Terrorist financing is often discussed in terms of how money is raised, but far less attention is paid to what happens next: how that money is deliberately hidden. In this context, obscuring refers to the financial tradecraft terrorists use to hide the source, destination, or ultimate use of funds—a set of practices designed to frustrate detection, complicate attribution, and sever the visible link between money and violence. Drawing on my existing dataset, this newsletter examines how terrorist groups and individuals disguise terrorist funds. Understanding these techniques is essential for a more operational understanding of how these networks and actors survive under sustained financial pressure.

To get caught up on the series so far (and learn more about the data, have a read:

1. Trends in Terrorist Financing 2020-2025

2. Beyond Anecdotes: Terrorist Financing Has Moved to Crypto

Over the past six years, terrorists have demonstrably increased their use of financial tradecraft to obscure the source, destination, and use of funds. Importantly, the patterns observed in open cases and enforcement actions almost certainly represent a lower bound of actual tradecraft in use: the most sophisticated methods are, by definition, the least likely to be detected, investigated, or publicly documented.

Over time, terrorist financing has become more complex, though it still generally lacks the sophistication typically observed in large-scale money laundering or other forms of illicit finance. This growing complexity is not driven by a single innovation, but by the layering of methods that, when combined, increase network opacity. These methods include continued reliance on cash, the use of facilitators and enablers, the deployment of third parties and proxies, and the selective adoption of money-laundering techniques. Keep reading to learn more:

Read more

Iran’s Sanctions Context

Iran has long employed adaptive financial strategies to mitigate the effects of international sanctions and continue backing its regional proxy organizations, including a shadow shipping fleet, money service business and front company networks, and cash couriers. As sanctions have restricted access to formal financial systems, Iran and its affiliates have increasingly relied on cryptocurrency to bypass controls and send funds to the Axis of Resistance, including Hizballah, Hamas, Ansarallah, and Iraqi militias. While Iran’s cryptocurrency-based financing infrastructure remains under development, it continues to advance in sophistication and scope, integrating legacy financial systems with emerging digital mechanisms. It is also increasingly part of an alternative financial systemformed by Russia and the DPRK, and supported by China and used by other countries, including Venezuela. As a result, cryptocurrency is likely to constitute an increasingly significant component of both Iran’s efforts to withstand sanctions and its ability to underwrite proxy activities region-wide.

A State Shaped by One of the World’s Most Comprehensive Sanctions Regimes

Since the 1979 revolution, Iran’s economy has repeatedly been hit by international sanctions. These measures are designed to restrict Iran’s access to the US dollar and to US financial institutions, as well as to foreign banks with correspondent relationships in the United States, thereby limiting its ability to conduct trade and international transactions. At various points, the economic impact of these sanctions has been compounded by volatility in global oil prices.2 In other cases, US and international sanctions have prompted Iran to make concessions during negotiations aimed at constraining its nuclear capabilities and development.3 However, under conditions of maximum pressure, these sanctions have also spurred the Iranian regime to intensify its efforts to evade them—both to bolster its negotiating leverage and to mitigate the economic impact at home. Increasingly, these efforts have incorporated cryptocurrencies.

Share

To finance its proxies and evade sanctions, Iran operates a parallel financial infrastructure comprising a network of informal money transfer businesses, bank accounts, and front companies, all designed to launder the proceeds of oil sales and create plausible deniability about the origin of the oil. Wherever possible, this network intersects with the Western financial system, facilitating Iranian financial activities globally. For instance, media reports indicate that two financial technology companies, Paysera and Wise, have unwittingly processed payments for the network. Over the last eight years, Iran has also added cryptocurrency capabilities to this shadow banking network.

Serious cryptocurrency activity in Iran took off in the mid-2010s with the launch of Nobitex, the country’s first major crypto exchange. As of 2023, Nobitex was Iran’s largest crypto exchange; Iran also has four other large exchanges: Wallex.ir, Excoino, Aban Tether, and Bit24.cash. Nobitex is deeply embedded in Iran’s traditional payment ecosystem and enables real-time currency deposits, withdrawals, and account verification. Nobitex functions as a full-service financial bridge that allows users to bypass the international banking system, demonstrating “how crypto rails and domestic banking infrastructure can be fused in sanctioned jurisdictions to create resilient, borderless payment systems.” Iranian citizens (and sometimes even regime members) use cryptocurrency as a means of moving capital out of Iran, particularly during geopolitical crises. Even for Iranian citizens not looking to offshore their wealth, many invest in cryptocurrency to protect their assets from the volatility of the Iranian currency and the broader economy.

Iran’s widespread adoption of cryptocurrency is unsurprising: sanctions can spur adoption, especially in regions with high income inequality.4 Indeed, cryptocurrency adoption is influenced by factors such as economic instability and infrastructure availability, and adoption rates are higher in countries with limited access to the traditional financial system.5

Beginning in 2018, Iran has turned to cryptocurrency to evade US sanctions. The IRGC is a key user, leveraging crypto to fund intelligence work and its proxy network across the Middle East, as well as foreign interference efforts such as sabotage, property damage, and possibly targeted killings.

Course Alert: Terrorist Financing Analysis

Our terrorist financing analysis course caters to researchers, intelligence, law enforcement, and compliance professionals, helping them learn about terrorist financing and analyze suspicious patterns to disrupt terrorist activities more effectively. Sign up today to grow your counter-terrorism expertise.

The Iranian state, regime officials, and the IRGC use cryptocurrency to evade sanctions and gain access to international markets. According to one blockchain analytics company, Nobitex, as well as other Iranian exchanges, have used “advanced techniques” to move funds and obfuscate their origin and destination. For instance, Iran uses cryptocurrency transactions to pay for imports that cannot be processed through conventional payment systems and to make up for revenues lost due to sanctions. Further, Iran has specifically legalized cryptocurrency payments for imports to circumvent sanctions and avoid using the dollar.

In addition to cryptocurrency transactions, Iran also uses its oil surplus to power Bitcoin mining, effectively converting energy into cryptocurrency. Given Iran’s extensive use of cryptocurrency and connections through various blockchains to international markets, generating Bitcoin in this way creates liquidity for Iran, revenues that can be used to purchase goods and services, and money it can send to its proxies in its “Axis of Resistance”. Indeed, the IRGC is widely believed to have undertaken extensive Bitcoin mining operations.

Once Iran has obtained cryptocurrency, it uses those funds to finance other illicit activities. This includes financing groups within its axis of resistance that support Iran’s goal of regional hegemony,6 as well as potentially using virtual assets to fund influence operations abroad.7 To date, cryptocurrency transactions from IRGC Qods Force (QF) have been sent to Hizballah, Hamas, and Ansarallah as part of the IRGC QF’s broader financing strategy. Cryptocurrency transactions might have benefited other groups in the Axis of Resistance as well.

Iran’s turn toward cryptocurrency marks the latest evolution in a long-running effort to withstand and circumvent one of the world’s most comprehensive sanctions regimes. What began as a workaround to maintain economic resilience has now become integral to financing Iran’s broader foreign policy aims, particularly the sustainment of its proxy network across the Middle East. As Iran’s crypto-financing infrastructure grows more sophisticated and increasingly interwoven with an emerging alternative financial system involving Russia, Venezuela, the DPRK, and China, the implications extend far beyond Tehran’s borders. The following articles in this series will examine how Iran’s proxies leverage these financial innovations, the specific methods used to move and conceal funds, and the expanding role of China and Russia in supporting and enabling Iran’s alternative financial architecture.

Read Part 2 here:

© 2026 Insight Threat Intelligence Ltd. All Rights Reserved. This newsletter and its contents are protected by Canadian copyright law. Except as otherwise provided for under Canadian copyright law, this newsletter and its contents may not be copied, published, distributed, downloaded or otherwise stored in a retrieval system, transmitted or converted, in any form or by any means, electronic or otherwise, without the prior written permission of the copyright owner.

Subscribe now

The case dates back to 2019 and stems from a Combined Forces Special Enforcement Unit–British Columbia (CFSEU-BC) probe into loan-sharking, illegal money services business, and the laundering of proceeds of crime. CFSEU-BC is an integrated policing program that draws officers from agencies across the province, including the RCMP, and is headquartered at the RCMP’s E Division in Metro Vancouver.

Keep reading to see how a seemingly modest $828,000 laundering scheme exposes structural failures in Canada’s $45-billion illicit economy.

Read more

In its news release on the administrative monetary penalty, FINTRAC noted that the penalty reflected the “magnitude of non-compliance” and the very serious nature of the violations. FINTRAC found that the crypto company failed to file suspicious transaction reports, noting that the company processed many transactions that it had reasonable grounds to suspect were related to proceeds from trafficking in child sexual abuse material, fraud, ransomware payments, and sanctions evasion.

The company also failed to report large virtual currency transactions of $10,000 or more (“threshold” reports in Canadian legislation).

Iran

The company also failed to comply with a Ministerial Directive (Iran). These directives are legally binding orders that tell reporting entities (like banks, money service businesses, casinos, etc.) how to handle transactions involving certain foreign jurisdictions, entities, or activities that pose a high risk of money laundering or terrorist financing. FINTRAC then communicates and enforces these directives. Under the current ministerial directive on Iran, reporting entities must:

• Treat every transaction with Iran as high-risk

• Verify the identity of any individual involved in these transactions

• Ascertain the source of funds for these transactions

• Keep a record of the transaction

• Report all of these transactions to FINTRAC

FINTRAC found 7,557 instances between July 1, 2024, and December 31, 2024, in which the exchange failed to report transactions originating in Iran.

This is particularly important because over the last five years or so, Iran has increasingly used cryptocurrency to evade sanctions, finance the non-state (and terrorist) groups in its Axis of Resistance (such as Hizballah, Hamas, the Houthis, Palestinian Islamic Jihad, and others), to fund its proliferation activities and acquire dual-use materials, and facilitate oil sales.

While we don’t know if any of these transactions facilitated this activity (that’s part of the problem: the non-reporting of transactions prevents them from being analyzed for potential money laundering, terrorist financing, and sanctions evasion), this fine illustrates how a crypto exchange with a presence in Canada might be used for this highly illicit activity.

Interestingly, I looked at the company’s anti-money laundering statement, and it claims it does not process transactions with Iran. Or actually a host of other countries….

Our terrorist financing analysis course caters to researchers, intelligence, law enforcement, and compliance professionals to help them learn about terrorist financing, and analyze suspicious patterns and activities more effectively. Sign up today!

Exiting the Canadian Market?

The Globe and Mail reported that the Cryptomus website is blocked in Canada, and I confirmed that. However, using a VPN, I did have a look around the website (see the above-mentioned AML policy), and noted some of the services they offer. Given the website block, it appears the company is exiting the Canadian market.

This might make it challenging for FINTRAC to collect this penalty. (Briefly, the collection process looks like this: once FINTRAC issues a notice of violation, the entity has 30 days to act. If the entity pays the penalty, the matter is settled. The entity can also appeal the penalty to the Federal Court. The debt becomes owed to the Crown, interest starts accruing, and FINTRAC (or its delegates) can pursue collection. FINTRAC indicated that since 2012, 74% of penalties have been fully collected, and other cases are at the Federal Court.)1

I doubt there is any real prospect for collecting this fine, but it certainly is symbolic. Further, in C-2 (and subsequently C-12), amendments are proposed to FINTRAC’s legislation to increase the fines further. (I will happily be wrong, and would be delighted to see FINTRAC collect this fine. Let’s all keep our eyes out for news on this front.)

Why not criminal non-compliance?

One of the tools that exists in Canadian anti-money laundering laws is criminal non-compliance with the regime. Criminal non-compliance requires a person or entity to knowingly contravene certain sections (such as record-keeping requirements). In this case, it’s entirely possible that Cryptomus or its principals could have met the standard for criminal non-compliance. However, given that they have no real presence in Canada (and legal cooperation with Kazakhstan and Uzbekistan (the country of residence for the principals) is likely…challenging), I doubt there was any real prospect of charges in this case. But it might be the kind of thing that our much-promised and not-yet-delivered Financial Crimes Agency might look into.

This really illustrates how easily companies can operate and evade reporting requirements, and the consequences of failing to combat illicit financial activities. Crypto isn’t the wild west of finance anymore, but issues like this really illustrate how difficult effective regulation and enforcement are in an interconnected world. Canada’s AML/CTF regime still relies on territorial enforcement powers in a borderless financial ecosystem, which could increasingly render its enforcement mechanisms meaningless.2

Serious Implications for the Fight Against Illicit Finance

This case underscores how crypto exchanges can become nodes in transnational illicit finance networks, even when nominally registered in one jurisdiction but operating globally without a real footprint. The Cryptomus case illustrates how such entities can serve as de facto gateways for proceeds of cybercrime, sanctions evasion, and terrorist financing.

Further, the unreported Iranian transactions could point to latent sanctions-evasion corridors through crypto platforms, including those operating in Canada. Canada could be unknowingly enabling the digital infrastructure of sanctions evasion and illicit finance, with crypto exchanges acting as intermediaries for regimes or proxies (e.g., Iran-linked networks financing Hizballah or Houthis).

Beyond its symbolic value, the Xeltox/Cryptomus case reveals a deeper structural weakness: national AML systems remain ill-equipped to police decentralized and transnational digital value flows. When a company can register in one jurisdiction, have principals resident another, serve customers globally, ignore sanctions-related directives, and then simply block Canadian access after being fined, it exposes the fragility of enforcement in the face of digital finance’s borderless nature.

To date, the regulation and enforcement of national AML/CFT standards have been carried out at the national level. But with digital finance, borders are meaningless. This leaves only a few options for effective regulation and enforcement, like a supranational FIU with global enforcement powers, or a much more muscular FATF, or some sort of UN mechanism. All of these options will be difficult to implement in the current geopolitical climate.

Share

© 2025 Insight Threat Intelligence Ltd. All Rights Reserved.

This newsletter and its contents are protected by Canadian copyright law. Except as otherwise provided for under Canadian copyright law, this newsletter and its contents may not be copied, published, distributed, downloaded or otherwise stored in a retrieval system, transmitted or converted, in any form or by any means, electronic or otherwise, without the prior written permission of the copyright owner.

While this is being touted as a significant disruption to Hizballah’s financial operations, and by extension, the wider Axis of Resistance, the impact on many of the members in the axis will likely be minimal. For instance, the Houthis’s finances are diversified, domestically anchored, and increasingly shielded from Lebanese or even regional pressures. Much of their funding is raised and spent locally, and while they likely benefited from the Al Qard al Hassan network (as all members of the Axis of Resistance did), they never relied exclusively on it.

That said, Al Qard al Hassan played an important role in Iran’s hybrid threat finance network. Its closure eliminates a semi-licit node long used for transactions and to move funds across jurisdictions with some degree of plausible deniability. In the short term, this will stress the network. In the medium term, Iran’s threat finance network will exploit alternative pathways: informal value transfer systems, cryptocurrency, crypto-hawala, and deeper entrenchment in the shadow banking ecosystem. The bank might even be reconstituted under a different name or cover.

Our terrorist financing analysis course caters to researchers, intelligence, law enforcement, and compliance professionals to help them learn about terrorist financing, and analyze suspicious patterns and activities more effectively. Sign up today!

Iran provides financial support to its regional proxies (Hizballah, the Houthis, Hamas, Iraqi militias, etc.) through a mix of formal and informal financial architecture that allows Iran to channel support with limited exposure. Shutting down one node, especially one with semi-legitimate status, adds friction but doesn’t collapse the system. What it does do is force the network further underground. As nodes like Al Qard al Hassan are lost, the architecture tilts more toward opaque and decentralized financial instruments: crypto wallets, unregulated hawaladars, and the use of shell companies in permissive jurisdictions.

It also makes the network more difficult to monitor and disrupt. Formal nodes serve as pressure points; once they’re gone, enforcement agencies lose access to transaction data and choke points and have to find new nodes to exploit.

So, while this move is politically and symbolically significant, the operational impact is limited unless it's paired with broader enforcement across the rest of the hybrid network. As with past disruptions, the real question is whether the network adapts faster than the enforcement mechanisms targeting it. So far, history suggests it will.

Share

© 2025 Insight Threat Intelligence Ltd. All Rights Reserved.

This newsletter and its contents are protected by Canadian copyright law. Except as otherwise provided for under Canadian copyright law, this newsletter and its contents may not be copied, published, distributed, downloaded or otherwise stored in a retrieval system, transmitted or converted, in any form or by any means, electronic or otherwise, without the prior written permission of the copyright owner.

There is some debate about whether he was ISIL-Somalia’s main financial leader. In 2023, the US designated him and indicated that he had been head of the group’s finance office since at least 2019. As with many things relating to ISIL Somalia leadership, his exact position in the organization is up for debate. Regardless, ISIL-Somalia has a rather complex financial management structure with some redundancies, several individauls responsible for collecting taxes (their main source of funds), and other management responsibilities.

Regardless of whether Yusuf was the financial leader for ISIL-Somalia, ISIL-Somalia as well as the al-Karrar office, or just in charge of tax collection, he undoubtedly has significant insight into the group’s financing activities and will be of huge intelligence value to the US.

Degradation of Financial Leadership

Capturing Yusuf represents a direct hit to the financial leadership of the organization. This is a textbook example of targeting a key facilitator who likely had deep knowledge of fund sourcing, routing, disbursement, and possibly integration into licit sectors. Yusuf likely oversaw or approved resource allocations, making him central to ISIL-Somalia's ability to operationalize violence, and he has significant institutional memory, making him an important intelligence asset.

This action might have been made possible by another high-profile event: the death of the al-Karrar office head al-Sudani back in 2023.

Yusuf likely also has knowledge of financial networks that connect into ISIL’s broader financial network, and could have knowledge of specific financial facilitators and intermediaries in each of the different ISIL Provinces and groups.

Our terrorist financing analysis course caters to researchers, intelligence, law enforcement, and compliance professionals to help them learn about terrorist financing, and analyze suspicious patterns and activities more effectively. Sign up today!

By removing a core financial actor, the group will experience short-term constraints. Terrorist organizations often centralize financial authority, at least in part. Removing Yusuf likely slows payments to operatives, contractors, arms suppliers, and bribe recipients. However, taxation efforts are likely to remain intact, since these are managed by a hierarchy of managers and tax collectors.

While removing a key financial facilitator often reduces terrorist capacity in the short term, it does create the possibility that someone more capable and knowledgeable will take his place. If Yusuf’s successor is more technologically-focused, we might see an increase in ISIL’s use of cryptocurrency (already present, but not widespread yet). If his successor is more adept at trade networks, we might see ISIL increasingly rely on trade-based movement techniques. Many scenarios exist, and it’s important to develop each, identify indicators, and adapt to the second-order effects of Yusuf’s capture.

Regardless, this moment creates an intelligence opportunity, as new actors step into financial roles without the same tradecraft discipline, increasing the chances of detection.

Geographic and Strategic Implications

ISIL-Somalia has been a regional financial and operational node for ISIL. Disrupting its financing (even in the short term) could have ripple effects across East Africa, particularly where funds transit through Kenya, Djibouti, or Yemen. It could also impact ISIL-KP (Afghanistan) and ISWAP, as there are known facilitation nodes between the Al Karrar office and those groups. Further, CTF is not just about “following the money” to seize assets, but also about neutralizing the people and processes behind the money. This is a concrete demonstration of that principle.

The capture of ISIL-Somalia’s finance chief represents a strategic CTF success. It degrades financial leadership, forces adaptation, and opens a window for intelligence exploitation. As with all counterterrorist financing (and counterterrorism in general), someone else will rise up to take on his role. But in the short term, this creates opportunities to undermine terrorist finance ecosystems and meaningfully disrupt operational capacity and strategic cohesion.

Share

© 2025 Insight Threat Intelligence Ltd. All Rights Reserved.

This newsletter and its contents are protected by Canadian copyright law. Except as otherwise provided for under Canadian copyright law, this newsletter and its contents may not be copied, published, distributed, downloaded or otherwise stored in a retrieval system, transmitted or converted, in any form or by any means, electronic or otherwise, without the prior written permission of the copyright owner.

USDT (Tether) is a type of cryptocurrency known as a stablecoin, which is designed to maintain a stable value by being pegged to a state-backed currency, typically the US Dollar. USDT is designed to have a 1:1 value with the dollar. Tether Limited, the company behind USDT, claims that each token is backed by reserves, including traditional currency, cash equivalents, and other assets. Initially launched on the Bitcoin blockchain, USDT is now available on multiple blockchain networks, including Ethereum and Tron. Tether has faced criticism over the transparency of its reserves, with critics questioning whether it holds enough assets to fully back the circulating USDT supply. Tether can be used on many different blockchains; until November 2024, the Tron blockchain hosted the largest amount of USDT. However, as of November, Ethereum blockchain is now leading blockchain for Tether, surpassing Tron.

(Sidebar: for an interesting discussion of stablecoins, their fungibility, and the network effects of the stablecoin market, have a read of this piece by JP Koning on his blog Moneyness.)

Tether is one of the main cryptocurrencies used for terrorist financing. Others include Bitcoin, Ethereum, Dogecoin, Zcash, and Monero. Terrorists often try to transact in cryptocurrencies with a lot of market share — this is how they hide the proverbial needle in the haystack. Tether, being one of the largest stablecoins, fits this bill perfectly.

The same features that make it attractive to legitimate users also make it attractive to illicit ones. This includes low transaction fees, a lack of volatility, and ease of use. Indeed, the lack of volatility of USDT is likely a main draw: while terrorists initially solicited donations in Bitcoin (many still do), the volatility of this asset makes it difficult to use for financing operational and organizational activities. For instance, at any given time, the amount of Bitcoin needed to purchase a weapon or improvised explosive component will change significantly. While this might be useful from a revenue-generating perspective, it adds logistical challenges to individuals trying to perpetrate an attack. They either end up needing to get more funds (if the Bitcoin initially transferred was too little to complete their purchases) or end up with a surplus and need to find a way to either return the money to the funder or accept that they’ve made a small profit from their activities. Tether is more straightforward: you can transfer the exact amount needed, and it maintains its value.

Terrorists Using Tether

Read more

Extremists believe the success or survival of an in-group (most often their own) can’t be separated from “the need for hostile action against an out-group.” (JM Berger’s definition from 2018). As readers of this newsletter certainly know, extremist movements often resort to covert processes to finance actions against out groups. However, this isn’t necessarily the case for far-right extremists. Instead, many far-right extremist groups in North America (a subset of ideologically-motivated extremists) benefit from the overt sale of their merchandise.

While the public nature of the sale of far-right extremist products is by no means a secret, book sales, in particular, have been especially recognized in recent months due to the controversy surrounding Rupaul Charles’ drop-shipping site Allstora. While Charles said the secondary retail website would be “all-inclusive,” reports quickly emerged about far-right literature being included on the platform, including favourable translations of Mein Kampf and the Turner Diaries. At the time of writing, Allstora provides a platform for books sales by many far-right extremist groups, including the Cosmotheist Church (a white supremacist church founded by Turner Diaries author William Luther Pierce),1 publishers in the Order of Nine Angles, and the infamous neo-Nazi publishing company Antelope Hill.2

Of course, far-right extremist groups’ capacity to enrich themselves through the online shopping habits of supporters is by no means limited to book sales. (It’s not even limited to selling their merchandise, as Proud Boys’ chair Enrique Tarrio claims to have sold pro-Black Lives Matter attire to divert payment processor’s suspicions.) Far-right extremist groups also sell clothing, accessories, décor, music, and more. While many of these sales are direct, independent labels with links to white power groups also likely play a role in financing. A notable example is Midgard, associated with the Nordic Resistance Movement, and a retailer of white power music, merchandise, and books whose customer data was publicly leaked in December by Anti-Fascist Action Stockholm. In a preface to the leak, Anti-Fascist Action Stockholm describes Midgard as having “actively participated in and financially supported several Nazi organizations.”

Today, we’ll be looking at how five far-right extremist groups and two clothing brands with ties to far-right extremist groups raise funds through online sales. While these groups and brands are only a drop in the ocean in the vast ecosystem of far-right E-Commerce, they provide insight into how these outfitters typically operate.

Do you want to learn more about financial intelligence and how to use it in research, investigations, and analysis? Our financial intelligence fundamentals course is for you! Launching 2 July 2024, this course is perfect for people new to financial intelligence and seasoned professionals. Enroll today!

Read more

Back in late 2023, a Wall Street Journal article came out claiming that terrorist groups in Israel had raised over $130 million in cryptocurrency donations. ($93 million going to Palestinian Islamic Jihad, and $41 million going to Hamas.) The article said that wallets “linked” to these entities had received these funds. I was immediately skeptical – this would have amounted to a significant percentage of the group’s yearly revenues. While certainly possible, it did not seem probable, given the other ways that the group has moved money into and out of its territory.

Read more

30% off

We hope you’ll join our community and help us celebrate our 🎉3 Year Anniversary🎉! Alright, let’s get into today’s article, all about espionage, foreign interference, and of course, money.

Share

In 2020, Germany’s fastest-growing technology company (sometimes described as Germany’s answer to PayPal) announced that nearly €2 billion was missing from the company’s accounts. The financial scandal that led to this, and ultimately the collapse of the company, is worth reading, but today we’re here to talk about the espionage & foreign interference angle of the case. Because the story of Wirecard is not just one of fraud: it’s one about international intrigue, spies, Russian private military corporations, and how those threats get financed.

Subscribe to read more:

Read more

~Jess

Subscribe now

Entropy is a Canadian livestreaming service and donation platform. It garnered significant recognition between 2019 and 2021 for providing a payment platform to influential extremists who had been demonetized from larger platforms, including prominent white nationalist Nick Fuentes. Today, it is used by dozens of extremist livestreamers and facilitates donations from potentially thousands of users.

Entropy’s Network

Entropy was launched in 2019 by Chthonic Software, a tech company co-founded by David John Bell, Emmanuel Constantinidis, and Rachel Constantinidis in Calgary, Alberta. In the website’s first two years, it attracted significant influential far-right personalities as livestreamers (live video bloggers), including Canadian white Nationalist Stefan Molyneux, British neo-Nazi Mark Collett, and — most notably — US white nationalist Nick Fuentes.

In 2021, Entropy’s owners moved to Türkiye. While the platform’s management has become more secretive in recent years, and have ceased all public marketing, the website appears to still be a thriving platform among white supremacist and neo-Nazi streamers in Canada and the US. The size of Entropy’s channels and user base is difficult to quantify due to the website’s user interface. The site only displays a limited number of channels in any category, and there is no method to browse accounts. However, the site’s most-subscribed channel has over 3500 subscribers.1

While Entropy took steps throughout 2019 and 2020 to find and promote emerging far-right talent, it did not obtain or maintain exclusive streaming rights from its streamers. For example, Entropy’s most subscribed livestreamers are US neo-Nazi comedian and ex-Infowars host Owen Benjamin, Canadian white supremacist Jeremy Mackenzie, Nick Fuentes, and US antisemitic conspiracy theorist Ryan Dawson, respectively.2 Benjamin and Dawson both promote their livestreaming accounts with competitors’ platforms (Odyssey and Rumble) on their own websites, but neither include links to their Entropy streams on the same pages.3 In fact, Owen Benjamin — Entropy’s biggest channel — promotes social media accounts for 12 different platforms on his website, but his Entropy account is not one of them. Likewise, Fuentes’ primary streaming channel is on his own brand’s platform.

Financing Through Entropy

How Entropy is Used

Entropy has a relatively simple financial workflow. According to Entropy’s materials for livestreamers, the site asks streamers for their preferred method of payment, and an email address to receive invoices. However, the materials do not publicly specify which payment options Entropy accommodates. Entropy promises users that it does not store streamers’ financial information and claims it uses encryption for payments:

While Entropy’s payment process processors are not visible to viewers, Southern Poverty Law Centre (SPLC) reported that the site used Stripe before developing their own payment processing service. Chthonic’s Emmanuel Constantinidis told Entropy users on a Discord server that the service was developed after Stripe pressured Entropy to stop facilitating payments to Nick Fuentes.

Entropy’s domain is currently registered by the US-based ICANN domain registration service Namecheap.com.

In archived web pages retrieved by the SPLC, Entropy’s own materials, and interviews with Chthonic, Entropy claims to take 15% from paid interactions and promises no hidden fees to both streamers and viewers who donate. Entropy’s main services are paid chats that incentivize donations through increased interactivity with streamers. A common example is Youtube’s “Super Chats,” which Entropy has mimicked on their platform. Streamers often incentivize paid chat donations by promising to perform specific actions or discuss specific topics if people pay for Super Chats.

Entropy pays out streamers their 85% share of paid chat funds once per month. If payments do not exceed $100, they claim they move the payout to the next month, and so on, until a streamer is set to receive $100 in total.

Why Entropy is Used

Entropy provides many influential streamers with a financing solution that is relatively simple when compared to competing platforms. Entropy’s branding has largely focused on transparent pricing models, boasting that both streamers and donors face no hidden fees in their transactions on the website.4 This positions Entropy as a much more affordable alternative for demonetized streamers than starting their own streaming platforms, for example Alex Jones’s Banned Video.

Entropy’s personability as a brand and its genuine far-right politics could also be factors in livestreamers’ decisions to use the website. As a small company, Chthonic used to frequently promote relatively small livestreamer’s channels on its own social media accounts. Much like Gab, an antisemitic social media platform favoured by Entropy’s ownership and users, Entropy’s ownership regularly engaged in far-right narratives and memes on social media. Entropy owner Rachel Constantinidis also participated in right-wing political streams.5

However, this part of Entropy’s branding and promotion appears to have ceased. Entropy’s account on Gab has not posted since 2021, and the Entropy developers’ current Twitter account has not posted since 2023, while Chthonic’s Twitter account has been deactivated.6

Entropy’s greatest brand proposition to streamers and viewers is most likely Chthonic’s dedication that its streamers can remain monetized, even when faced with external pressure. The website has even monetized Unite The Right organizer Robert Ray when he was a fugitive from the law. Furthermore, in 2021, when Entropy was pressured by Stripe to demonetize Nick Fuentes, Chthonic created a new platform for Fuentes to avoid demonetization.

However, Entropy’s own terms and services are more limiting than some other internet platforms used by right-wing extremists. The website does not allow pornography, impersonation, or “revealing private information about someone with the intention of causing them harm.”7

Evidently, Chthonic’s loyalty to its streamers has not prevented them from cultivating larger audiences on competing platforms. Fuentes himself has since launched his own streaming platform, CozyTV, which he has promoted as an “anti-gay, anti-woman, anti-Black, antisemitic” streaming alternative.

An additional weakness in Entropy’s service is that the streaming quality is relatively poor, with lag being a common occurrence.

Entropy’s Finances

As a small, private company, it is difficult to gauge the costs incurred by Chthonic Software to build and maintain Entropy. Additionally, it is unclear if, or how, Entropy is marketed other than through extremist word of mouth. While Entropy could have spent money on social media marketing between 2019 and 2021, Chthonic seldom, if ever, publicly promotes Entropy today.

Prior to their move to Türkiye, Entropy’s owners appeared to be involved in development and marketing of Entropy, which could have reduced contracting costs for the company. Rachel Constantinidis often acted as the face of Entropy, at times appearing in videos promoting the platform posted to video platforms like Bitchute and Youtube.8 These videos had minimal production value, with much of the footage appearing as Constantinidis speaking to a webcam, and as such likely did not incur significant costs for Entropy.

The Entropy website is a .live domain registered through Arizona-based domain provider NameCheap.com. Other domains with similar names to Entropy’s website drastically range in costs, with many costing less than $10 per year and others costing several hundred.

While Chthonic software does not currently appear to operate a website other than Entropy, Entropy’s contact information includes emails registered to a second domain, which records indicate is also registered through NameCheap.com.

Because Entropy claims that no additional fees are ever incurred by its users, its ownership likely incur wire transfer fees to pay out the streamers (a fairly minor cost for the business).

Entropy does not appear to incur contracting costs for website maintenance or customer service. Instead, Chthonic’s owners’ personal emails are listed for troubleshooting support.9

A Canadian company but an international footprint

As of the time of writing, Entropy’s parent company Chthonic Software appears to still be registered as a company in Alberta. However, its business address has not been updated since before its owners moved to Türkiye. Businesses registered in Canada usually have a bank account at a Canadian financial institution; however, Chthonic might also have opened a bank account in Türkiye through which it processes its payments.

Türkiye is widely recognized for its leniency on terrorism financing. As such, it is unlikely that Entropy’s owners, who primarily provide financing to non-violent extremists, would face legal consequence from Turkish authorities. Further, Türkiye is preoccupied with other forms of terrorism and extremism, and is unlikely to view this activity as a threat to its security or worth taking action against. The situation could be further complicated by the fact that Entropy’s domain and the domain that Chthonic’s owners’ email addresses use are both registered to an address in Reykjavik, Iceland. However, this address has not been verified.

Conversely, deplatforming by other tech companies has hindered Entropy’s operations in the past. As the SPLC reported, Emmanuel Constantinidis claims Entropy was pressured by Stripe (a service that has been criticized for providing services to far-right extremists in the past) to demonetize Nick Fuentes. The site’s accompanying Google Chrome application also appears to have been removed from Google’s app platform. However, it is possible that Google has not fully deplatformed Entropy. Entropy has boasted integration with Youtube (owned by Google) and Twitch for simultaneous streaming capabilities since 2019.10 Login pages on Entropy and the website’s FAQ sections indicate that it is still integrated with both services, as well as Rumble, Odyssey, Cozy, and DLive.11

Share

Interested in learning more about terrorist financing and how best to analyze it? Sign up for our online course today!

© 2024 Insight Threat Intelligence Ltd. All Rights Reserved.

This newsletter and its contents are protected by Canadian copyright law. Except as otherwise provided for under Canadian copyright law, this newsletter and its contents may not be copied, published, distributed, downloaded or otherwise stored in a retrieval system, transmitted or converted, in any form or by any means, electronic or otherwise, without the prior written permission of the copyright owner.

If you haven’t read our initial analysis, you should go back and read it before continuing with this article, because it will explain our methodology and definitions.

Subscribe now

The Good News

Read more

Here at Insight Monitor, we are anti-Nazi. (Apparently this needs to be said in 2024.) But we are also pro-inquiry, and wanted to know exactly what Substack’s Nazi problem might look like, how much money Nazis might be making from their newsletters, and how Substack itself is profiting from this content. Basically: we wanted to qualify and quantify this problem in order to provide evidence for policy recommendations.

For those of you who aren’t subscribers, here’s the TL;DR:

• Nazis on Substack might make millions of dollars per year, with some creators making hundreds of thousands of dollars

• Substack itself probably makes hundreds of thousands of dollars per year on Nazi content

• Substack’s algorithm creates a network of Nazi substacks by recommending similar content

• We should not give Nazis money: Substack should demonetize and de-prioritize these newsletters (at the very least)

• GIFCT and Tech Against Terrorism should engage with Substack to help them develop better policies and practices

• States should consider legislation and regulations against the monetization of hateful content (ideally platforms do this themselves…)

Yesterday (8 January 2023), Substack announced that it would be removing Nazi publications from the platform. This is not a new policy — but rather a reconsideration of how it considers existing policies. The removals only apply to “credible threats of harm”. The application of the policy applies to five publications, and none of the publications removed had paid subscriptions enabled, and they accounted for about 100 active readers.

Subscribe to read more about how we came to these conclusions and our evidence-base:

Subscribe now

How we found Nazi newsletters

To find Nazi newsletters, we initiated our research using the publications of known white nationalists and neo-Nazis, for example, a newsletter mentioned in the “Substackers Against Nazis” controversy. We snowballed (expanded our sample) using Substack’s own suggestion algorithm, including dozens of suggested Substack publications in our initial dataset.

We also used subscriber lists to identify possible newsletters for inclusion. When newsletters had a low number of subscribers, we were able to use these lists to identify further newsletters that used hate-promoting iconography or language, and included these in our broader sample for further assessment against our criteria.

This is not an exhaustive examining of the Substack platform for Nazi material; instead, it is a sample in a broader population. The actual number of Nazi newsletters on the platform is unknown.

Inclusion Criteria

While we looked at nearly 100 publications, we analyzed the written content and imagery from 75 Substack publications (newsletters) whose contents clearly fulfilled one or more of the following attributes:

1. The publication uses Nazi symbols, terms, or slogans or explicitly defends, promotes, or celebrates Nazism.

2. The publication defends, promotes, or celebrates Adolf Hitler or other historic Nazis, or else defends or celebrates the Holocaust.1

3. The publication defends, promotes, or praises individual white supremacists or neo-Nazis.

4. The publication promotes White Supremacy or White Nationalism.2

5. The publication promotes antisemitism.

Evaluation

For each newsletter in the initial dataset, we looked at recent or pinned article titles and imagery against our inclusion criteria. Some of the newsletters initially included were excluded as they failed to meet any of our inclusion criteria, resulting in a final dataset of 75 Nazi newsletters.3

We also used keyword searches within the publication to determine inclusion and to analyze the content. Keywords promoting antisemitism and National Socialism included “Hitler,” “Jews,” “Holocaust,” and “ZOG” (Zionist-Occupied Government, a conspiratorial and antisemitic term commonly used by neo-Nazis). Additionally, keywords promoting white supremacy and white nationalism included “Blacks,” “white,” “race,” and certain anti-Black slurs.

While in many cases publications in our research promoted both National Socialism and white supremacy, 20 publications promoted white nationalism or extreme antisemitism without explicitly praising National Socialism or Nazism by name and without defending, denying, or celebrating the Holocaust or the actions of Nazi Germany in the second World War. At least five of these publications included articles by authors who were known to promote or defend Nazism outside of Substack.

In total, we found:

1.     45 newsletters used Nazi symbols, terms, or slogans or explicitly defend, promote, or celebrate Nazism.

2.     51 newsletters defended, promoted, or celebrated Adolf Hitler or other historic Nazis, or else defended or celebrate the Holocaust.

3.     65 newsletters defended, promoted, or praised individual white supremacists or neo-Nazis.

4.     69 newsletters promoted white supremacy or white nationalism.

5.     60 newsletters promoted antisemitism.

Over 40 publications included all five of our attributes, while only a few newsletters included only one of our attributes.

This categorization was based only on free material. We did not subscribe to any of these newsletters to identify further extremist or violent content. As such, this likely under-states the level of extremism / Nazi content in these newsletters, as authors might put the most extreme / inciting material behind a paywall.

Determining Monetization Levels

As readers of this newsletter know, creators who publish on Substack can choose to monetize their newsletters with a variety of subscription plans for their audience at monthly or annual rates. Additionally, publishers can choose to set a “Founding Member” subscription rate for their publication, which is typically more expensive than a standard subscription. A publisher can also let subscribers donate more money through the founding member option. While any Substack publication can be subscribed to for free, a publisher can choose to limit specific content to paying subscribers.

The exact number of paid subscribers that a Substack publication has is not available publicly. However, “bestseller badges” appear on Substack authors’ accounts, indicating authors with at least 100, 1000, or 10,000 subscribers. (It is possible to hide this badge.)

In our analysis, we used this publicly-available information to estimate minimum and maximum numbers of paid subscribers for each publication based on their bestseller badge (or lack thereof) and determined what the minimum and maximum amount of money the author could be receiving from their paying Substack subscribers.4

Further, substack claims 10% of a publisher’s subscription payments as platform fees, while credit card processing fees tend to claim an additional 3 to 5% of payments.

89% of publications including in our analysis had some option to monetize their content. However, the distribution of monetization is highly uneven, with some newsletters making little to no money, and others making (potentially) hundreds of thousands of dollars per year.

One particular publication that espoused extreme antisemitism, at one point mocking a fictional Jewish person as “Jewberg,” and that defended contemporary white nationalism, had at least 1000 paying subscribers. This newsletter might be generating between $87,000 and $1,000,000 per year. (The reality is likely somewhere in the middle — million-dollar newsletters are rare, but not impossible.)

Another newsletter in our sample displayed Nazi iconography, identified itself as antisemitic, and claimed that “most blacks [sic] don’t have any brain matter” in “the part of the brain that deals with logic, sound decision-making and higher-thinking in general”. This newsletter generated between $8,200 and $343,000 annually.

The Network Problem

In addition to the monetization of hate, Substack’s feature of recommending similar publications to readers provides hate-promoting publications with a valuable tool to reach new audiences. In our research, we used this feature to discover neo-Nazi and white supremacist’s newsletters that were not previously known to us. While this aided our research, it demonstrates that Substack users viewing the same publications are likely to be recommended similar materials.

The Profit Motive

In addition to the ethical controversies about the monetization of hate content, this analysis raises the issue of Substack’s culpability in allowing for an easy method for promoting hate content. According to analysis conducted using the search engine optimization tool Moz, Substack articles are relatively highly prioritized in search engine results, such as Google searches. While the search engine optimization of hate-promoting platforms varies, many independent blog sites and traditional forums frequented by hate movements are known to be low-priority in search engines. For example, the prominent neo-Nazi forum Stormfront has a domain authority of 65, which is significantly lower than Substack’s score of 92 (both measured at the time of publication).

Even in today’s social media environment, where hate speech is rampant on many major platforms, the extreme nature of many of the newsletters leads us to conclude that Substack is a uniquely large platform for financing hate content.

While many prominent neo-Nazis subscribe to Twitter/X Blue (for example former National Youth Front leader Angelo John “Lucas” Gage has amassed over 220,000 Twitter/X followers) — and as such are eligible for monetary gain for their Tweets promoting National Socialism and hate speech, the nature of how Twitter/X finances popular accounts means that payments for content can be inconsistent.

Conversely, financing through Substack is direct. As such, it can provide much more reliable, long-term funding than larger social media outlets with comparably relaxed content moderation policies.

These funds are important for these extremist content creators. Many of them have been publicly outed as neo-Nazis, white supremacists, and promoters of hate. These creators might find it difficult to obtain gainful employment because of the content that they produce, making them reliant on their Substack revenues. In other cases, they might be driven to produce more hateful content in order to drive revenue.

Finally, it’s worth noting Substack’s profit motive. While our estimates of revenue generation for these newsletters is crude, there is no doubt that Substack is profiting from this content. We estimate that Substack is generating somewhere between $24,000 and $724,000 in annual revenue from these newsletters — and our sample of Nazi newsletters is far from an exhaustive look at hate on the Substack platform.

The policy solution

Giving money to Nazis is not good. Without delving into the free speech issue (itself worthy of many newsletter articles), here at Insight, we tend to think that people should not be allowed to make money from hate. We agree with some of the proposals put forward in this thoughtful newsletter from Platformer that these newsletters should, at the very least, be demonetized. They should also not appear in recommendations or be promoted by Substack in any way.

If Substack is unwilling to take action, then it might be worthwhile for concerned newsletter readers to engage with Stripe, the payment processor, as some of these newsletters might breach their terms of service.

There are other options as well, some of which involve state intervention and new rules and regulations around monetization of hate content, which will be time-consuming and cumbersome to develop and implement. (And in the case of Substack, a US-domiciled company, will likely run into constitutional challenges.)

There’s also likely a role here for GIFCT and Tech Against Terrorism to engage with Substack and help the company develop better policies around the monetization of hate.

The easiest and best way forward is the one that, to date, Substack has refused to do: demonetize Nazis.

For now, Insight Monitor will remain on the Substack platform. We agree with Platformer that no platform is perfect. However, this is exactly the type of issue that will be weighed in our consideration of the future of this newsletter. Feel free to let us know what you think in the comments.

Share

Want to learn more about how violent events are financed? Check out our analysis of the financing of January 6th:

© 2023 Insight Threat Intelligence Ltd. All Rights Reserved.

This newsletter and its contents are protected by Canadian copyright law. Except as otherwise provided for under Canadian copyright law, this newsletter and its contents may not be copied, published, distributed, downloaded or otherwise stored in a retrieval system, transmitted or converted, in any form or by any means, electronic or otherwise, without the prior written permission of the copyright owner.

Subscribe now

In December 2022, four individuals were charged in the United States with conspiring the provide material support to ISIL. These charges are notable because of the extensive use of cryptocurrency and social media / messaging platforms to coordinate the funding of terrorism. They’re also notable because they include a woman in the group, as well as a Canadian citizen.

Insight Intelligence

Women Financing Terrorism

Welcome to the Insight Intelligence newsletter! And a special welcome to the new subscribers this week – I love seeing our community of interest grow. This week’s analysis is all about the role of women as financial facilitators and terrorist financiers. If you find this analysis interesting, please share it with a friend…

Read more

4 years ago · Jessica Davis

Read more

This analysis was last updated on 29 August 2023

Subscribe now

In 2021 and 2022, the cement giant LafargeHolcim was investigated and prosecuted for terrorist financing. Lafarge's subsidiary in Syria is suspected of paying roughly $5 million  in protection money to armed groups in Syria in order to keep the Jalabiya cement plant open, with an estimated $500,000 paid to the Islamic State (ISIL). The company also bought raw materials from individuals connected to ISIL or from individuals in ISIL-controlled territory, potentially further supporting the group in this manner. Lafarge also reportedly paid €220,000 to release staff kidnapped in 2012. Keeping the cement operation open allowed Lafarge to obtain approximately $70.3 million in revenue, and Lafarge also expected ISIL to take action against its competitors by stopping the sale of competing imported Turkish cement or by imposing taxes on competing cement.

Read more

Subscribe now

Last week, the United States imposed sanctions on 20 people for financially supporting ISIL and Al Qaeda in the Maldives. These designations also include people accused of supporting ISIL-Khorosan Province.

The designation focused on the Addu City cell in the Maldives that has attempted to conduct terrorist attacks since 2018 and the ISILS-affiliated criminal gang Kuda Henveyru, which has attempted to fundraise for Maldivian ISIL foreign terrorist fighters in Syria. The designation includes a number of individuals and their companies, many of which can be found in the Maldives’ rather excellent corporate registry. A number of these individuals and companies have other associated individuals and corporations not included in the sanctions that can be explored through the business registry.

Some of the funds raised were sent to ISIL in Indonesia, as well as Turkey.

One of the individuals sanctioned, Ali Shafiu, controls a crypto address on the TRON blockchain. Here’s an interesting excerpt from a Chainanalysis report:

TRM Labs found  on-chain transactions from Shafiu’s address to addresses that they have associated with the media units of ISIL-KP and ISIL in Pakistan.

The question many of you might have is why crypto? The Maldives has a rather bustling cryptocurrency sector. Some resorts there even accept cryptocurrency as payment. For terrorists operating in small countries, cryptocurrency might hold even more appeal than other methods of moving money, since they can avoid interacting with compliance staff or having their transactions caught up in geographic targeting and monitoring. And as the United Nations reported back in July, ISIL is increasingly using cryptocurrency for international funds transfers.

Did you find this article interesting? Share it with a friend and help us grow our community!

Share

Subscribe now

In June, a man in the United States was arrested and charged with concealing terrorist financing. Mateo Ventura allegedly purchased a number of gift cards and provided the access codes to his contact (whom he believed to be a member of ISIS, but was actually an online covert employee - OCE). The contact told Ventura that he sold the gift cards online on a dark web marketplace, and sent the funds to ISIS.1

While a rarer method of terrorist financing, this particular case is interesting in its use of dark web marketplaces, and is worth understanding more detail, particularly in terms of identifying this type of activity in subjects of interest or investigation.

Read more

Read more

Read more

A warm welcome to our new Insight Intelligence subscribers! Last week we crossed the 3k subscriber threshold, and I have to say, I’m rather pleased that so many people find this newsletter interesting and useful. Thank you to all who have joined us, and who share this newsletter! This week, we’re taking a look at a terrorist financing case from the UK. We normally focus on terrorist attack financing, or terrorist organization financing. This case is a bit different, because it involves a terrorist financier: someone whose purpose and goal is to provide funds for terrorist activity. Let’s dig in.

Subscribe now

At the beginning of January, a Barber shop owner in the UK (Tarek Namouz) was jailed for using COVID grants to fund terrorism. He received a 12 year sentence for sending funds he received from COVID relief to Islamic State terrorists in Syria. At the time of the offence, he was on licence for raping a woman. The funds were sent through a currency exchange in West London. The investigation found transfers totalling £11,284.69, but he claimed to have sent £25,000 to an Islamic State member to purchase sniper rifles and prepare for an attack against the Syrian government. As part of his defence, he claimed to have sent the funds to help the “poor and needy” in Syria. The funds transfers were coordinated through WhatsApp messages. He regularly deleted the messages as part of his operational security. He sent the funds in seven transfers over the course of months, starting with a small transfer of £100, before increasing the transfers to between £1,500 and £2,700 at a time.

There are a number of things that are interesting in this case that are worth highlighting because they speak to broader trends in terrorist financing and efforts to detect and disrupt it: the currency exchange, the amounts sent, coordinating on WhatsApp, and the ‘cover story’.

Read more