Introduction
The Islamic State (IS) transnational jihadist group has increasingly turned to cryptocurrency alongside traditional fundraising channels for financing its terror operations across the world. One of its lethal affiliates, IS-Khorasan Province (ISKP), has dominated the Afghanistan and South Asian terrorism landscape for over a decade, capitalising now on the more secure cryptocurrency in terms of privacy and safety protection, particularly Monero (XMR), to fund its global jihadist ambition. This tactical diversification from traditional sources and channels such as charity contributions, extortion, taxes, and ransom payments to more private, secured cryptocurrency donations presents formidable challenges for global counterterrorism efforts.
This Insight aims to highlight the role that virtual donations in cryptocurrencies play in supporting transnational jihadist organisations such as IS (IS Central), challenging previously held views on their role and prevalence within broader terrorism financing mechanisms. It examines the adaptive strategies in navigating the rapidly evolving digital landscape, mainly focusing on the increasing use of safer and private cryptocurrencies for fundraising. The Insight traces the rise of Monero as the preferred cryptocurrency for these activities, highlighting consistent public appeals for donations in Monero to support jihadist causes. It explores ongoing fundraising campaigns linked to ISKP, emphasising those in Central and South Asia.
Islamic State’s Financial Resilience
Despite military defeats and the loss of territory in Iraq and Syria, IS retains access to significant financial resources, which were accumulated during its peak control over parts of Iraq and Syria from 2014 to 2017. It controls an estimated $25 to $50 million in reserves, primarily in Iraq, according to the July 15, 2022 UNSC report. IS has established a sophisticated network of financial operations, with various regional offices playing crucial roles in maintaining the group’s financial strength. Two key offices in this structure are the al-Siddiq office and the al-Karrar office, each overseeing distinct regions, Central and South Asia, and African countries – Somalia, Congo and Mozambique – respectively, contributing to IS’s financial and operational strengths. These offices are instrumental in ensuring the flow of funds, coordination of operations, and expansion of IS’s influence, particularly in South and Central Asia and beyond.
Since 2023, IS has raised thousands of dollars through international donations by promoting virtual asset addresses in social media and in its propaganda literature published in multiple languages by the al-Siddiq Office. This fundraising strategy links directly to IS’s external operations, as seen in the Crocus Hall attack in Moscow, where ISKP transferred at least $2,000 USD in virtual assets to the attackers. The use of virtual assets by IS and its affiliates, like al-Siddiq, demonstrates the group’s growing reliance on these methods to fund global terrorism. Fundraising through crypto coins certainly facilitates discreet and swift financial support, circumventing traditional banking surveillance mechanisms.
IS’s financial ability to sustain itself is bolstered by its strategic use of virtual assets. It has increasingly turned to cryptocurrencies to preserve and transfer wealth, particularly in regions where traditional financial routes have been disrupted due to counterterrorism measures. This use of virtual assets with high anonymity and security features makes it difficult for global financial institutions to trace and intercept the flow of funds. These funds are used to support IS provinces globally, finance terrorist operations, purchase weapons and train fighters, recruit and train members, and maintain the loyalty of its affiliates. Also, it is possible that the funds collected in the name of humanitarian aid through digital donation can be used to support families of deceased or imprisoned IS fighters, pay militants’ salaries and fund media operations.
Quest for Crypto Coins
According to the Counter IS Finance Group (CIFG), the working group within the Global Coalition to Defeat IS, private voluntary (Islamic) donations (sadaqah) and mandatory contributions (zakat) make up IS’s most vital sources of revenue. While IS and its affiliates have long relied on informal cash couriers like Hawala, they have increasingly turned to crowdfunding through digital currencies such as Bitcoin (BTC), Tether (USDT), and Ethereum (ETH) in recent years to quickly move funds and evade detection.
However, Bitcoin’s initial appeal faded due to increased transparency in financial transactions and accounting with improved blockchain tracing techniques adopted by security agencies across the globe. This situation prompted IS groups to shift towards stringent privacy-focused cryptocurrencies like Monero, which offers advanced privacy features like ring signatures, stealth addresses, and confidential transactions, making it nearly impossible or, at least, challenging for law enforcement to trace and prevent. Monero’s design effectively obscures transaction details, rendering traditional financial tracking and intercepting methods largely obsolete and ineffective.
Seeking Monero ‘Wealth for Jihad’
For ISKP, the al-Siddiq office perhaps is the key to channeling funds from IS central and other sources to various IS affiliates in South and Central Asia. While these funds are crucial for sustaining jihadist operations, the office may have devised or adapted to use virtual assets to transfer funds. This provides security and anonymity compared to traditional fundraising methods and helps in easy crowdsourcing. While Bitcoin and Tether were the preferred virtual currency for IS before 2020, Monero has become increasingly prevalent within IS networks, as evidenced by its recent digital fundraising campaigns.
In one of the Voice of Khurasan (VoK) magazines (No 32, January 2024), ISKP’s flagship English language propaganda publication, the group exhorted its followers or sympathisers to ‘Spend for the Shake of Allah”. It reminded and urged them to send financial support to Muslims facing war and calamities. It also cautioned readers to send using safe and secure means, followed by detailed instructions for the Monero digital coin donation. The message further urged Muslims to support their fellow believers by donating their wealth and lives to the cause, claiming their contributions to God (Allah) will be rewarded. However, it criticised secular aid agencies, accusing them of advancing harmful agendas, and cited a Quranic verse that suggests disbelievers wish to withhold blessings from Muslims (figure 1).
Figure 1: ‘Spend for the Shake of Allah: Voice of Khurasan, Issue 32, January 2024)
The use of Monero as a preferred medium can be traced to the pro-IS Akhbar al-Muslimin portal, which announced the change in the medium of donations from Bitcoin to Monero exclusively in June 2020. In July 2021, the IS cyber defence unit AFAQ (Electronic Horizons Foundation) explicitly recommended Monero for its superior anonymity features and difficult-to-trace transactions in its Telegram channel. However, ISKP used Tether for some time to receive funds in the past and may continue to do so presently, along with other stable and safe virtual coins. The AFAQ, however, warned against using Bitcoin, which has a public ledger that allows third-party tracking, advising potential donors to return to the decentralised ‘Element’ platform for secure Monero purchasing guidance. After a few months, IS affiliates, especially ISKP and other regional units and networks, started publishing advertisements for exclusive Monero-only methods for cryptocurrency donations through their official publications and channels.
VoK continuously urges its Muslim readers to contribute financially to jihad (figure 2).
Figure 2: Voice of Khurasan (Tajik), Issue, 1, March 2024
VoK issues regularly include Monero solicitations messages. For example, in the November 2023 issue (Number 30), ISKP pleaded for donations to strengthen ‘Mujahedeen,’ showing pictures of Palestinians looking for survivors following an early November 2023 Israeli airstrike in Khan Younis refugee camp, southern Gaza Strip (figure 3). Furthermore, VoK also features a message urging its supporters to ‘give’ and criticising them for being ‘stingy’ with their donations in its latest August issue (figure 4).
Figure 3: Voice of Khurasan, Issue 30 (November 2023)
Figure 4: Voice of Khurasan Number 38/August 2024
ISKP linked branches’ Monero solicitations
Since 2021, ISKP’s regional branches have been soliciting Monero cryptocurrency. The Myanmar-based group Katibah al-Mahdi fi Bilad al-Arakan (KMBA) called for Monero donations in the May 2021 issue of its magazine “Arkan: Ahsan al-Qasas”. KMBA, which pledged allegiance to IS in November 2020, shared a Monero account and QR code via its Arrukn Media Center. The donation message emphasized Jihad for Allah’s cause, promising either entry into paradise or rewards for those who supported their mission. In March 2023, Islamic State Pakistan Province (ISPP)’s Nashir al Pakistan media used Telegram to raise funds, urging supporters to donate to multiple cryptocurrencies, including Bitcoin and Monero, to aid earthquake victims in northwestern Syria. Similarly, IS Hind Province (ISHP)’s Al-Jauhar Media soliciting Monero donations in regular intervals. In April this year, a poster campaign urged supporters to donate via Monero, with the message: “Who will lend to Allah a good loan which He will multiply many times over?” (figure 5). Again, in its July 2024 issue of ‘Serat-ul-Haq’ (No. 4), ISHP’s propaganda magazine called for Monero donations to support its jihad campaigns in India (figure 6).
Figure 5: Arkan (Issue 2) (May 2021)
Figure 6: Serat-ul Haq (Al Jauhar Media/ISHP), Number 4, July 2024
Conclusions
The increasing use of Monero and other digital coin platforms by IS and its regional branches challenges the earlier belief that cryptocurrency would not be a preferred method for terror financing, potentially due to how crypto would be perceived in compliance with Sharia law. Monero is now certified as a ‘permitted’ cryptocurrency under Islamic jurisprudence by ‘Cryptohallal’ (Image-5), making it more attractive to terrorist groups like the IS or Hamas. This trend arguably underscores the broader impact of cryptocurrency on global counterterrorism finance efforts, emphasising the need for balanced regulation that addresses both the privacy benefits of digital currencies and the security risks they pose. The documented (fundraising) evidence above suggests that IS has adopted Monero effectively because of its enhanced anonymity and privacy features, making it particularly lucrative over other crypto coins. However, this does not mean terrorist groups are not using different cryptocurrencies. For groups like IS, Al Qaeda or even Hamas, private coin donations or mining significantly complicate financial surveillance and investigation. Unlike more transparent cryptocurrencies like Bitcoin, Monero’s architecture allows them to conduct transactions with minimal risk of detection, thereby undermining traditional counterterrorism finance operations. These features have already earned Monero a ‘tough cookie’ tag for law enforcement to crack.
Monero should take steps to discourage or block these jihadist groups from exploiting the network. Although it does not have direct control over who uses its platform, legal or regulatory scrutiny could harm its reputation and threaten its long-term viability as a leading cryptocurrency. By implementing a combination of regulatory measures, international cooperation, and technological advancements, Monero or, for that matter, other cryptocurrencies (such as Tron [TRX]) presently preferred by terror groups, should focus on developing strategies to counter the misuse of its platform effectively.
Indeed, Monero alone may not fulfil all the financial needs of transnational jihadist groups like IS or its regional branches. However, its continued adoption demonstrates the evolving nature of terrorism financing. The use of Monero and other privacy-focused cryptocurrencies in future (such as Zcash or Horizon) could severely hinder global efforts to track and disrupt illicit financial flows, making it imperative for regulatory authorities and international partners to develop more robust mechanisms to counter this evolving threat.
Animesh Roul is the executive director of the New Delhi-based policy research group Society for the Study of Peace and Conflict. He specializes in counterterrorism, radical Islam, terror financing, and armed conflict and violence in South Asia.
