Twenty-five years ago, terrorism financing ran through a system that the authorities could barely see into. Organising the September 11 attacks cost an estimated $500K, and the money moved using the tools available in 2001: bank transfers, cash carried through airports and hawala — a trust-based network of intermediaries that settle up with each other without any cross-border banking record.
The counter-terrorism financing system built in response focused on tools such as sanctions, mandatory reporting of suspicious transactions and pressure on the banks that handle international transfers.
A quarter of a century later, a growing share of terrorist money moves through crypto infrastructure.
The trust-based hawala economy of the early 2000s still exists, but a crypto layer dominated by stablecoins — cryptocurrencies designed to hold a relatively stable value — has now appeared on top of it. That infrastructure gives investigators an advantage thanks to the transparency of the blockchain, yet adversaries are already looking for ways around it. At the same time, the first signs of generative AI use are starting to appear. Over the next few years, much will depend on how quickly law enforcement can act on the information it can see on the blockchain, while terrorist networks experiment with assets that are harder to freeze, transactions that are harder to trace and, potentially, AI-assisted fundraising.
How the financial channels changed after September 11
Before September 11, Al-Qaeda and its affiliated networks moved most of their money through hawala, large amounts of cash carried by couriers and charities used as cover.
By 2019, Hamas — or, more precisely, its military wing, the Izz ad-Din al-Qassam Brigades — was among the first terrorist organisations to start using crypto actively, collecting donations in bitcoin. After the collapse of the physical ISIS caliphate and the spread of its activity through affiliates in Afghanistan, Somalia, Nigeria and the Sahel, the practical task changed as well. Individual units needed to send small amounts to scattered cells across borders, in regions where normal banking infrastructure barely works. Crypto made that possible.
What began as a niche practice later spread more widely. In early 2023, the UN Analytical Support and Sanctions Monitoring Team reported that the Somalia-based Al-Karrar office, linked to ISIS, regularly transferred crypto directly to the Islamic State Khorasan Province (ISKP) in Afghanistan.
Other research into on-chain flows also shows that ISIS units increasingly transfer funds to each other directly through crypto infrastructure. Crypto has also been central to raising money for ISIS members and their families held in camps and detention facilities in Syria, which remains one of the most persistent drivers of crypto use among the group's supporters.
The crypto received is often converted back into local currency through regional crypto exchanges and informal intermediaries. This is the same final cash-out stage that mattered in 2001 as well. Until recently, terrorist organisations used crypto mainly for general fundraising and to cover operating costs. Now crypto is moving deeper into the financing of attack preparation itself. ISIS units in Africa, for example, have openly solicited crypto donations to buy weapons and drones, while Yemen's Houthis have gone further, using crypto to acquire dual-use goods employed in unmanned aerial vehicles (UAVs) and counter-UAV systems. The suppliers of such goods included a Russian intermediary reselling Chinese-made systems.
Terrorist money still passes through the same regional exchanges, intermediaries and professional launderers that serve cartels, drug traffickers and fraudsters. In 2025, the designation of eight cartels and transnational criminal groups as Foreign Terrorist Organizations (FTO) formally brought this shared money laundering infrastructure into the scope of counter-terrorism financing.
What AML in cryptocurrency is and how it worksRead more
Crypto transparency gives law enforcement an advantage
When terrorism financing moves onto the blockchain, investigators gain a level of visibility that does not exist when working with cash. Transactions on public blockchains can be traced, and in the case of stablecoins the funds can often be frozen. It is cash that is the genuinely difficult target for an investigation. Banknotes moving through informal networks leave far less information to examine.
On a public blockchain the situation is reversed. That transparency can translate directly into real law enforcement action.
Experimentation is expected to continue in this direction with cross-chain swaps and privacy-focused cryptocurrencies that make it harder to trace the movement of funds.
Law enforcement is targeting the same financial channels
Since March 2025, the US Department of Justice has recovered about $560K across five separate operations against money flows linked to Hamas. Every case described the same pattern, with constantly rotating deposit addresses. The number of law enforcement actions — arrests and seizures — against groups and individuals using crypto to provide material support for terrorism has been growing steadily since 2020, as shown below.
Prosecutors have also exposed sham charities that collected money through popular crowdfunding platforms and then converted the proceeds into crypto and moved them further along the criminal chain.
How to keep the advantage: analytics, attribution and training
The share of terrorism financing that runs through crypto is likely to keep growing. To date, generative AI has not featured in a single documented terrorism financing case. If it does start to be used, this will most likely happen first in low-visibility forms — for example, creating synthetic identities or mass-producing fundraising appeals in different languages. Two directions deserve particular attention: assets resistant to freezing and tracing, whose spread is still uneven, and the growing overlap between cartel money laundering and terrorist organisations now that both categories fall under the same sanctions mechanisms.
Transparency alone is not enough.
Over 25 years, terrorism financing has changed along with terrorism itself and with the methods used to fight it: from banknotes and hawala, the system has gradually expanded to include stablecoins on public blockchains. One thing, however, has not changed: money must ultimately turn into physical resources, the movement of people or goods, and a safe place to use them. Every such conversion creates a point at which the movement of funds can be detected.
In 2001, terrorist money ran through a system the authorities could barely see into. Today, counter-terrorism specialists have a rare advantage: a significant part of that money moves across a blockchain whose data can be read and analysed. But this advantage is limited and does not sustain itself: it works only where analytics, attribution and trained investigators are present at the same time, and only for as long as adversaries have not moved en masse to assets built to resist freezing.
