memri
June 4, 2021 MEMRI Daily Brief No. 281

Jihadis On Using Cryptocurrencies – The Next Threat

June 4, 2021 | By Steven Stalinsky*
MEMRI Daily Brief No. 281

A seminal MEMRI study The Coming Storm: Terrorists Using Cryptocurrency published August 2019 focused on jihadis' growing use of cryptocurrencies and the threat that this poses, and documents how these groups and individuals are already extensively fundraising in cryptocurrencies – including for attacks and for weapons and equipment purchases, for food and necessities for fighters' families, and more. It also examined how they are promoting and discussing their use on various online platforms. The research showed jihadis' growing sophistication over the years in using cryptocurrencies, and their recommendation of them as simple, safe, and secure.

Read the preface, introduction, and part of the report here. The full report can be requested with full credentials.

Since the report's publication, terrorist groups have continued to experiment with using cryptocurrency – which has captured the attention of government and counterterrorism officials. In February 10, 2021 comments that received widespread attention in media that focus on cryptocurrency, U.S. Treasury Secretary and former Federal Reserve Chair Janet Yellen said that cryptocurrency use for illicit purposes is "a growing problem" and has "been a tool to finance terrorism." She added, '"We are living amidst an explosion of risk."[1]

It was reported on May 25 that the Biden administration, lawmakers, and central bankers are attempting to tackle new cryptocurrency challenges. Administration officials are said to be studying potential "gaps" in oversight related to the cryptocurrency market, such as whether it can be used to finance illicit or terrorist activities. Earlier in May, Treasury Department officials briefed White House officials about the risks posed by cryptocurrency, and the issue has been discussed by federal regulators; it has also been raised in conversations with federal regulators involving the Treasury's Office of the Comptroller of the Currency and the Consumer Financial Protection Bureau (CFPB).[2]

In a recent interview with Wired magazine  about terrorist use of cryptocurrencies, I explained that developments over the previous year had revealed that at the time the MEMRI report was published, there had been a major increase in jihadi groups' use of cryptocurrencies, making it "the most significant and dangerous recent development in global terrorism." Part of the discussion with Wired focused on Telegram's possible launch of its own cryptocurrency and wallet; as that did not occur, the overall threat of jihadi use of cryptocurrency diminished somewhat.

Also as part of the interview, Wired was provided with links to many current jihadi Telegram accounts using cryptocurrency for a range of purposes – fundraising, courses, and more, and I pointed out that following the U.S.'s largest ever seizure of jihadi organizations' cryptocurrency accounts, and the wave of arrests and indictments in France, India and the UK in connection with jihadi fundraising, there is less open discussion of cryptocurrency in known jihadi channels but its use continues.

This "does not mean that they are not doing these things – this activity is likely more underground and less public," but there has been a "huge uptick" in the adoption of cryptocurrency by domestic terrorist groups in the U.S. and Europe, including for solicitation campaigns to finance violence, "following in the footsteps of jihadis."

A recent example documented by the MEMRI Jihad and Terrorism Threat Monitor (JTTM) was a February 18, 2021 post by the jihadi "Digital Awareness in the Liberated Areas" Telegram channel operated by a user who appears to reside in the Idlib, Syria area, which is controlled by Hayat Tahrir Al-Sham (HTS) and its affiliates. The post stated that the channel would provide guidance regarding the best platforms for using cryptocurrency in order to serve "our brothers, the mujahideen, and our steadfast people" in Idlib.[3]


Hayat Tahrir Al-Sham channel details how to use cryptocurrency. February 18, 2021.

Just today, the MEMRI Jihad and Terrorism Threat Monitor (JTTM) published a report about Hamas's online fundraising campaign through which it accepts donations in Bitcoin. Its website features video tutorials in Arabic, English, French, Turkish, Malaysian, Russian, and Indonesian explaining how to send secure donations via Bitcoin. It also regularly shares links on its Telegram channel to a page with new Bitcoin addresses where donations can be sent. The most recent of these posts, dated June 1, included a quote from the Quran encouraging readers to "strive with your wealth and your lives in the cause of Allah" – i.e. to donate.[4]

Al-Qaeda-Affiliated Magazine Explains And Recommends Cryptocurrencies, Offers $60,000 Reward In Bitcoin For Killing Police In The West

Among those clearly paying attention to what jihadis online are saying and doing with regard to cryptocurrency are the leadership of both Al-Qaeda and ISIS.  Over the past year, as Western media have continued to report on cases of criminal use of cryptocurrency, jihadis have paid close attention.

The second issue of the pro-Al-Qaeda Syria-based Jaysh Al-Malahim Al-Electroni media group's "Wolves of Manhattan" online magazine, released April 14, 2021, included several articles on cryptocurrency, along with articles inciting Al-Qaeda supporters in the West to exploit civil unrest to carry out lone wolf attacks and offered $60,000 in Bitcoin to the first person to kill an police officer in a Western country. The reward, it said, is available to any Christian, Jew, or atheist who does so, and it added that these funds are being provided by another party, not by the group.[5]

The issue's opening article, titled "The Lone Wolf And The Protests," tells supporters to carry out terrorist acts, including attacking police officers, under the cover of protests that are taking place. It identifies the U.S. and France as top countries currently experiencing civil unrest, along with Italy, Germany, and the UK. It advises that the lone wolf can easily disguise himself as a protestor in order to infiltrate these groups and steer them to carry out violent actions such as vehicular attacks.


Announcement offering reward for killing a police officer.

Feature articles in the "Wolves of Manhattan" issue included one on Bitcoin and a two-part series on cryptocurrencies and how people in a blacklisted country can obtain cryptocurrencies.[6] The first article in the series gave a general overview of cryptocurrency history from 2009, stating that it was developed by "Satoshi Nakamoto" in the aftermath of the 2008-2009 economic crisis that led to the collapse of Lehman Brothers, the fourth-largest investment bank in the U.S. According to this article, Nakamoto developed the concepts of e-money and cryptocurrencies, and Bitcoin is the practical representation and application of the concept of cryptocurrencies.

Highlighting the differences between digital currency and cryptocurrency, the article stated that the former is broader than the latter, and that digital currencies include cryptocurrencies, Central Bank Digital Currencies (CBDCs), victual currencies, e-cash, and more. Cryptocurrencies, it said, include Bitcoin, Ethereum, BlackCoin, Bitcoin Cash, Tether and others, collectively referred to as altcoins. It explained that digital currency operates under the umbrella of e-money and that the difference between e-money and digital currencies is that e-money represents the fiat currency (euro, dirham, dollar, etc.), but virtual currency is not equivalent to any fiat currency.

Following an explanation of how to buy and sell cryptocurrencies, the article discussed digital wallets (e-wallets), noting that they are software-based and can be downloaded as a mobile app that allows users to store their digital currencies, make transactions, and track payments.

The second article in the "Wolves of Manhattan" series set out steps for handling digital wallets and taking security measures to ensure that the wallet owner is not tracked. It listed measures such as using a Gmail account that is created while using a VPN if the wallet is downloaded from Apple Store or Google Play; ensuring that the wallet is compatible with the operating system of the device on which it is stored; ensuring that the VPN is active when accessing a hot wallet; ensuring that the VPN is active when connecting a cold wallet to the internet; and creating a paper wallet, which is "the most secure to protect cryptocurrency." The author highlighted that he would provide a separate lesson on paper wallets in the future.

The difficulty of obtaining cryptocurrencies in a country that is blacklisted was discussed, and the article noted that the easiest way to do this is to find someone in a country that is not blacklisted to purchase them and send them to the person in the blacklisted country. Those in non-blacklisted countries should avoid buying cryptocurrencies using a cold wallet, it added, because they offer non-optimal prices, and that they should review other prices on forex websites.

Included in the article was a phone screenshot showing a disparity of nearly CAD $4,000 for the same cryptocurrency purchase on two different cryptocurrency purchasing platforms, and advised readers to examine several to be sure they are getting the most for their money.

The article also provided a screenshot of a transfer of cryptocurrencies from the wallet of someone not in a blacklisted country to the wallet of someone in one, and another of a purchase of cryptocurrencies using the address of the person in a blacklisted country without using the wallet of the person in a non-blacklisted country. It concluded by assigning readers homework: searching online for local cryptocurrency sellers in their city.

ISIS Ridicules Al-Qaeda Call For Using Cryptocurrency: Don't Do It – It's A Security Risk

Within days of the publication of the Al-Qaeda-affiliated "Wolves of Manhattan" issue with articles focusing on Bitcoin and other cryptocurrencies, ISIS called on its followers not to use Bitcoin. On April 17, 2021, the pro-ISIS Electronic Horizons Foundation (EHF), which disseminates technical and cyber security-related information to supporters, released a poster in Arabic, English and French on its website warning readers not to use Bitcoin for transactions.[7]

The posters, which were widely circulated on pro-ISIS online channels on Telegram, warned that Bitcoin transfers are not safe and that they are monitored and this information is provided to government authorities. The posters also refer to a July 2019 article published by EHF, "Introduction to Safe Financial Transactions," that warned about security threats faced by ISIS supporters who send and receive money online.

The English version of the poster states: "We warn Al-Ansar from using Bitcoin currency for financial transactions and money transfer, as Bitcoin logs the financial records and transactions on the Blockchain, which is a database of Bitcoin transactions, and allows tracking of transfers from the sender and receiver. We also warn that the money transfer services and sites (Exchanges) to Bitcoin logs IP addresses and the purchase data of (Bitcoin currency), and these sites also cooperate with government agencies. Therefore, we advise our brothers to follow the maximum possible security measures – God willing – and we warn against using common methods in financial transactions which we mentioned its risks in this article 'Introduction to Safe Financial Transactions.'"

ISIS followers online appeared to be paying attention. Days after ISIS issued its warning, members of a pro-ISIS Telegram group circulated a warning concerning a Telegram user posing as an ISIS supporter who is actually an intelligence agent, and claimed that he had helped in the arrest of a female supporter from Morocco after she used Bitcoin. They posted an EHF warning that Bitcoin poses a security risk.

What's Next Regarding Terrorist Use Of Cryptocurrency?

As this debate between ISIS and Al-Qaeda and their followers plays out, cryptocurrencies are increasingly being used by domestic terrorist groups in the U.S. and abroad. These groups have looked to jihadi organizations who have faced similar obstacles to online activity, and have proven their ability to adapt.

But the question is, how serious is this problem? As I told Cointelegraph.com in an April interview, "following the fall of ISIS's caliphate, [cryptocurrency] quickly became even more important for them. But this use has not recently developed to the extreme proportions that it could have and still might. Any arrests and public news of jihadis using cryptocurrency has so far led to the companies acting to shut down these and related accounts, and this seems to be creating a balance to curb the problem."

The interview noted that there is an upsurge among domestic terrorists in the use of and references to cryptocurrencies – "very much like what happened with jihadis a few years ago. [However,] after the events of January 6, when the U.S. Capitol building was stormed by extremist groups, there is more pressure to go after these groups' fundraising online. A year ago it was common to see many of these individuals, groups, and organizations openly using mainstream banking platforms, from major credit card companies to regular banks, Apple Pay, PayPal, and other platforms." While they have been largely forced off these platforms, they still need to raise funds – "whether for recruitment, solicitation of support, or sales of merchandise such as books and clothing lines – through cryptocurrency wallets, which they are all using and promoting."

*Steven Stalinsky is Executive Director of MEMRI.

For more on cryptocurrency and terrorists, visit the MEMRI Cyber & Jihad Lab.

 

[1] Coindesk.com/crypto-use-in-terrorism-a-growing-problem-yellen-says, February 10, 2021.

[2] Washingtonpost.com/us-policy/2021/05/25/biden-bitcoin-crypto-markets, May 25, 2021.

[3] T.me/USDT_Syria_almuharir/12.

[4] MEMRI JTTM report Hamas Continues To Fundraise Via Cryptocurrency, June 3, 2021.

Share this Report: