Bitcoin terrorists of Idlib are learning new tricks
In a small shop overlooking the dusty streets of Idlib in northwestern Syria, a group of men sit huddled around a laptop watching the price of bitcoin skyrocket. Outside, the city is devastated by war, but the men’s eyes remain locked on the price chart – they are trying to turn $10 into $20 through Shariah-compliant trades.
These men are part of a small cryptocurrency community in Idlib, an enclave of Syria run by former Al-Qaeda affiliate Hay’at Tahrir al-Sham (HTS). A sign on the wall reads “BitcoinTransfer” – it’s one of many shops in the area that buys and sells cryptocurrencies for cash.
But BitcoinTransfer is also at the heart of a network providing money to terror groups. In August 2020, the US Department of Justice revealed BitcoinTransfer had acted as a central hub in six terror-funding operations and called for the forfeiture of 155 cryptocurrency addresses linked to the exchange. Other research has also pointed to BitcoinTransfer’s jihadist connections.
The indictment hasn’t stopped cryptocurrency usage in Idlib. In fact, new evidence points to jihadis becoming more security conscious: switching away from the heavily monitored bitcoin into a wider range of cryptocurrencies and using VPNs to side-step surveillance and sanctions. They’re also getting into trading – running classes on technical analysis and recruiting young people into trading groups on Telegram.
The increasingly sophisticated approach to cryptocurrency trading builds upon a long documented history of digital currencies being used to fund terrorism. HTS, the jihadi faction controlling Idlib, has an openly pro-cryptocurrency stance.
In 2019, it called bitcoin the “Currency of the Future Economy” and released a 26-minute video of a HTS cleric discussing its compliance with Shariah-law. The faction has also regularly promoted BitcoinExchange since June 2019.
But HTS is not the first jihadi group to adopt cryptocurrency – the technology been used by militants across Syria for at least seven years. Among the first documented instances of this was in July 2014, when an Isis-affiliated blog proposed the use of bitcoin anonymity tool Dark Wallet for jihadi financing.
In 2019, research from US-based terrorism threat monitor Middle East Media Research Institute (MEMRI) revealed a major increase in the use of cryptocurrencies by jihadi groups. MEMRI calls the phenomena “the most significant and dangerous recent development in global terrorism”.
BitcoinTransfer itself has processed 36 bitcoin – just over $2 million based on current prices – in 679 transfers since December 2018, according to Chainalysis, a blockchain analytics firm that assisted the US indictment reported last year. Maddie Kennedy, a spokesperson for Chainalysis, says the company has not detected any further funds being sent to addresses associated with BitcoinTransfer since the August indictment.
But, in the same period, BitcoinTransfer has ramped up its operations and opened new branches in Idlib while also moving from bitcoin to a stablecoin called USD-Tether. Tether is a cryptocurrency pegged to the price of the US dollar and has the highest volume of any cryptocurrency in circulation.
BitcoinTransfer opened its first store in December 2018. As well as buying and selling cryptocurrency, it runs workshops teaching people how to trade. It opened its second branch in Sarmada, a town in the north of Idlib governorate, in October 2020.
Alongside BitcoinTransfer, there is at least one other exchange in the city of Idlib, called BitcoinExchange Agent. Active on Telegram since January 2020, BitcoinExchange Agent accepts a range of cryptocurrencies, including the privacy-enhanced cryptocurrencies Monero and Zcash.
Privacy coins like Monero and Zcash conceal user activity and are almost impossible to trace. Such features could make privacy coins appealing to terrorists, however, the level of terrorist adoption is disputed.
BitcoinExchange Agent and BitcoinTransfer have Telegram channels in English and appear to be catering to Westerners wanting to send money into Syria. They both post about how to send cryptocurrency anonymously and get around customer identity checks.
BitcoinExchange Agent has also posted content on how to send cryptocurrency from Sweden, while BitcoinTransfer frequently posts in French. WIRED contacted several representatives from both BitcoinExchange Agent and BitcoinTransfer, but neither had replied at the time of publication.
The use of English in the channels may indicate that the exchanges are trying to raise money from sympathisers living abroad – a process known as “financial jihad”. Essentially, jihadi supporters are encouraged to donate money toward the war if they can’t physically partake in it.
Cryptocurrency is well suited to this, because anyone can use it to send money without approval from governments. “Cryptocurrency’s whole purpose is being able to move large quantities of money around without censorship,” says Amir Taaki, lead developer of Dark Wallet. “Terrorists are essentially non-state sanctioned political groups, so cryptocurrency is ideal for them.”
Source: Wired
