The bitcoin terrorists of Idlib are learning new tricks

April 3, 2021

Terror-linked groups in war-torn Idlib are changing their crypto tactics to avoid detection by Western law enforcement

In a small shop overlooking the dusty streets of Idlib in northwestern Syria, a group of men sit huddled around a laptop watching the price of bitcoin skyrocket. Outside, the city is devastated by war, but the men’s eyes remain locked on the price chart – they are trying to turn $10 into $20 through Shariah-compliant trades.

These men are part of a small cryptocurrency community in Idlib, an enclave of Syria run by former Al-Qaeda affiliate Hay’at Tahrir al-Sham (HTS). A sign on the wall reads “BitcoinTransfer” – it’s one of many shops in the area that buys and sells cryptocurrencies for cash.

But BitcoinTransfer is also at the heart of a network providing money to terror groups. In August 2020, the US Department of Justice revealed BitcoinTransfer had acted as a central hub in six terror-funding operations and called for the forfeiture of 155 cryptocurrency addresses linked to the exchange. Other research has also pointed to BitcoinTransfer’s jihadist connections.

The indictment hasn’t stopped cryptocurrency usage in Idlib. In fact, new evidence points to jihadis becoming more security conscious: switching away from the heavily monitored bitcoin into a wider range of cryptocurrencies and using VPNs to side-step surveillance and sanctions. They’re also getting into trading – running classes on technical analysis and recruiting young people into trading groups on Telegram.

The increasingly sophisticated approach to cryptocurrency trading builds upon a long documented history of digital currencies being used to fund terrorism. HTS, the jihadi faction controlling Idlib, has an openly pro-cryptocurrency stance. In 2019, it called bitcointhe “Currency of the Future Economy” and released a 26-minute video of a HTS cleric discussing its compliance with Shariah-law. The faction has also regularly promoted BitcoinExchange since June 2019.

But HTS is not the first jihadi group to adopt cryptocurrency – the technology been used by militants across Syria for at least seven years. Among the first documented instances of this was in July 2014, when an Isis-affiliated blog proposed the use of bitcoin anonymity tool Dark Wallet for jihadi financing. In 2019, researchfrom US-based terrorism threat monitor Middle East Media Research Institute (MEMRI) revealed a major increase in the use of cryptocurrencies by jihadi groups. MEMRI calls the phenomena “the most significant and dangerous recent development in global terrorism”.

BitcoinTransfer itself has processed 36 bitcoin – just over $2 million based on current prices – in 679 transfers since December 2018, according to Chainalysis, a blockchain analytics firm that assisted the US indictment reported last year. Maddie Kennedy, a spokesperson for Chainalysis, says the company has not detected any further funds being sent to addresses associated with BitcoinTransfer since the August indictment. But, in the same period, BitcoinTransfer has ramped up its operations and opened new branches in Idlib while also moving from bitcoin to a stablecoin called USD-Tether. Tether is a cryptocurrency pegged to the price of the US dollar and has the highest volume of any cryptocurrency in circulation.

BitcoinTransfer opened its first store in December 2018. As well as buying and selling cryptocurrency, it runs workshops teaching people how to trade. It opened its second branch in Sarmada, a town in the north of Idlib governorate, in October 2020.

Alongside BitcoinTransfer, there is at least one other exchange in the city of Idlib, called BitcoinExchange Agent. Active on Telegram since January 2020, BitcoinExchange Agent accepts a range of cryptocurrencies, including the privacy-enhanced cryptocurrencies Monero and Zcash. Privacy coins like Monero and Zcash conceal user activity and are almost impossible to trace. Such features could make privacy coins appealing to terrorists, however, the level of terrorist adoption is disputed.

BitcoinExchange Agent and BitcoinTransfer have Telegram channels in English and appear to be catering to Westerners wanting to send money into Syria. They both post about how to send cryptocurrency anonymously and get around customer identity checks. BitcoinExchange Agent has also posted content on how to send cryptocurrency from Sweden, while BitcoinTransfer frequently posts in French. WIRED contacted several representatives from both BitcoinExchange Agent and BitcoinTransfer, but neither had replied at the time of publication.

The use of English in the channels may indicate that the exchanges are trying to raise money from sympathisers living abroad – a process known as “financial jihad”. Essentially, jihadi supporters are encouraged to donate money toward the war if they can’t physically partake in it. Cryptocurrency is well suited to this, because anyone can use it to send money without approval from governments. “Cryptocurrency’s whole purpose is being able to move large quantities of money around without censorship,” says Amir Taaki, lead developer of Dark Wallet. “Terrorists are essentially non-state sanctioned political groups, so cryptocurrency is ideal for them.”

But these censorship-resistant features also make cryptocurrency appealing to a wider class of users. For millions of people living in the UK, the EU and the US, sending money into Syria is currently illegal due to sanctions imposed by regulators. These sanctions also cover money sent to civilians. Chainalysis declined to comment on the exact figures that BitcoinTransfer is processing for civilian purposes. However, an August report by Chainalysis shows 2.002 bitcoin ($117,717) sent to BitcoinTransfer is linked to terror organisations – the use of the remaining 34 bitcoin sent to BitcoinTransfer is unconfirmed.

In demographic terms, the number of people in Idlib that may be having money transferred to them massively outnumbers the number of jihadi fighters. According to a security report by the United Nations, HTS employs around 10,000 fighters in the Idlib area, whereas the number of people living in Idlib is close to three million. Many of these people survive through remittances sent through the hawala system, an ancient method for sending money through a network of human contacts.

Still, jihadis appear to be among the most enthusiastic cryptocurrency adopters. MEMRI shared several jihadi Telegram channels with WIRED, one of which was a HTS-affiliated cryptocurrency trading group that claims to be based in Idlib. WIRED reached out to four people associated with this channel and an associated discussion group. Of the two people that replied, one claimed he operated several jihadi and cryptocurrency-related Telegram channels, as well as allegedly running a refugee camp that is home to more than 100 families. The representative claims the hawala system is “dangerous for the sender” because the sender can be “arrested by the government under the pretext of supporting terrorism”. He adds that bitcoin is a safer alternative “because the government does not know who sent and who received it”.

Another person, who appeared to be an admin of the crypto-jihadi channel, says civilian adoption of cryptocurrency remains low, stating he “did not see any interest from Idlib residents in digital currencies”. However, he says that young people, especially the very poor, are now joining cryptocurrency groups on Telegram hoping to make money from trading. “May this field be income for them someday,” he says. He estimates that there are “approximately ten stores” buying and selling cryptocurrency in Idlib, and that “the number is increasing”. When asked about the indictment of BitcoinTransfer, the contact deleted all their messages and made a public post urging others not to reply to any requests for comment from journalists.

The war in Syria has been raging for ten years and has killed more than 380,000 people. The city of Idlib is the last major rebel stronghold and is run by HTS, which has been designated a terrorist organisation in the UK, Canada, Turkey and US, and began its life as the Syrian branch of Al-Qaeda. While Al-Qaeda has a focus on global jihad, HTS is more local: it’s waging a holy war against the Syrian government, with the aim of overthrowing the country’s dictator Bashar Al-Assad and implementing Sharia law.

According to Elizabeth Tsurkov, a non-resident fellow at the Newlines Institute, a US think tank, the majority of the people in Idlib are displaced supporters of the revolution against Assad, forced from their homes when the regime recaptured parts of the country. Many have had family members imprisoned, tortured or killed by the regime. Huge numbers of people, predominantly women and children, live in tents – thousands live under olive trees. They’ve been subject to relentless aerial bombardment, chemical weapon attacks, and rape. Most are traumatised.

One result of the devastation is that Syria is now suffering an economic crisis. The Syrian lira reached its lowest price ever in March. Food prices in Syria have increased by 222 per cent since last year, and 376 per cent since October 2019. According to the World Food Program, 12.4 million people in Syria lack basic food provisions, while 1.3 million people are on the brink of starvation.

This economic backdrop may be accelerating overall cryptocurrency adoption in Syria. The price of bitcoin has increased more than 430 per cent since last year – at the time of writing, the price is $58,927. The surge has also impacted other cryptocurrencies such as Ethereum, currently at $1,835, up more than 560 per cent since last year. In March this year, the Syrian Observatory for Human Rights reported that a growing number of displaced people were turning to cryptocurrency as a way to make money. People in refugee camps make small sums buying and selling cryptocurrency – enough to cover their basic needs.

Rising cryptocurrency prices have spurred jihadi engagement in trading as well. One channel, which started in February, taught jihadi supporters in Idlib how to trade cryptocurrencies securely. The channel was deleted from Telegram shortly after WIRED asked the company for comment. Telegram has yet to reply to the request for comment or clarify whether it was responsible for deleting the channel.

Prior to its removal the channel had 379 members. It shared information about how to use VPNs to bypass sanctions on cryptocurrency exchange Binance, which blocks people in Syria. The channel also shared information on how to use trading bots, including those that use algorithmic strategies such as scalping. It aimed to provide guidance on cryptocurrency to serve “our brothers, the mujahideen, and our steadfast people” in Idlib, including how to make money with cryptocurrency in a way that is permitted by Sharia law.

The group also appeared to be recruiting its members into a jihadi cryptocurrency trading arm. “After a period of learning, some brave people who will devour the digital field with their teeth will be chosen to be members of our humble team,” reads one message, translated from Arabic. Before it disappeared, the Telegram channel reposted content on trading strategies from a 17,000 member, non-jihadi Telegram group that teaches people how to make money using trading bots.

The jihadi trading channel shared content about a range of cryptocurrencies, including Avalanche, Cardano, Fantom, Litecoin and 1INCH, among others. A message sent to the group on March 11 appeared to be soliciting donations to supply Muslim refugees with cryptocurrency wallets and Tether. It linked a Tether address associated with the Tron blockchain. Soliciting charity is a common pattern in jihadi fundraising campaigns. In many cases, crowdfunding campaigns were military operations posing as charities – phenomena referenced in the Department of Justice indictment and that has been widely documented throughout the civil war.

Jihadi crowdfunding campaigns of this type were once commonplace, but are less widespread since the August indictment and similar arrests in France, India and the UK. In France in October, 29 people were arrested in connection to a crypto-financing scheme architectured by two HTS militants, Mesut S and Walid F, which involved sending bitcoin into Syria using anonymous coupons. According to MEMRI, the crackdown has led to less open discussion of cryptocurrency in known jihadist channels. But evidence remains that the use of cryptocurrency by jihadi groups in Idlib continues.

“Our monitoring has seen significantly less usage of cryptocurrency by jihadis, and less discussion of it among them as well,” says Steven Stalinky, executive director of MEMRI. “However, that does not mean that they are not doing these things – this activity is likely more underground and less public.”

Stalinky adds that while jihadi usage of cryptocurrency is less noticeable, MEMRI has seen a “huge uptick” in the adoption of cryptocurrency by domestic terrorist groups in US and Europe. In particular, Stalinky says that MEMRI has seen an increase in the adoption of cryptocurrency by white-supremacist and neo-Nazi groups that are using donation campaigns to finance violence. “They are following in the footsteps of jihadis,” he says.

MagniFile, a Syria-focused research agency, has been conducting investigations into the use of bitcoin in Idlib following the crackdowns by the US and France. The agency, which had previously reported on Syrian mercenaries in Libya, began by identifying Telegram channels associated with jihadi crowdfunding campaigns. MagniFile says it gets its information through a combination of open-source intelligence and information provided by pro-government forces that are investigating the use of cryptocurrency by jihadists.

During its investigation, MagniFile uncovered more than 120 Telegram groups chats and channels, including many it claims are connected with HTS and Isis. To investigate the process for donating bitcoin, MagniFile talked to eight-channel administrators. Four provided bitcoin addresses where money could be sent. In the remaining four cases, alleged militants were reluctant to openly share bitcoin addresses. One person suddenly backed out of a trade and deleted the chat. MagniFile adds that bitcoin is becoming less attractive to jihadists since the indictment including BitcoinTransfer. Instead, it is claimed, militants are turning to less high profile cryptocurrencies, such as Dash, Ripple and Ethereum, and anonymous cryptocurrency Zcash.

MagniFile also claims that jihadi groups are changing tactics to avoid detection by Western law enforcement. Before, groups could send money using anonymous coupons. Since this funding stream was captured by French authorities, jihadis have allegedly switched to more secure means of payments, using single-use Electrum wallets and cryptocurrency mixing services hosted on Tor. Security concerns may be driving the adoption of Tether by exchanges in Idlib. In Telegram channels, Tether is described as a “private” and “secure” alternative to bitcoin.

The rise of cryptocurrency in Idlib is mirrored across the world, especially in politically unstable and developing countries. Turkey, which shares a border with Idlib and is home to nearly four million Syrian refugees, has the highest crypto adoption in the Middle East.

In a recent report Chainalysis found that the growth in the crypto economy has caused illicit usage of bitcoin to fall relative to non-illicit use. Criminal activity in 2020 fell from 2.1 per cent to just 0.34 per cent, while the overall economic activity in cryptocurrency nearly tripled.

A Chainlysis’s spokesperson says that the company detected a total of 37.35 bitcoin ($2,196,180 at current pricing) that went toward terrorism financing in 2020: a mere 0.00324 per cent of the overall illicit activity. However, the reduction has more to do with the growth of the cryptocurrency economy than a significant decrease in terror-funding. According to numbers shared by Chainalysis, the amount of dollars sent to terrorist groups through bitcoin only fell by 4.2 per cent in 2020.

While terror financing is a tiny fraction of the overall cryptocurrency economy, the sums of money being sent is large enough for terror-funding to remain a concern for regulators. US treasury secretary Janet Yellen has spoken about bitcoin three times since coming into office, and each time she has mentioned terrorism financing. “I see the promise of these new technologies, but I also see the reality: cryptocurrencies have been used to launder the profits of online drug traffickers; they’ve been a tool to finance terrorism,” she said in a roundtable discussion in February.

But the continued use of cryptocurrency in Idlib proves that people will find creative ways to get money into sanctioned areas. Efforts to curtail its use may simply accelerate the adoption of technologies such as VPNs and privacy coins. “If you ban crypto it would not stop it from existing,” says Riccardo Spagni, lead developer of privacy coin Monero. “The people who need it most will keep using it.”

Locked out of traditional financial networks, people in Idlib may need cryptocurrency more than most. Exchanges such as BitcoinTransfer are a way for jihadis and civilians alike to bypass the economic breakdown that surrounds them. Idlib abandoned the Syrian currency for the Turkish lira last year, but it has not been enough to shield the area from crushing inflation. For civilians, the need for cryptocurrency is perhaps even more acute – HTS is wealthy compared to most organisations in Idlib, making $130m a month through taxes and trading oil.

The favourable situation for crypto in Idlib – largely spurred on by HTS’s pro-crypto stance and the influence of Turkey in the region – may not last. Idlib sits in a delicate position. According to Tsurkov, the non-resident fellow at the Newlines Institute, HTS is minimising direct confrontation with Syrian regime forces, hoping to hold on to its power in the region. Until the situation changes, Idlib’s exchanges and trading desks are likely to remain linked up to the cryptocurrency economy, even as near daily airstrikes target the towns and countryside surrounding them.

By RACHEL-ROSE O’LEARY, March 31,2021, published on WIRED