This past July, a cleric from Gaza with 1 million followers on TikTok launched a fundraising campaign on US-based crowdfunding platform GoFundMe. The stated goal: to raise €500,000 "For humanitarian needs and aid to civilians in Gaza." But behind the scenes, a covert team sought to uncover his true goals and quickly tracked down his connections to a cleric named Al-Sharif, a member of the Hamas-affiliated Palestinian Preachers' Forum. Using facial recognition software, the team tracked down footage on social media showing the recruiter calling on Gazan youth to become "Soldiers of the next October 7." The evidence was handed over to GoFundMe. The result: the fundraising campaign was frozen within 36 hours.
Last week, the team also managed to shut down another GoFundMe campaign that sought to raise more than $1 million to benefit terrorist organizations under the guise of aiding Gazan children. Behind the campaign was an NGO called Ibrahim Ayyash, which was set up by the founders of Gaza Now, whose activities are blocked by the US administration on suspicion of financing terrorism. "It just continued under a different name, with the same managers and in the same ways," says a senior team member who revealed what was really happening. "Every time they put up a campaign, we immediately report on them. We’d taken down several of their campaigns to the point where their leader posted on social media, 'The Zionists have taken down my campaign again.' That's us, it's important to us and we'll keep on doing it."
The covert team behind these revelations is not part of any state authority, but is comprised mostly of volunteers who work to help Israel and other countries locate and block the money pipelines for terrorist organizations around the world. It is one of many members of an organization founded after October 7 by banking and fintech entrepreneurs, and is managed by a former senior legal advisor. To date, the organization has helped shut down over 700 fundraising campaigns for terrorist organizations amounting to about $400 million, and the information passed on to law enforcement authorities is estimated to be hundreds of millions more.
Despite their achievements, they eschew exposure. "We know they’re looking for us. We’re staying behind the scenes in order to continue doing the work without endangering ourselves and our volunteers personally," says A, a senior member of the organization.
"It started with a focus on Hamas on October 7, but as we progressed in time and research, we reached more terrorist elements, including Hezbollah, Iran, al-Qaeda and ISIS," A says. "We find the connection between them and organizations that appear very innocent, but have worked for many years to build extensive networks of contacts in all kinds of countries, and in the end, they try to use the funds via Western pipelines. "
"We began activity in the US, but we’ve come a long way since then and through many countries - from Europe, through Canada to Australia - where we’ve discovered quite a few terror financing pipelines. This isn’t only a problem for Israel. Antisemitic groups have established extensive networks, NGOs and many front companies across countries and continents. Our work is only beginning."
"Less fear, more information sharing"
Fundraising for terrorist organizations has long since become an entire industry that operates in many ways, from transfers through hawalas (a traditional method of transferring money through intermediaries, which is common mainly in South Asian, African, and Middle Eastern countries), through campaigns on crowdfunding platforms, to campaigns on social networks, Instagram, TikTok, and more.
According to data from the Israel Money Laundering and Terror Financing Prohibition Authority (IMPA), 25% of the money laundering offenses identified since the start of the war are related to financing terrorist organizations. The IMPA, the National Bureau for Counter Terror Financing of Israel (NBCTF) at the Ministry of Defense, the Israel Security Agency (Shin Bet, Military Intelligence, and other relevant intelligence and security agencies are working to locate the financiers and limit their financial activities, as are many other countries.
"The law enforcement agencies are doing a great job and they have access to classified intelligence materials that we don't have," says A. "The banks that are supposed to detect suspicious economic activity are also operating in this arena. But the banks’ technological and human systems aren’t skilled enough to keep track of all of the money and all of the ways terrorism is financed.
"Sometimes it's a matter of connecting the dots between several NGOs that deal with completely legal accounts and very humanitarian goals for hungry children, for the reconstruction of hospitals, for orphans and more. They incorporate in the US completely legally, and sometimes all the bank will see is a nonprofit that transfers $5,000 from one side to another over a month. But if they would connect the dots between 10 nonprofits, they’d see that they’re all owned by the same person, someone who is Sinwar's cousin.
"Since October 7, activity of the other side has become bolder. They are far more proud of their fundraising and use of funds. They are much less afraid, so they also share much more information, and a skilled analyst can get a lot out of it. Their confidence, independence, and even arrogance leads to discovering things they’d prefer not to be discovered."
"The banks can't connect the dots"
Covert organizations aren’t the only ones active in this area. Commercial entities are also entering the fight against terrorist organizations money pipelines, using advanced technologies, combined with more traditional detective skills, to follow suspect money. B, owner of a terror funds and money laundering consulting firm, entered the scene on October 7 and has since exposed quite a few NGOs and private entities that transferred funds to terrorist organizations. "We only use open sources, networks and human sources, to build a full profile that incriminates the entities that fund this activity," he explains.
B advises financial institutions and banks on how to comply with anti-money laundering and anti-terror financing regulations, but the profiles his company builds also reach official law enforcement agencies. Recently, his people identified a person who described himself as CFO of a charitable aid organization in Italy, but turned out had previously headed a nonprofit with a different name, one the US had defined and sanctioned for funding terror. "It's important to go back to the Internet Archive, see who raised funds and was blocked, because they usually continue to operate under a different name," he says.
When B describes the process of building a profile, it sounds like a script for a thriller. " We cross-reference a phone number or name [with databases] to identify the actual person, then call and speak with them in the appropriate language, usually fluent Arabic. We agree with his goals and ask if we can donate. From that point, we can get to bank accounts. In this case, we discovered there were Italian volunteers working for the NGO and we made contact through them. We spoke in Arabic with the CFO, and we arrived at a bank account that was very incriminating. The fact that he manages to reopen accounts at other banks is crazy in itself, because it shows that banks don't always manage to connect the dots."
One challenge for banks and financial institutions is the lack of tools to track changes in NGO names and identify the individuals behind them, especially when those names appear in multiple variations. "A compliance officer at a US or European bank has no idea about Arabic names, so the whole issue is problematic, especially when it comes to common names. The ability of banks to really understand who the person is and whether he is on the sanctions list is very low," explains B. "The name Muhammad can be written in English in almost 40 different ways, and if the customer's name is spelled differently than in the existing information, they won't catch it. We trace all his names and activities. It's real detective work."
B first transfers the profile to his clients, but from there he contacts anti-money laundering agencies around the world. "In the US and Israel there is currently zero tolerance and they immediately block funding and funders, but in Europe the situation is much more complicated because of the Muslim lobby. The Muslim Brotherhood has not been outlawed, and it raises a lot of money in Europe. Mosques have cash collection. Hamas is an arm of the Muslim Brotherhood, their nonprofit funds make their way to terrorist activity, but it's very difficult for the Europeans to prove it."
Eliyahu Cohen, CEO of 240 Analytics, a company that provides software aimed at tracking terror financing, explains that countries' blacklists are always partial. "They never contain all the entities that have ties to terrorism. There are hundreds of Hezbollah-linked digital entities on the international blacklist, but we know there are thousands. When you, as a financial institution, don't identify them, you're in serious trouble, because you don't have the ability to assess the risk and make an informed decision whether to allow this entity to operate through you."
This is when technology enters the picture. "We live in a digital age, where there is a wealth of information that often indicates links to terrorism, but the big challenge is how to turn big data into useful conclusions," says Cohen. "If I have a media clip with a person's name but I don't have any other details, it's hard to know with whom he’s associated, but it could be that it indicates terrorist activity or terrorist financing."
240 Analytics has therefore developed a product that takes all the seemingly unrelated information and creates relationship graph. "The company was founded just before October 7, and its activity was further strengthened following the events. Since then, we have created the largest public database of undesirable entities that play a role in terror financing, for use by the private sector and the government sector."
New ways of terror financing
In the end, the struggle is Sisyphean and never-ending, as the terrorist organizations are constantly developing new ways of raising and transferring funds. Take the following story as an example: For years, a US-based Jewish organization that is anti-Israel bordering on antisemitic had been raising billions of dollars a year without hindrance. After October 7, it ran into a problem. The US Treasury discovered it had transferred money to Hamas operatives including to UNRWA employees who were in fact terrorists and imposed sanctions. The organization’s greatest concern was that Israel’s Ministry of Finance might revoke its tax-exempt status on donations.
Their solution was to change their fundraising system. Before the war, the system was based on bank transfers and checks, but since then it has been based exclusively on cryptocurrencies. Anyone visiting the organization's Facebook page wishing to donate receives a QR code with the address of a digital wallet. The aim is not to hide the donation, but to make it difficult for the authorities to find out where the money has gone. As of now, that aim is being achieved.
This is just one example of the widespread use of cryptocurrency, Bitcoin, and the like to fund terror. The anonymity these currencies offer attracts those wishing to hide their identity and financial activities. At first, they were used by criminals but over the last five years, the world’s biggest largest terror organizations have entered the cryptocurrency space.
"If you go to a demonstration of a terrorist organization affiliate or of a student cell that supports it, and you want to donate, you do it in cryptocurrency. Within four minutes you can have two Bitcoins in your wallet, and no one will know. It's so easy and tracking is so limited," says Idan Barlev, CEO of BIWC, a cryptocurrency and cyber fraud investigation company. "The Hamas Telegram channel has a list of ways to donate; 99% are exclusively in cryptocurrency. This money goes directly to Hamas, without intermediaries or go-betweens in the US and Europe. After October 7, the US Treasury tried to freeze some of the wallets, which contained tens of millions of dollars. But the organizations have found a workaround: they change wallet addresses every other day.
"There are indirect donations in the US to nonprofit organizations that fund student activities and similar things, but they launder and transfer part of the money to Hamas under the guise of donating to a local nonprofit in Gaza. It could be a nonprofit that supposedly rescues children from starvation, but in practice has never spent a single shekel on that, but instead pays Hamas operatives. The US donor is sure that he gave to the best cause there is, and has no idea that his money is funding terror."
It's not just the US "Three or four years ago, a cryptocurrency exchange was established in Russia, which was ostensibly negligible. It offered unimportant coins, there was no real trade in it," Barlev says. "But a US blogger discovered movements that changed the turnover by thousands of percents, and was able to directly link this exchange to terrorist financing. Sanctioned countries are increasingly turning to crypto to hide their operations. Members of the Russian Wagner Force who fought in Syria were paid in cryptocurrency, and so are the North Korean soldiers fighting in Ukraine today."
The danger, says Barlev, is also physically nearby. "Judea and Samaria are swimming in cryptocurrency that comes by way of third-party transfers, donations and fictitious organizations. In this sense, Judea, Samaria, and Gaza are the same. It’ s mainly Hamas in Judea and Samaria. The Palestinian Authority is less involved because the Shin Bet allows it to maintain bank accounts."
And what about Iran?
"Iran currently has three official currencies: the rial, the dollar, and cryptocurrency. Because of the international sanctions, they began establishing their position in the cryptocurrency market 10-15 years ago. It is impossible to impose sanctions on an inactive wallet that contains five bitcoins, that no one except the Revolutionary Guard knows where it is. All the indictments for espionage or activity by Israelis on Iran’s behalf allege that payment was made in cryptocurrency."
The sting that exposed Hamas' finances
Financing terrorism with cryptocurrency is not a new phenomenon and it is on the rise. In August 2020, the US Department of Justice announced its greatest success in eliminating fundraising for terrorist organizations using digital currency. These were run by Hamas’ Izz al-Din al-Qassam Brigades (IQB), al-Qaeda and ISIS. In all cases, these were sophisticated and worldwide maneuvers through social networks. In total, the US seized millions of dollars from 300 cryptocurrency accounts, shutting down four websites and four Facebook pages.
In early 2019, the IQB posted a request for Bitcoin donations to fund terrorist activities on their social media accounts, and later, on their websites. The posts claimed that Bitcoin transactions could not be traced and specified exactly what the donations were intended for. Videos appeared on the sites explaining how to donate anonymously, using a unique Bitcoin address for each donor.
The investigators carried out a sting operation, setting up a Bitcoin website that pretended to be one collecting donations for Hamas. In this way, they were able to trace 150 accounts laundering Hamas funds and located the US donors. They also confiscated the equipment used to operate IQB sites in the US.
At the same time, al-Qaeda and its affiliated terrorist organizations carried out a fundraising campaign in the wake of the Syrian civil war, that included a system for laundering Bitcoin donations through Telegram channels and other social networks. In some cases, the donations were raised under the guise of charitable organizations, even though in practice the funds were channeled to terrorist activities. The organizations operated a sophisticated camouflage system to hide the financial transactions, but the US authorities were able to uncover 155 cryptocurrency accounts that were used by them.
Undercover US agents contacted the so-called charity Reminder for Syria, which collected donations in Bitcoin. The organization's members had stated explicitly their wish for the US to be destroyed, and discussed how much it would cost to purchase surface-to-air missiles. One of the organization's posts read, "Whoever arms a soldier in the war of Allah takes part in the war." In another post, the organization's members were seen holding a banner that read: "Supporting the mujahideen in Syria with weapons, money, and other means, supports jihad."
ISIS, too, took pride in exploiting the Covid-19 pandemic through a scam that boosted its finances. The operation was conducted by ISIS operative Murat Kakar, and centered on the "sale" of counterfeit protective equipment through the website FaceMaskCenter.com and four Facebook pages that promoted it. The site claimed to sell FDA-approved masks with almost unlimited stocks in reserve. Customers across the US were asked to pay in cryptocurrency.
"Neo-Nazis have a lot of cryptocurrency wallets"
In Linz, Austria in August 2024, police arrested Mustafa Ayyash, the official head of the Gaza Now News Network, at his home. Gaza Now claimed that this was done, "Following massive pressure from the officials in the Tel Aviv regime," as part of "the attempts of the occupation authorities to persecute everyone connected to the Palestinian media, in an attempt to silence the voice of the wounded Gazans and prevent the exposure of the suffering of the Palestinian people and the massacre of women, children and the elderly."
But the truth is different. It leads to Hong Kong and one of the world's leading terror financing experts, a British police veteran who, because of the sensitive nature of his work, we will call George. According to George, Ayyash is not an innocent journalist, but rather a key fundraiser for Hamas and a unit from a particularly wide network that is also connected to ISIS.
"We followed his e-wallet," he says. "The money was transferred from him to 47 other electronic wallets. Each wallet had 3,000 bitcoins and their current value is in the billions. There were Bitcoin mining scams. There were scams like, 'If you lose access to your wallet, we'll get it back for you for $1,000,' which of course ended with taking the money without giving help. There were romantic scams. There was human trafficking. There were drug sales all over the world. There was a fake website that supposedly raised donations to help children in Afghanistan and Iran.
"They say you can't find anything when you make cryptocurrency transfers. But sometimes you can, depending on how you look. Every Bitcoin transfer has an IP address, and we knew how to track those addresses. Eight addresses have been linked to Bitcoin mining and Bitcoin ATMs in Europe, which is particularly worrying - that networks like these can control ATMs," says George.
Ayyash, of course, is not an isolated incident. "There are many sites asking for aid and funding to oppose the occupation. These people are everywhere on Instagram. There are hundreds of student Instagram accounts that support the Palestinians. Some sites say they are collecting donations to help young people in South Sudan, Afghanistan and elsewhere. The neo-Nazis have a lot of crypto wallets."
Taking them on seems like trying to drain the ocean with a spoon.
"The problem is that these sites aren’t being shut down. One journalist recently checked and found that the social networks took down only 1% of these accounts, because it's a big business for them. 97% of the brainwashing news out of Gaza comes from Hamas. If it were possible to get to the source and take it down, that would be useful."
Published by Globes, Israel business news - en.globes.co.il - on September 2, 2025.
© Copyright of Globes Publisher Itonut (1983) Ltd., 2025.