Beyond Anecdotes: Terrorist Financing Has Moved to Crypto

Six years of data on terrorist financing proves it

This week, we’re taking a close look at how terrorists move money. Drawing on our Trends in Terrorist Financing 2020-2025 dataset, we can now say with authority that it wasn’t just a blip: terrorist financing mostly happens through cryptocurrency now. Have a read to learn about the data behind this bold statement, and what it means for the future of countering the financing of terrorism.

The Data

This research grew out of frustration with claims about “new” or “increasing” terrorist-financing trends that are made without evidence. To address this, the project built its own empirical foundation by systematically collecting and coding real-world cases of terrorist financing over the past eight years. Each case captures reported financial activity used to support terrorism and is analyzed using a six-part framework that examines how funds are raised, used, moved, stored, managed, and concealed. The approach emphasizes observable activity.

The data are drawn exclusively from open sources, including media reporting, court documents, and government publications, and are subjected to a multi-stage validation process to ensure consistency and accuracy. The resulting dataset contains more than 21,000 data points across 1,150 cases, coded across 19 variables such as country, group, financing methods, and sources. While collection began in 2018, analysis relies on cases from 2020 onward, when data quality became sufficiently robust. Together, this methodology provides a rare evidence-based foundation for assessing terrorist-financing trends and testing claims about how those activities evolve over time.

Learn more here.

When Terrorists Used Banks

When Illicit Money was published in 2021, banks remained the primary channel through which terrorists moved money internationally, despite more than two decades of sustained counter-terrorist financing efforts. This persistence reflects a core challenge in CTF: terrorist financing is extraordinarily difficult to detect within the formal financial system. Large organizations such as Hamas and Hizballah have relied on complex front-company networks to obscure illicit activity, while small cells and lone actors typically move modest sums that attract little scrutiny.

In practice, many terrorist transactions closely resemble ordinary remittances or everyday financial activity, making them hard to distinguish from legitimate flows. The amounts involved are frequently below mandatory reporting thresholds, which vary by jurisdiction but are easily circumvented in the context of terrorist financing. Detection becomes even more challenging when terrorist networks benefit from a trusted insider within a financial institution or affiliated business, further blurring the line between licit and illicit activity.

Crypto Enters the Chat

Around 2022, a noticeable shift emerged in terrorist financing patterns, with cryptocurrency appearing with increasing frequency across cases. This change intersects with nearly every aspect of my investigative, research, and policy work, reflecting how digital assets have moved from the margins to the mainstream of terrorist money movement. Today, cryptocurrency is present in roughly 8–12 percent of documented cases and has become the most visible method for moving funds, in part because it dominates in volume and is easier to observe, trace, and publicly report on than many traditional methods like hawala.

Keep reading to find out how we know this, and what it means for the future of counterterrorist financing:

Financial Intelligence Fundamentals

Do you want to learn more about financial intelligence and how to use it in research, investigations, and analysis? Our financial intelligence fundamentals course is for you! This course is perfect for people new to financial intelligence and seasoned professionals. Enroll today

Cryptocurrency functions as a complementary mechanism, operating alongside established financing methods rather than supplanting them.

The growing role of cryptocurrency is largely explained by its accessibility. Terrorist actors initially experimented with crypto as a proof-of-concept and, once they confirmed how easy it was to use, gradually adopted it more systematically. Adoption has not been universal, however. Groups that face little counter-terrorist financing pressure have had few incentives to change established practices, while those under sustained scrutiny have been more willing to innovate. Even so, cryptocurrency presents a persistent constraint: converting digital assets into usable cash remains a significant vulnerability, shaping how, when, and why terrorist groups ultimately rely on crypto in practice

Data provided by Insight Threat Intelligence Ltd.

Crypto-Hawala and the Democratization of Informal Value Transfer

One of the most significant developments in recent years has been the rise of crypto-hawala, or over-the-counter brokers, which has effectively democratized access to hawala services. Because most countries do not recognize cryptocurrency as legal tender, digital assets cannot be used directly to purchase everyday goods or specialized items, including components for terrorist attacks. In practice, this means that crypto must usually be converted into cash or state-issued currency before it can be used.

Crypto-hawalas fill this gap by adding a new capability to traditional hawala networks: the ability to receive cryptocurrency and cash it out on behalf of clients. I first observed this adaptation during investigative work on ISIL financing in Syria, and later in Afghanistan, where it was often used to bypass Taliban control over the formal financial system. Since then, this model has spread across the Middle East and beyond, significantly lowering barriers to entry. What was once a relationship-based system has become far more accessible, allowing a much wider range of actors to access hawala networks and convert cryptocurrency into usable cash.

Confronting Crypto Risk: Regulation, Adaptation, and Intelligence Exploitation

Countering crypto-enabled terrorist financing is often framed first through regulation, but this approach faces real and persistent constraints. Regulatory frameworks vary widely across jurisdictions in both law and enforcement, creating uneven pressure points that illicit actors can exploit. One proposed measure is to require regulated crypto platforms to transact only with other regulated entities and to de-risk relationships with high-risk jurisdictions or platforms. In theory, this could raise the cost of abuse. In practice, however, illicit actors adapt far faster than policy systems can respond, cycling through new platforms, wallets, and techniques long before legislation, regulation, or supervisory guidance can be updated. While platforms might technically be able to keep pace with these adaptations, they are often poorly incentivized to do so consistently and proactively.

This gap points to the need for a more fundamental reassessment of how states approach crypto risk. The financial system has absorbed a new vulnerability, and incremental fixes are unlikely to be sufficient. Rather than focusing exclusively on stopping the flow of funds, there is also a strong case for exploiting crypto-enabled activity more deliberately for intelligence purposes. Blockchain transactions, associated wallets, and cash-out points can provide valuable insight into networks, facilitators, and geographic linkages that are far harder to observe in cash-based systems. A more effective strategy could therefore combine selective disruption with systematic exploitation of intelligence, using crypto not only as a target of enforcement but also as a source of insight into terrorist financing networks and their broader ecosystems.

Ultimately, addressing crypto-enabled illicit finance requires a collective “come to Jesus” moment about the vulnerability digital assets have introduced into the global financial system. The use of cryptocurrency for illicit activity is no longer marginal or experimental, and there is little evidence that this trend is slowing. Incremental regulatory adjustments and reactive enforcement will not be enough to meet a challenge defined by speed, adaptability, and technological change.

What is needed instead is genuine policy innovation: new legal frameworks, new incentive structures for platforms, and new ways of integrating intelligence, enforcement, and financial oversight. Without a decisive shift in approach, responses to crypto-enabled illicit finance will continue to lag behind the threat. The choice is no longer between action and inaction, but between rethinking the system now or remaining permanently on the back foot.

Did you find this article insightful? Share it with friends and colleagues to help grow our community and help make the world safer and fairer for everyone.

© 2026 Insight Threat Intelligence Ltd. All Rights Reserved.

This newsletter and its contents are protected by Canadian copyright law. Except as otherwise provided for under Canadian copyright law, this newsletter and its contents may not be copied, published, distributed, downloaded or otherwise stored in a retrieval system, transmitted or converted, in any form or by any means, electronic or otherwise, without the prior written permission of the copyright owner.