The group also appeared to be recruiting its members into a jihadi cryptocurrency trading arm. “After a period of learning, some brave people who will devour the digital field with their teeth will be chosen to be members of our humble team,” reads one message, translated from Arabic. Before it disappeared, the Telegram channel reposted content on trading strategies from a 17,000 member, non-jihadi Telegram group that teaches people how to make money using trading bots.
The jihadi trading channel shared content about a range of cryptocurrencies, including Avalanche, Cardano, Fantom, Litecoin and 1INCH, among others. A message sent to the group on March 11 appeared to be soliciting donations to supply Muslim refugees with cryptocurrency wallets and Tether. It linked a Tether address associated with the Tron blockchain. Soliciting charity is a common pattern in jihadi fundraising campaigns. In many cases, crowdfunding campaigns were military operations posing as charities – phenomena referenced in the Department of Justice indictment and that has been widely documented throughout the civil war.
Jihadi crowdfunding campaigns of this type were once commonplace, but are less widespread since the August indictment and similar arrests in France, India and the UK. In France in October, 29 people were arrested in connection to a crypto-financing scheme architectured by two HTS militants, Mesut S and Walid F, which involved sending bitcoin into Syria using anonymous coupons. According to MEMRI, the crackdown has led to less open discussion of cryptocurrency in known jihadist channels. But evidence remains that the use of cryptocurrency by jihadi groups in Idlib continues.
“Our monitoring has seen significantly less usage of cryptocurrency by jihadis, and less discussion of it among them as well,” says Steven Stalinky, executive director of MEMRI. “However, that does not mean that they are not doing these things – this activity is likely more underground and less public.”
Stalinky adds that while jihadi usage of cryptocurrency is less noticeable, MEMRI has seen a “huge uptick” in the adoption of cryptocurrency by domestic terrorist groups in US and Europe. In particular, Stalinky says that MEMRI has seen an increase in the adoption of cryptocurrency by white-supremacist and neo-Nazi groups that are using donation campaigns to finance violence. “They are following in the footsteps of jihadis,” he says.
Read more: A blockchain tweak could fix crypto’s colossal energy problem
MagniF!le, a Syria-focused research agency, has been conducting investigations into the use of bitcoin in Idlib following the crackdowns by the US and France. The agency, which had previously reported on Syrian mercenaries in Libya, began by identifying Telegram channels associated with jihadi crowdfunding campaigns. MagniF!le says it gets its information through a combination of open-source intelligence and information provided by pro-government forces that are investigating the use of cryptocurrency by jihadists.
During its investigation, MagniF!le uncovered more than 120 Telegram groups chats and channels, including many it claims are connected with HTS and Isis. To investigate the process for donating bitcoin, MagniF!le talked to eight-channel administrators. Four provided bitcoin addresses where money could be sent. In the remaining four cases, alleged militants were reluctant to openly share bitcoin addresses. One person suddenly backed out of a trade and deleted the chat. MagniF!le adds that bitcoin is becoming less attractive to jihadists since the indictment including BitcoinTransfer. Instead, it is claimed, militants are turning to less high profile cryptocurrencies, such as Dash, Ripple and Ethereum, and anonymous cryptocurrency Zcash.
MagniF!le also claims that jihadi groups are changing tactics to avoid detection by Western law enforcement. Before, groups could send money using anonymous coupons. Since this funding stream was captured by French authorities, jihadis have allegedly switched to more secure means of payments, using single-use Electrum wallets and cryptocurrency mixing services hosted on Tor. Security concerns may be driving the adoption of Tether by exchanges in Idlib. In Telegram channels, Tether is described as a “private” and “secure” alternative to bitcoin.