red 
Shortly after the end of a military operation in the West Bank city of Jenin, Israel’s National Counter-Terrorism Financing Bureau (NBCTF) issued an asset seizure order targeting the Palestinian Islamic Jihad (PIJ) on July 4. The order – issued by Defense Minister Yoav Gallant – uncovered 26 Tron wallets and 67 additional client accounts on virtual asset exchanges.
Together, the 26 discovered wallets hold over $93.7 million in Tether (USDT), USD Coin (USDC), and Tron (TRX). Since the order also includes cryptocurrency exchange wallets, it is not clear how much of these funds belong directly to PIJ. However, in addition to the NBCTF’s earlier order in June targeting alleged Hezbollah wallets that received over $3.8 billionthis remains the second largest terrorist-related crypto order to date.
In this blog post, we’ll examine what the latest on-chain data shows regarding crypto-based terrorist financing.
What is Palestinian Islamic Jihad?
Formed in the late 1980s, the PIJ is one of several armed groups operating in the Gaza Strip designated as terrorist organizations by Israel, the United States, the United Kingdom and the European Union. The US Office of Foreign Assets Control (OFAC) designated PIJ as a “Specially Designated Terrorist” in 1995, while the State Department designated it a Foreign Terrorist Organization (FTO) two years later.
Like many groups in the region, PIJ advocates armed “jihad” (struggle) against Israel and coordinates with other organizations such as Hamas to launch attacks. PIJ has long been seen as a proxy for Iran. Iran’s Islamic Revolutionary Guard Corps (IRGC) reportedly funded the PIJ with $70 million a year during the 1990s, making the NBCTF warrant to seize $93.7 million in cryptocurrencies particularly significant. Iran’s heavy engagement with crypto-assets to circumvent sanctions may partly explain these amounts.
With this seizure order, PIJ becomes the eighth known proscribed terrorist organization to have dealt with the crypto-asset, along with other major groups such as ISIS, al-Qaeda, Hay’at Tahrir al-Sham (HTS), Hezbollah, Iran’s Islamic Revolutionary Guard Corps. (IRGC) and Hamas.
Monitoring of PIJ’s crypto activities
Like many other Islamist terrorist groups operating in Gaza and the West Bank, the blockchain activity of PIJ-linked wallets appears to correlate with major escalations in the conflict. Both the number and value of transactions rose in March 2022 and peaked in May of that year – coinciding with a wave of violence in which militants killed 17 Israelis and two Ukrainians in the West Bank.
These events culminated in reciprocal rocket launches and airstrikes on Gaza in early August, and violence continued sporadically until the end of the year. During this period, a large volume of crypto transactions continued with wallets linked to PIJ.
The balance of transactions shows a sharp decline at the end of April 2023 – almost exactly coinciding with the announcement by Hamas’ al-Qassam Brigades that it is suspending its Bitcoin donation campaign.
Although the vast majority of PIJ’s funds come from USDT, the two events may still be related. As the Elliptic Investigator chart below shows, wallets linked to PIJ initiated large transactions with those linked to Hezbollah, Hamas, and a number of businesses providing illegal money services.
Elliptic Investigator shows links between PIJ and Hamas, Hezbollah, multiple money laundering services, Garantex exchange and Sunswap.
On-chain data also shows that Israeli-listed wallets processed some of their funds through Garantex – a sanctioned Russian exchange – and Sunswap, a decentralized exchange. These are terrorist financing strategies observed by other Palestinian groups such as Hamas.
Both the use of high-risk exchanges and asset hopping are typologies discussed in our upcoming crypto-asset terrorist financing briefing note. Given the increased anonymity that such blockchain activities offer to terrorists, virtual asset services must ensure that they have effective compliance systems in place to prevent exposure to these trends.
Elliptic’s briefing note on crypto-asset financing of terrorism will provide details on the latest risks and how blockchain analytics solutions can be leveraged to implement effective detection and mitigation strategies.
We also routinely collect and take immediate action where necessary to flag any cryptoasset wallet addresses linked to terrorist financing within our tools. To learn more, contact us for a demo.
