Terror-linked groups in war-torn Idlib are changing their crypto tactics to avoid detection by Western law enforcement
In a small shop overlooking the dusty streets of Idlib in northwestern Syria, a group of men sit huddled around a laptop watching the price of bitcoin skyrocket. Outside, the city is devastated by war, but the men’s eyes remain locked on the price chart – they are trying to turn $10 into $20 through Shariah-compliant trades.
These men are part of a small cryptocurrency community in Idlib, an enclave of Syria run by former Al-Qaeda affiliate Hay’at Tahrir al-Sham (HTS). A sign on the wall reads “BitcoinTransfer” – it’s one of many shops in the area that buys and sells cryptocurrencies for cash.
But BitcoinTransfer is also at the heart of a network providing money to terror groups. In August 2020, the US Department of Justice revealed BitcoinTransfer had acted as a central hub in six terror-funding operations and called for the forfeiture of 155 cryptocurrency addresses linked to the exchange. Other research has also pointed to BitcoinTransfer’s jihadist connections.
The indictment hasn’t stopped cryptocurrency usage in Idlib. In fact, new evidence points to jihadis becoming more security conscious: switching away from the heavily monitored bitcoin into a wider range of cryptocurrencies and using VPNs to side-step surveillance and sanctions. They’re also getting into trading – running classes on technical analysis and recruiting young people into trading groups on Telegram.
