0

Bitcoin and PayPal, the Hidden Crypto Route to ISIS Funding

This image is AI-generated.

A recent federal conviction in New York exposed how small but coordinated cryptocurrency donations can evolve into a full-fledged terrorist financing laundering operation. The case against Abdullah At Taqi and Mohamad David Hashimi demonstrates that even limited transfers, masked as charitable giving, can sustain violent networks when combined with modern digital tools and poor monitoring. It also highlights how anti-money-laundering frameworks are evolving to capture cross-platform activity that blends traditional payment services, online fundraising, and digital assets. The defendants’ actions spanned Bitcoin transfers, PayPal donations, and GoFundMe campaigns, each crafted to look legitimate while concealing a shared purpose: to support a designated foreign terrorist organisation through a web of anonymised payments.

Terrorist financing laundering uncovered

Authorities revealed that At Taqi used Bitcoin wallets to send multiple small transactions to an individual claiming allegiance to ISIS. The recipient operated under the alias Osama Obeida and coordinated with sympathisers through encrypted applications. To conceal the destination of funds, the defendants used conversion tactics common in money-laundering schemes: cycling between digital wallets, employing intermediary accounts, and erasing communication records. Over nearly a year, they disguised their activity behind pseudonymous transactions and peer endorsements, combining financial layering with online radicalisation networks. Investigators traced over US $24 000 funnelled through digital addresses linked to Obeida, complemented by transfers through PayPal and traditional money remittance services. The proceeds were ultimately used to purchase weapons and supplies for combatants in conflict zones.

How the laundering network operated

The scheme began in online chat groups frequented by sympathisers who discussed fundraising under humanitarian banners. Within those groups, participants promoted links to campaigns that appeared philanthropic, collecting donations for refugees or war victims. The underlying purpose, however, was to divert money toward fighters associated with extremist organisations. Hashimi and other contributors used GoFundMe and PayPal accounts to channel contributions to a common collector, while At Taqi managed the cryptocurrency side by sending funds to digital wallets he believed belonged to the organisation’s operative. Each channel represented a separate stage of the laundering cycle: placement through public donations, layering through cryptocurrency transfers, and integration via the purchase of physical assets abroad.

The conspirators deployed anonymity tools and operational security measures typical of illicit finance. They discussed deleting messages, switching Internet Protocol addresses, and masking digital footprints. By operating through micro-transactions and decentralised finance rails, they avoided triggering basic reporting thresholds and took advantage of cross-jurisdictional gaps. This hybrid model merged conventional electronic payments with blockchain-based remittances, making it harder for compliance teams to detect correlations between fiat and crypto channels. The same tactics now appear in global typologies used by regulators and financial intelligence units to train institutions on emerging risks.

For investigators, the turning point came when covert sources engaged the network online and obtained confirmation that funds were reaching individuals inside conflict zones. Visual proof, such as photographs of weapons with digital signatures and references to encrypted accounts, confirmed that the donations were being used for material support. The defendants’ conversations revealed an explicit intent to bypass financial surveillance and sustain activities contrary to U.S. and international counterterrorism laws. Once authorities traced wallet addresses and linked them to identifiable exchanges and payment accounts, the structure of the laundering network became visible, proving coordination among participants and the deliberate concealment of funds’ origins.

The convictions rest on two intertwined bodies of law: the prohibitions against providing material support to designated foreign terrorist organisations and the statutes governing money-laundering offences. Under Title 18 United States Code § 2339B, it is illegal to knowingly provide financial or material support to any organisation officially designated as terrorist by the Secretary of State. Violations may result in imprisonment up to 20 years, and when death results, potential life imprisonment. Parallel to that, Title 18 U.S.C. § 1956 criminalises financial transactions conducted with intent to promote unlawful activity or conceal the nature of proceeds derived from specified offences. Conspiring to commit such acts carries the same penalties as the substantive crime.

In this case, both statutes applied. The defendants’ contributions, regardless of size, were considered intentional acts of financing terrorism, and their concealment of payment flows satisfied the elements of laundering. The dual-charge structure underscores a broader shift in enforcement, where terrorism financing is prosecuted not only under national-security provisions but also through the more comprehensive lens of anti-money-laundering law. This integration enables investigators to trace value movement across asset types, seize digital funds, and freeze corresponding fiat accounts.

For compliance professionals, the case is a textbook example of how typologies evolve faster than regulatory guidance. Crowdfunding deception, cryptocurrency layering, and social-media radicalisation collectively form a high-risk convergence point for financial institutions. While each individual transaction might appear innocuous, the aggregation reveals patterns consistent with laundering and terrorist financing indicators. The inclusion of virtual assets adds complexity, as service providers must meet registration, know-your-customer, and suspicious-activity-reporting obligations comparable to traditional financial institutions.

Lessons for AML and CFT practitioners

The At Taqi and Hashimi case reinforces that financial integrity threats increasingly emerge from small-scale, high-tech actors rather than only from large networks. The amount transferred, roughly US $25 000, may appear modest, but its ultimate use magnified its gravity. Several operational lessons arise for financial-crime professionals.

First, monitoring systems must adapt to detect multi-platform linkages. A single donor using both PayPal and cryptocurrency should trigger risk flags for cross-channel activity, especially when connected to newly created accounts or overseas wallets. Machine-learning tools can assist by mapping behavioural anomalies and identifying coordinated micro-payments consistent with laundering patterns.

Second, platforms that host user-generated fundraising campaigns should embed robust screening of campaign narratives, beneficiary identities, and withdrawal destinations. Charitable fraud remains one of the most effective laundering disguises because it exploits donor trust. Regulators encourage platforms to apply customer-due-diligence principles, including identity verification of campaign organisers and real-time transaction monitoring.

Third, traditional financial institutions must integrate virtual-asset-service-provider intelligence into their transaction-monitoring programmes. The risk of convergence between fiat and crypto flows increases when customers use exchanges or wallets located in jurisdictions with weak oversight. Compliance teams should maintain updated typologies describing how terrorism financiers exploit these channels, ensuring staff can identify red-flag behaviours such as repeated small crypto deposits converted immediately into remittances.

Fourth, law enforcement cooperation is essential. In this case, data correlation between blockchain analytics, payment-service records, and undercover digital-chat intercepts enabled the prosecution. Similar cooperation models are expanding internationally through information-sharing frameworks and joint task forces.

Finally, this episode reiterates that awareness and early detection outweigh reaction. Each stage of laundering—from placement to integration—was traceable once investigators connected disparate data sources. For regulated entities, proactive analytics and rapid escalation protocols remain the most effective defences against both laundering and its terrorist-financing variant.


Source: U.S. DOJ

Some of FinCrime Central’s articles may have been enriched or edited with the help of AI tools. It may contain unintentional errors.

Want to promote your brand, or need some help selecting the right solution or the right advisory firm? Email us at info@fincrimecentral.com; we probably have the right contact for you.

Related Posts

Share This