you access to the terrorist financing analysis course, plus a customizable analytic tool, relevant case studies, and other practical resources you need to detect, analyze, and disrupt illicit financing networks.

Join our community, tackle real-world exercises, and gain skills you won’t find anywhere else. Enroll now and take your expertise to the next level!

Articles

This month we did a deep dive into terrorist financial tradecraft, highlighting new data on how attacks are funded and the methods groups use to move and obscure money. We also released a commentary on Canadian terrorism trends, examining riding changes, shifting motivations, and the growing involvement of youth.

Stay informed with our latest analyses — explore our newest articles below:

Share

That’s a wrap for March! See you next month with more analysis and updates. Be sure to subscribe so you don’t miss out! This is news and analysis you won’t find anywhere else.

Subscribe now

© 2026 Insight Threat Intelligence Ltd. All Rights Reserved.

This newsletter and its contents are protected by Canadian copyright law. Except as otherwise provided for under Canadian copyright law, this newsletter and its contents may not be copied, published, distributed, downloaded or otherwise stored in a retrieval system, transmitted or converted, in any form or by any means, electronic or otherwise, without the prior written permission of the copyright owner.

It’s been quite the journey. What started with a few hardcore illicit finance nerds has grown to a community of over 8,000, with new subscribers every day. I’m always excited when someone else agrees to receive the newsletter or follows me on this platform, because I think we’re collectively one step closer to illicit finance being taken more seriously. And as regular readers of this newsletter know, countering the illicit finance threat is something I take very seriously.

This newsletter started as something I wanted to do to capture my thinking on illicit finance and security, share insights through something more enduring than the odd thread on Twitter (I refuse to use the new name because I think it’s dumb), and promote the courses and other activities that I do as part of Insight Threat Intelligence. It’s grown well beyond that and has actually become a revenue line for the business; it’s also become a source of some expenses, because I usually have at least one researcher working on the Global Terrorist Financing Report (our monthly roundup of terrorist financing news), as well as research for other newsletters.

When I first started out, I migrated old content from a blog I was running to help populate the back catalogue – a lot of that is still available on the site if you go way, way back. As with most Substackers, I started publishing free articles, but quickly added a paywall because, frankly, those news roundups are an annoying amount of work. Artificial intelligence has helped a bit, but we still need to check every story, verify details, and make sure it’s accurately represented, and I have yet to find an AI tool that does that to my satisfaction. All that to say: this newsletter remains labour-intensive, and I’m happy about that. The writing is the work.

Somewhere along the way, I started trying to write twice per week. That turned out to be too much — for both my readers and me. So now we focus on one article per week, and sometimes add a second if things are particularly newsy. I’m increasingly trying to take things slowly: reading, writing, and publishing with intention. In our information ecosystem, I think we can all use a bit of a break, and a focus on more signal, less noise.

Growth on this platform hasn’t been exponential for me. I feel like I’ve earned every one of my followers or subscribers; while Substack touts a network effect, I have yet to really experience it, and I haven’t had any posts go truly viral as I have elsewhere. But there’s something more organic and sustainable about this – I feel like every person is here because they want to be, not because they feel like they should be, or because the algorithm told them to be.

I think one of the things that I like the most about writing a regular newsletter is that it keeps the writing muscles sharp, even during long periods where I’m mostly researching, travelling, or giving talks, like right now, when over the period of three months I’m scheduled to be in three different countries and eight cities, some twice. It forces me to write, for better or for worse. Yes, this is pressure, but I also give myself grace, and if I really need to miss some weeks, that’s okay.

In recent years, I’ve experimented with publishing series. I’m not sure that these really work, but I like them because they give me a way to break up longer pieces of analysis and share them with readers, without overwhelming people with details, links, or forty-page documents. Feel free to let me know what you think about these series in the comments, by email, or however we communicate.

This platform itself isn’t without flaws. There are way too many Nazis on the platform, although I’d argue this is true of most social platforms these days. Substack also takes a pretty big cut of my profits, particularly compared to other platforms. Finally, Substack has started a Polymarket integration, which I think is criminal. (Note: it is not technically criminal now, but I’m willing to bet (haha) that it will become criminal within ten years when we see the full effects of the gaming and gambling epidemic. Maybe sooner, although policy change takes time.) This is all driven, of course, by Substack’s need to become profitable. It has no alternative viable path to profitability. Which, in my view, raises questions about the platform’s long-term viability.

To that end, I’ve migrated my content to a blog hosted on my website, which you can access at www.insightthreatintel.com. It has both a free and a paid section, and one of my wonderful team members maintains it, keeping it up to date with the latest news and analysis, pretty much at the same time as we release articles on Substack. This also gives some readers the chance to subscribe without supporting the Substack platform, which is an absolutely valid choice.

That’s not to say I’ll be disappearing from here anytime soon, but it is to say that I’m making plans (and maintaining newsletter lists!) so that if Substack disappears, I can still keep doing this work. Because that’s what matters, not the way it lands in your inbox.

Share

That’s enough reflection for one day. On to the good stuff. To celebrate my five years on this platform, I’m offering a huge discount for new subscribers: 50% off an annual membership. This is a rare sale (we almost never have them), and this is by far the largest discount I’ve ever given. It’ll be available for the full month of April, so if you want to take advantage, be sure to lock it in before the end of the month. And you know the drill: like, share, and subscribe to help us grow our community!

50% OFF!

© 2026 Insight Threat Intelligence Ltd. All Rights Reserved.

This newsletter and its contents are protected by Canadian copyright law. Except as otherwise provided for under Canadian copyright law, this newsletter and its contents may not be copied, published, distributed, downloaded or otherwise stored in a retrieval system, transmitted or converted, in any form or by any means, electronic or otherwise, without the prior written permission of the copyright owner.

We’ll be back with regular newsletters in April — we’re on a short hiatus as I wrap up some significant fiscal year-end projects, deliver some technical assistance, and generally just try to get caught up on life.

If you want something a little bit more hands-on, we also have a course based on the book, which you can access here:

Our terrorist financing analysis course caters to researchers, intelligence, law enforcement, and compliance professionals to help them learn about terrorist financing, and analyze suspicious patterns and activities more effectively. Sign up today!

Share

© 2026 Insight Threat Intelligence Ltd. All Rights Reserved.

This newsletter and its contents are protected by Canadian copyright law. Except as otherwise provided for under Canadian copyright law, this newsletter and its contents may not be copied, published, distributed, downloaded or otherwise stored in a retrieval system, transmitted or converted, in any form or by any means, electronic or otherwise, without the prior written permission of the copyright owner.

CASIS is pleased to announce the 2026 essay contest. Essays must address some dimension of intelligence, security, or law enforcement issues in any time period and in any country. Submissions can be from any Humanities or Social Sciences discipline, inter-disciplinary programmes, or law school.

For a full description of eligibility and requirements, see the official call for papers here.

The winners of the essay contest will receive cash prizes ($2500 for the graduate winner and $1000 for the undergraduate winner), and will also be invited to present their papers at the annual CASIS Symposium in Ottawa.

Please share with friends and colleagues!

© 2026 Insight Threat Intelligence Ltd. All Rights Reserved.

This newsletter and its contents are protected by Canadian copyright law. Except as otherwise provided for under Canadian copyright law, this newsletter and its contents may not be copied, published, distributed, downloaded or otherwise stored in a retrieval system, transmitted or converted, in any form or by any means, electronic or otherwise, without the prior written permission of the copyright owner.

Last year, I reviewed terrorism metrics in Canada and found some surprising trends, namely that we have more terrorism incidents in Canada than ever before. This includes terrorism peace bonds, charges, and attacks, and the numbers have been climbing. Peace bonds are being used more often as a preventative tool, though there’s debate about how effective they really are.

Historically, most charges have targeted religiously motivated actors—those inspired by groups like ISIL or al-Qaeda. But in recent years, there’s been a noticeable shift: more and more cases involve ideologically motivated individuals. What’s interesting is that while religiously motivated actors are charged more often, most actual attacks in Canada have been carried out by ideologically motivated ones. That suggests authorities may be better equipped to detect and stop religiously motivated plots, possibly because of long-standing international intelligence partnerships and entrenched ideas of what counts as “terrorism.”

That article generated a lot of interest and some controversy. Stewart Bell covered it in his Global News article on terrorism in Canada. The Integrated Threat Assessment Center also had some thoughts on the data and analysis, which they declined to share with me directly, but that I got to read all about in an access to information request. It was actually sweet how much time they spent on this little blog.1 Keep reading to learn what it all means for measuring terrorist activity in Canada:

Share

Read more

In February 2026, news of terrorism financing struck almost every region of the world. From North America and Western Europe to the Middle East and Africa! We cover illicit financing through NGOs, terrorist organizations’ gold reserves, and money-filled briefcases headed to Hizballah. So, have a read, share with a colleague, and don’t miss out on our long-read recommendations!

Financial Intelligence Fundamentals

Do you want to learn more about financial intelligence and how to use it in research, investigations, and analysis? Our financial intelligence fundamentals course is for you! This course is perfect for people new to financial intelligence and seasoned professionals. Enroll today

Read more

It has been another packed month, full of research and analysis on terrorist financing and emerging threats. Be sure to subscribe so you don’t miss out!

In case you missed it…

Jessica is leading a new research project with the SOC ACE Research Programme: Criminal Hands, State Ends: State-Sponsored Assassination Using Organized Crime. The project examines how governments exploit organized crime networks for targeted killings. Check out the full project here.

Meanwhile, Leah, Steph, and Jess have been busy on the Secure Line podcast, releasing four new episodes, covering everything from global policy and organized crime to domestic threats and security trends. They had a talk about PM Carney’s Davos speech, how organized crime is increasingly being used as a tool of state power, grievance-fuelled violence (with Emily Corner, in light of the mass shooting at Tumbler Ridge), and reporting on national security issues with Chris Nardi from the National Post. Catch up on the latest episodes here.

Lastly, Jessica was quoted in a Global News article, offering her perspective on ongoing foreign interference in Canada.

As always, we published our latest Global Terrorist Financing Report, highlighting major developments from the past month.

Illicit Finance Investigations

The Illicit Finance investigations bundle includes access to both Financial Intelligence Fundamentals and Financial Intelligence Sources and is your one-stop shop to learn how to conduct an illicit finance investigation.

Whether your goal is to work as a financial intelligence analyst, an investigator, or in a related field, this bundle ensures you’re equipped with the skills needed to succeed.

Enroll now and take your expertise to the next level!

Articles

February was packed with insight. We started the month with our analysis of the 2025 Bondi Beach terrorist attack, breaking down how it was financed and what it reveals about disrupting future attacks. Next, we shared a commentary outlining Jessica’s recommended priorities for Canada’s future financial crimes agency to tackle emerging threats and protect Canadians. We also unpacked the 37th UN Monitoring Team Report, showing how ISIL, Al-Qaeda, and associated groups continue to sustain themselves through both traditional and innovative financing methods. Finally, in the second article of our Axis of Illicit Finance Series, we examined how Iran moves funds to the Houthis using cryptocurrency, spotlighting the networks that underpin this capability.

Stay informed with our latest analyses — explore our newest articles below:

Share

That’s a wrap for February! See you in March with more analysis and updates. Be sure to subscribe so you don’t miss out! This is news and analysis you won’t find anywhere else.

Subscribe now

© 2026 Insight Threat Intelligence Ltd. All Rights Reserved.

This newsletter and its contents are protected by Canadian copyright law. Except as otherwise provided for under Canadian copyright law, this newsletter and its contents may not be copied, published, distributed, downloaded or otherwise stored in a retrieval system, transmitted or converted, in any form or by any means, electronic or otherwise, without the prior written permission of the copyright owner.

Terrorist financing is often discussed in terms of how money is raised, but far less attention is paid to what happens next: how that money is deliberately hidden. In this context, obscuring refers to the financial tradecraft terrorists use to hide the source, destination, or ultimate use of funds—a set of practices designed to frustrate detection, complicate attribution, and sever the visible link between money and violence. Drawing on my existing dataset, this newsletter examines how terrorist groups and individuals disguise terrorist funds. Understanding these techniques is essential for a more operational understanding of how these networks and actors survive under sustained financial pressure.

To get caught up on the series so far (and learn more about the data, have a read:

1. Trends in Terrorist Financing 2020-2025

2. Beyond Anecdotes: Terrorist Financing Has Moved to Crypto

Over the past six years, terrorists have demonstrably increased their use of financial tradecraft to obscure the source, destination, and use of funds. Importantly, the patterns observed in open cases and enforcement actions almost certainly represent a lower bound of actual tradecraft in use: the most sophisticated methods are, by definition, the least likely to be detected, investigated, or publicly documented.

Over time, terrorist financing has become more complex, though it still generally lacks the sophistication typically observed in large-scale money laundering or other forms of illicit finance. This growing complexity is not driven by a single innovation, but by the layering of methods that, when combined, increase network opacity. These methods include continued reliance on cash, the use of facilitators and enablers, the deployment of third parties and proxies, and the selective adoption of money-laundering techniques. Keep reading to learn more:

Read more

Part 1:

The first installment of this eight-part series outlined how one of the world’s most heavily sanctioned states has evolved its financial infrastructure — integrating traditional networks with crypto rails — to sustain its economy and underwrite proxy activities across the Middle East. Against a backdrop of geopolitical conflict and tightening sanctions, Iran’s adoption of cryptocurrency is not just about evading sanctions but about embedding itself in an emerging “axis of illicit finance” that links it with other sanctioned states and actors, making crypto increasingly central to its ability to fund and project influence through its affiliates. In recent years, Iran’s proxy networks have conducted on-chain activity of over $2 billion; this activity is based on confirmed wallets identified in sanctions designations, and likely represents a low estimate of Iran’s true use of cryptocurrency for terrorist financing.

Yemen, the Houthis, and the Axis of Resistance

Over the last two years, the Houthis have become even more important to Iran amid geopolitical losses. At the same time, cryptocurrency has become increasingly important for Iran, with the IRGC’s share of Iran’s cryptocurrency ecosystem rising to 50% in the last quarter of 2025. For instance, several reports indicate that Iran accepts crypto payments for military equipment purchases, even if those payments are not necessarily processed directly through websites. Ultimately, sanctions targeting both Iran and the Houthis, and Iran’s development of crypto rails for payments to its proxies (among other uses), likely complement other, more traditional payment methods like hawala, cash couriers, and even bank transfers.

Like the other axis members, Iran funds the Yemen branch of its axis of resistance (Ansarallah / The Houthis) in various ways, primarily by diverting profits from illicit oil sales through cryptocurrency transactions. The crypto component of Iran’s hybrid threat-financing network that funds the Houthis is illustrated below. Some of the basic details are as follows:

• According to the US OFAC, the IRGC-QF cooperates with Iran-based Ansarallah financial official Sa’id al-Jamal; OFAC has identified five cryptocurrency wallets associated with him. Al-Jamal also operates exchange companies in Sana’a, Yemen, specifically Janat al Anhar General Trading LLC (formerly Abu Sumbol General Trading LLC). These businesses facilitate payment for Iranian oil.

• Funds transfers are also facilitated for him through a variety of money exchanges located in the United Arab Emirates (UAE), including Adoon General Trading FZE. Al-Jamal reportedly generates revenue through the illicit sale of Iranian petroleum to customers in East Asia using a network of shipping firms in Malaysia. (Malaysia acts as an intermediary for some Iranian oil, with Iranian oil re-labelled as originating from Malaysia and sold to other countries, including China).

• These oil transactions often appear in Iran’s shadow banking network and refer to “Malaysian blend” oil. Some of these transactions have been small-denomination inflows through informal exchanges.

These transactions are not limited to the Middle East and are linked to the broader illicit finance network through Russia, specifically the Russian cryptocurrency exchange Garantex, which is reportedly still active despite sanctions and domain seizure. In April 2025, the US further identified eight wallets associated with Sa’id Al-Jamal and indicated that, in addition to facilitating illicit petroleum sales, he is also involved in weapons procurement from Russia and facilitating the sale of stolen Ukrainian grain. These addresses included six private wallets and two deposit addresses at mainstream services. According to Chainalysis, these addresses have moved nearly $1 billion in illicit funds. As part of this activity, the Houthis used deposit addresses at Garantex. In early 2026, allegations surfaced about the role of Binance in Iran’s illicit finance network, including for sending money to the Houthis. These allegations suggest that Binance has facilitated over $1.7 billion for Iran / IRGC / Axis of Resistance.2

Share

Financial Intelligence Sources

Do you want to identify and exploit new sources of financial intelligence? Our evergreen course is your guide to finding, analyzing, and contextualizing open source financial intelligence. This step-by-step guide to FININT sources will greatly expand your intelligence knowledge and skills. This course is perfect for people new to financial intelligence and seasoned professionals. Enroll today

An International Network

Anyone versed in counter-terrorist financing will also not find it surprising that this terrorist financing network has connections in Türkiye. According to OFAC, Türkiye-based Hassan Jafari has also worked with Sa’id al-Jamal to launder money on behalf of al-Jamal’s network and has arranged payments worth millions of dollars in support of shipments for the Houthis. Jafari has also worked with brothers Hushang and Sohrab Gahirat on the Houthis’ commercial initiatives in Russia, including arms procurement and grain shipments.

Part of this network also extends into Syria. For instance, Alireza Derakshan and Arash Estaki Alivand coordinated more than $100 million in oil sales for the Iranian government through cryptocurrency and used a network of front companies across multiple jurisdictions. Alivand worked as a financial facilitator and oil broker for Syria-based Al Qatirji Company, while Derakhshan used UAE-based Minato Commercial Brokers as a front company to make a payment to Al Qatirji Company.

In Yemen, a network of money service businesses connects and facilitates cryptocurrency payments, as well as traditional financial transfers and likely cash-out services:

• Houthi finance official, Abdullah al-Jamal, has used a network of money service businesses, trade facilitators, and cryptocurrency addresses to move funds.

• He has used the Sana’a-based money service business Mohammed Ali Al Thawr Exchange, and he also controls the Davos Exchange and Remittances company.

• Other exchanges, specifically Khaled Al Hazmi and Brother Company General Partnership, have also transferred funds to Davos Exchange as part of this illicit activity.

This cryptocurrency network does not operate in isolation. Instead, it plugs directly into a wider ecosystem of exchange houses, front companies, and long-standing smuggling routes tied to the Houthis’ weapons-procurement apparatus. Together, these crypto nodes form a parallel financial architecture—one that functions as a secondary payment system —designed to move value, settle transactions, and sustain illicit activity while insulating the network from sanctions and traditional financial controls. While parts of this network are visible through on-chain analysis, additional off-chain activity (including cash and hawala transactions) likely further obfuscates the network's full extent.

Iran and the Houthis’ hybrid threat finance system is likely growing in complexity and sophistication, and is facilitated by access to greater pools of illicit cryptocurrency funds provided by Chinese money laundering networks. Furthermore, Ansarallah has used privacy-enhancing tools such as mixers and cross-chain protocols, demonstrating financial tradecraft capabilities.

Ansarallah’s use of cryptocurrency for financing, facilitated by a small number of identified individuals, reflects a broader and potentially more complex network linked to Iran. These facilitators operate through companies, hawalas, and exchanges in Türkiye, Russia, Yemen, Syria, Lebanon, and the UAE, thereby enabling the group to access financial infrastructure beyond Yemen’s borders. While current evidence highlights these specific connections, it remains unclear whether this network represents the entirety of Ansarallah’s crypto-financing apparatus or merely the visible edge of a much larger system. The opacity of these networks, combined with Iran’s established role in supporting proxy groups through both traditional and emerging financial channels, suggests that the full scale and sophistication of Ansarallah’s digital financing strategy might still be underappreciated.

Following Iran’s significant military setbacks in the first half of 2025, Iran needs Ansarallah more than ever, and faces significant sunk costs in terms of existing investment in the group. As a result, Iran is likely to continue, and could increase, support for the group, and some of the tens or hundreds of millions of dollars a year that Iran provides to the group might increasingly move through cryptocurrency.

© 2026 Insight Threat Intelligence Ltd. All Rights Reserved.

This newsletter and its contents are protected by Canadian copyright law. Except as otherwise provided for under Canadian copyright law, this newsletter and its contents may not be copied, published, distributed, downloaded or otherwise stored in a retrieval system, transmitted or converted, in any form or by any means, electronic or otherwise, without the prior written permission of the copyright owner.

One of the most notable developments in AQ/ISIL terrorist financing concerns the Allied Democratic Forces (ADF), which is reportedly using satellite internet to facilitate cryptocurrency conversions into state-issued currency, including through mobile money applications. This demonstrates not only the increasing accessibility of crypto for terrorist actors but also a significant operational adaptation to access crypto even in remote areas. The technical and logistical barriers are being overcome, and groups are increasingly integrating digital assets into local financial ecosystems.

At the same time, while cryptocurrency adaptation is increasing, it does not displace more traditional revenue streams. Across theatres, local taxation and extortion networks remain central to sustaining operations, alongside criminal activity such as smuggling and illicit trade. The report reinforces a familiar pattern: innovation at the margins, but continuity at the core. For most groups, territorial control, coercive taxation, and embedded criminal economies continue to underpin their financing strategies.

JNIM

According to the UN, JNIM profited from a single large ransom payment and used that to increase its capabilities. Here at Insight Monitor, we wrote about that large ransom payment, noting that “the money will certainly allow JNIM more operational freedom of movement in the coming months, and likely incentivize them to gain more territory and solidify control and influence in the region.” JNIM engages in both low-level (and low-cost) local kidnappings, as well as higher cost (and higher reward) international kidnapping for ransom.

JNIM is assessed by the UN to be the wealthiest Al-Qaeda affiliate after Al-Shabaab, having significantly expanded its revenue base through territorial control. The group raises funds by taxing and regulating gold mining and other commercial activities, imposing road tolls and transportation fees, and engaging in smuggling and livestock rustling. It also collects zakat (charitable donations), with rates varying by location; in areas where local communities resist or are perceived as uncooperative, zakat can be increased to extortionate levels. This diversified and locally calibrated approach to revenue generation has strengthened JNIM’s financial resilience.

Lakurawa

The UN also mentioned (I believe for the first time) Lakurawa, a group within the Islamic State Greater Sahel,2 and described their financing as primarily illegal tax collection and cattle rustling. You can read more about Lakurawa in this Soufan Center intel brief.

Terrorist Financing Analysis

Our terrorist financing analysis course caters to researchers, intelligence, law enforcement, and compliance professionals, helping them learn about terrorist financing and analyze suspicious patterns to disrupt terrorist activities more effectively. Sign up today to grow your counter-terrorism expertise.

ADF

The Monitoring team also reported an increase in ADF's use of cryptocurrency for financing. They also noted that the ADF now has greater satellite connectivity, enabling the group to convert cryptocurrency into usable funds via mobile money applications and wallets. This capability allows them, even when deep in the bush and in areas outside of conventional cell coverage, to access and covert cryptocurrency to state-issued currency. To read more about ADF financing:

Share

ISIL

The UN monitoring team assesses that the revenue collection capability of ISIL in Somalia has been significantly degraded. While the group continues to generate revenue through its business interests, it can no longer collect revenue in key locations such as Bosasso, Qandala, and Ba’ad, where security conditions have tightened. The securitization of these areas has disrupted their taxation and extortion activities, constraining their ability to operate as they once did. That said, ISIL-Somalia has been able to draw on residual funds, which have helped sustain the group despite these setbacks.

ISIL-K has sought to exploit geopolitical flashpoints, including the war in Gaza, to drive fundraising and mobilize support. By framing distant conflicts as part of a broader narrative of global grievance, the group attempts to tap into issues that resonate with potential donors and sympathizers. This reflects a broader adaptation strategy: rather than relying solely on local revenue generation, ISIL-K leverages international events to expand its financial reach and reinforce its relevance within the global jihadist movement.

At the same time, counterterrorism efforts have disrupted elements of ISIL’s broader financial architecture. In Iraq, authorities dismantled a finance network with connections stretching to Côte d’Ivoire, Madagascar, and Togo. The geographic spread of this network underscores the transnational character of ISIL’s facilitation structures and its reliance on dispersed nodes to move and store funds. Disruptions in one theatre, therefore, have ripple effects across regions, illustrating both the network's scope and its potential vulnerability to coordinated action.

ISIL-K has also faced setbacks in the digital financial space. The group reportedly lost access to approximately $100,000 in Monero after several individuals were arrested, preventing it from retrieving funds held in associated wallets. In response, it altered its Monero quick response code distributed through its propaganda arm Voice of Khorasan and introduced a new Bitcoin address. This episode highlights both the risks and adaptability associated with cryptocurrency use: while digital assets offer speed and global reach, they also expose groups to technical and operational vulnerabilities when key facilitators are detained.

Al Shabaab

The report also notes developments concerning Al-Shabaab and its relationship with Al-Qaeda in the Arabian Peninsula (AQAP). While financial support from Al-Shabaab to AQAP may have declined, cooperation between the two groups continues. This suggests that even when financial flows fluctuate, operational or strategic ties endure, including those associated with weapons trafficking networks. In the Somali context, this underscores a broader pattern in which terrorist groups adapt to financial pressure but maintain networks that allow them to remain resilient.

To read more about Al Shabaab financing:

Libya

In Libya, security services have dismantled at least four cells involved in terrorist financing, migrant and fighter smuggling, and media operations, with links extending to Europe, Iraq, Syria, the Sahel, and East Africa. One of these cells played a logistical role, facilitating operations through smuggling networks and money laundering. The use of smuggling routes and financial crime as enabling mechanisms reflects a pragmatic blending of ideological objectives with criminal enterprise; when one node is disrupted, others can absorb the shock.

AQAP & the Houthis

At the same time, the threat from Al-Qaeda in the Arabian Peninsula (AQAP) is reportedly growing, driven in part by improved funding streams. AQAP, for instance, has profited from Al Shabaab piracy by receiving a share of payments made by vessels in exchange for transiting through high-risk waters. The group also uses Telegram to solicit funds and connect supporters to financial intermediaries. (This is a form of informal crowdfunding that allows them to access international support networks.) Increased access to resources appears to have strengthened the group’s operational tempo and capacity, underscoring the persistent relationship between financing and capability. Where funding improves, groups can move beyond subsistence-level activity and reconstitute networks, invest in recruitment, and plan more ambitious operations. This pattern reflects a familiar dynamic: financial resilience often precedes operational resurgence.

Further complicating the picture, the Houthis reportedly provided AQAP with financial support for a successful attack. This illustrates the fluidity of relationships in conflict environments, where tactical or transactional arrangements can override ideological divides.

Conclusions

The through line in this report is not dramatic innovation; it is consistency and slow adaptation to counter-terrorist financing measures. Groups are experimenting at the edges, whether through cryptocurrency, satellite internet access, or opportunistic alliances, but their core revenue models remain intact. Taxation, extortion, smuggling, and embedded criminal economies continue to sustain most organizations. Disrupting a wallet address or arresting a facilitator matters, but it rarely dismantles the underlying system. These networks are adaptive by design; when pressure is applied in one area, activity shifts to another.

Countering this ecosystem is becoming increasingly difficult amid geopolitical fragmentation and strategic distraction. Cooperation on sanctions enforcement, financial intelligence sharing, and capacity-building is more difficult to sustain when alliances are divided and disrupted and multilateral institutions are strained. Terrorist groups, by contrast, exploit these seams: weak governance, contested territories, and inconsistent enforcement all make terrorist groups stronger. As states turn inward or prioritize great-power competition, the space for illicit finance expands. The difficulty of coordinated disruption, combined with enduring funding streams, leaves all of us less safe than we might otherwise be.

© 2026 Insight Threat Intelligence Ltd. All Rights Reserved.

This newsletter and its contents are protected by Canadian copyright law. Except as otherwise provided for under Canadian copyright law, this newsletter and its contents may not be copied, published, distributed, downloaded or otherwise stored in a retrieval system, transmitted or converted, in any form or by any means, electronic or otherwise, without the prior written permission of the copyright owner.

This month’s Global Terrorism Financing Report uncovers networks spanning Gaza to California—from fake charities funnelling millions to Hamas, Houthi oil smuggling, Hizballah’s laundering via Canadian auto dealers, Spanish crypto transfers, Russian plots in Lithuania, to Australian lone actors.

Stay a while, have a read, and share with a colleague, and don’t miss out on our long-read recommendations!

Terrorist Financing Analysis

Our terrorist financing analysis course caters to researchers, intelligence, law enforcement, and compliance professionals, helping them learn about terrorist financing and analyze suspicious patterns to disrupt terrorist activities more effectively. Sign up today to grow your counter-terrorism expertise.

Read more

Jessica Davis is the president of Insight Threat Intelligence and the author of Illicit Money: Financing Terrorism in the Twenty-First Century. She was consulted by the government of Canada on the development of a new financial crimes agency.

In Budget 2025, the Carney government promised to create a Canadian Financial Crimes Agency, introducing legislation by the spring of 2026, to address a growing range of financial threats facing Canadians.

This is not the first time Canadians have heard this promise: a financial crimes agency was promised in the Liberal election platform of 2021 and has been in various stages of policy development since that time. Yet Canadians have heard very little about the promised agency, except for Finance Minister François-Philippe Champagne’s promise in the fall of 2025 that it would tackle sophisticated financial crimes.

As Canadians face unprecedented levels of sophisticated fraud, ransomware attacks, and geopolitical uncertainty, it’s time for the government to set an ambitious and clear mandate to protect Canadians and our financial sector.

Canada is slowly coming to terms with the fact that its once most-valued partner is increasingly unreliable. This is true in the world of trade as much as it is true in the world of security and intelligence.

The United States has long been an important law-enforcement partner, conducting joint investigations with Canadian police and often taking the lead on terrorist financing or money-laundering investigations. Today, and for the foreseeable future, Canada must prepare to go it alone on critical issues, as the U.S. has recently proven that it can only be relied upon to serve its own immediate and mercurial interests.

In this context of geopolitical uncertainty, Canada must protect the financial sector and Canadians against a smorgasbord of threats. Top of mind for most Canadians is fraud: many know someone who has been directly targeted by sophisticated fraud. These frauds are often perpetrated from abroad, sometimes by people who themselves are victims of human trafficking networks. Money from these schemes is moved swiftly offshore, and often through cryptocurrency. Another threat, ransomware, targets critical infrastructure and services, holding mission-critical data hostage until a ransom is paid. When payments are made to restore services, those payments embolden and strengthen criminals.

While fraud and ransomware are well-known threats to Canadians, the threat from those seeking to avoid sanctions is quietly stalking our financial system. Historically, enforcement of Canadian sanctions has been spotty at best. In the cryptocurrency era, sanctions evasion through Canada has been supercharged. According to one report, the Canadian cryptocurrency sector ranks in the top 10 worldwide in terms of exposure to sanctioned entities. This places Canada on the same list as countries such as North Korea, Russia, and Iran. Canada needs to take immediate action, or we risk becoming a haven for sanctions evasion.

Finally, Canada also needs to address the growing issue of professional money laundering networks. These networks of professionals (accountants, lawyers, and business owners) exist to launder the proceeds of a variety of crimes, including drug trafficking and fentanyl production. These professionals create separation between the main crime and the ultimate beneficiary of the money, making it harder to hold criminals accountable. Addressing this issue requires specialized, skilled, and dedicated financial crime professionals.

The financial sector is a bright beacon in Canada’s economy. Canada must get smart, innovative, and efficient at combating financial crimes targeting and exploiting the sector.

Share

The future Canadian Financial Crimes Agency will face tremendous challenges from the threat environment and from structural issues in this country. In addition to the threats outlined above, the agency will have to spend considerable resources to avoid conflict with other departments, the RCMP, and other police forces. It will also need to engage in horizontal co-ordination across the 13 federal departments and agencies responsible for Canada’s anti-money laundering regime, as well as with provinces and territories.

While avoiding conflict and ensuring co-ordination will be important, the future agency will also need serious teeth. It will need considerable powers to collect intelligence and evidence, analyze that information, investigate crimes, and, ideally, to compel, prohibit, sanction, and disclose information as required. The agency will also require a clear reporting and review structure, with actionable objectives and performance metrics.

A new agency will be expensive, but it will also be a tremendous opportunity for Canada to develop its considerable existing financial investigative capabilities into a world-class agency to fight serious and transnational financial crimes and protect our important financial sector and Canadians.

A future Financial Crimes Agency needs a focused mandate to address the most pressing threats and robust authorities to carry out this mission.

Share

© 2026 Insight Threat Intelligence Ltd. All Rights Reserved.

This newsletter and its contents are protected by Canadian copyright law. Except as otherwise provided for under Canadian copyright law, this newsletter and its contents may not be copied, published, distributed, downloaded or otherwise stored in a retrieval system, transmitted or converted, in any form or by any means, electronic or otherwise, without the prior written permission of the copyright owner.

To do that, this Insight Monitor will examine the attack’s elements, estimate the financing, identify areas for detection (and, if possible, disruption), and compare it with other similar attacks in recent history. Subscribe to read more:

Read more

But before we dive in… Jessica has been busy in the background this month:

• She shared her insights in this Global News article involving a Toronto auto exporter who has been accused of laundering money for Hezbollah.

• She provided expert commentary in a Money Laundering Bulletin article on how Hawala networks and crypto-enabled transfers are exploited by terrorist groups.

• She was the guest speaker in the Terrorist Financing Detection: Tools, Tactics and Real-World Solutions webinar hosted by Nasdaq Verafin.

As always, we published our latest Global Terrorist Financing Report, highlighting major developments from the past month.

Financial Intelligence Sources

Ready to go beyond the basics of financial intelligence? Our Financial Intelligence Sources course dives deeper, exploring open and closed sources, leaked data, and more. Perfect for researchers, compliance and intelligence professionals, and anyone in a FININT or OSINT role.

Join our community, tackle real-world exercises, and gain skills you won’t find anywhere else. Enroll now and take your expertise to the next level!

Articles

This month, we kicked off an 8-part series exploring how Iran uses cryptocurrency to evade sanctions and operate within a broader illicit financial network. We also introduced our Trends in Terrorist Financing 2020-2025 dataset, built from six years of research, which highlights key patterns in how terrorist financing operates. Finally, we examined how digital assets are increasingly used alongside traditional financial systems, the rise of crypto-hawala networks, and the regulatory and intelligence challenges this creates.

Stay informed with our latest analyses — explore our newest articles below:

Share

That’s a wrap for January! See you in February with more analysis and updates. Be sure to subscribe so you don’t miss out! This is news and analysis you won’t find anywhere else.

Subscribe now

© 2026 Insight Threat Intelligence Ltd. All Rights Reserved.

This newsletter and its contents are protected by Canadian copyright law. Except as otherwise provided for under Canadian copyright law, this newsletter and its contents may not be copied, published, distributed, downloaded or otherwise stored in a retrieval system, transmitted or converted, in any form or by any means, electronic or otherwise, without the prior written permission of the copyright owner.

The Data

This research grew out of frustration with claims about “new” or “increasing” terrorist-financing trends that are made without evidence. To address this, the project built its own empirical foundation by systematically collecting and coding real-world cases of terrorist financing over the past eight years. Each case captures reported financial activity used to support terrorism and is analyzed using a six-part framework that examines how funds are raised, used, moved, stored, managed, and concealed. The approach emphasizes observable activity.

The data are drawn exclusively from open sources, including media reporting, court documents, and government publications, and are subjected to a multi-stage validation process to ensure consistency and accuracy. The resulting dataset contains more than 21,000 data points across 1,150 cases, coded across 19 variables such as country, group, financing methods, and sources. While collection began in 2018, analysis relies on cases from 2020 onward, when data quality became sufficiently robust. Together, this methodology provides a rare evidence-based foundation for assessing terrorist-financing trends and testing claims about how those activities evolve over time.

Learn more here.

When Terrorists Used Banks

When Illicit Money was published in 2021, banks remained the primary channel through which terrorists moved money internationally, despite more than two decades of sustained counter-terrorist financing efforts. This persistence reflects a core challenge in CTF: terrorist financing is extraordinarily difficult to detect within the formal financial system. Large organizations such as Hamas and Hizballah have relied on complex front-company networks to obscure illicit activity, while small cells and lone actors typically move modest sums that attract little scrutiny.

In practice, many terrorist transactions closely resemble ordinary remittances or everyday financial activity, making them hard to distinguish from legitimate flows. The amounts involved are frequently below mandatory reporting thresholds, which vary by jurisdiction but are easily circumvented in the context of terrorist financing. Detection becomes even more challenging when terrorist networks benefit from a trusted insider within a financial institution or affiliated business, further blurring the line between licit and illicit activity.

Crypto Enters the Chat

Around 2022, a noticeable shift emerged in terrorist financing patterns, with cryptocurrency appearing with increasing frequency across cases. This change intersects with nearly every aspect of my investigative, research, and policy work, reflecting how digital assets have moved from the margins to the mainstream of terrorist money movement. Today, cryptocurrency is present in roughly 8–12 percent of documented cases and has become the most visible method for moving funds, in part because it dominates in volume and is easier to observe, trace, and publicly report on than many traditional methods like hawala.

Keep reading to find out how we know this, and what it means for the future of counterterrorist financing:

Financial Intelligence Fundamentals

Do you want to learn more about financial intelligence and how to use it in research, investigations, and analysis? Our financial intelligence fundamentals course is for you! This course is perfect for people new to financial intelligence and seasoned professionals. Enroll today

Read more