ISKP’s QR Codes and the Limits of Text-Based Monitoring

By Aamir Hayat

14th October 2026 In Insights

On 1 July 2026, the US Treasury’s Office of Foreign Assets Control added 134 cryptocurrency addresses (131 TRON and three Monero) to its existing entry for Islamic State of Iraq and the Levant-Khorasan (ISIL Khorasan), an organisation designated as a Foreign Terrorist Organization since January 2016. Chainalysis reported on the same day that the TRON wallets had received over US$1.4 million since 2023, and that Tether had frozen the balances on all 131 of them. All three Monero addresses appeared months before designation.

This Insight analyses how Islamic State Khorasan Province (ISKP) distributes cryptocurrency donation addresses across text, image and machine-readable layers. To function, public solicitation must leave an actionable path for potential donors to follow. In the corpus examined in this Insight, the path can be traced across message text, images, documents, quick response (QR) codes and contact identifiers, sometimes redundantly and sometimes in one medium only. Monitoring confined to a single layer therefore risks mistaking absence from that layer for absence of a campaign in its entirety. The clearest evidence is a designated wallet that appears nowhere in 393,832 retrieved text messages. It surfaced 486 days before Treasury acted, circulated only as images attached to messages containing no words, and was still being advertised 59 days before the designation.

Method and Limitations

The data source for this Insight is a live, self-hosted Rocket.Chat instance used by ISKP’s media outlets and their translation network, collected by direct retrieval from the running service rather than from a static archive, and re-checked live on 25 September 2026. The retrieval covers 393,832 messages across 589 channels, spanning December 2018 to September 2026. Attachments (files posted with messages, such as images and PDFs) were then inventoried in 29 of those 589 channels: 33,722 records, of which 29,640 were retrieved; the remainder were skipped by the filter (which excluded video, audio, compressed archives, Office documents and images under 200 pixels on their shorter side, such as icons and emojis), lost to Hypertext Transfer Protocol (HTTP) errors, or missing. The resulting 23,524 images were QR-scanned, and 2,299 document pages were rendered and scanned rather than read as text. This layer, not the message text, is where the findings below were recovered. Designated-address matches were cross-referenced against official US Treasury notices.

These findings were subject to five limitations. This is one platform, and the absence of an address does not mean that it was not published elsewhere. Only 46% of the server’s total reported messages were retrieved, so each count here is a minimum, not a total. Attachments were checked in only 29 of the 589 channels, and two lower-priority batches of files were not checked at all. The QR scanners were also imperfect: two scanners run on the same material disagreed, with one producing five false readings from ordinary photographs and the other missing a real QR code that the first one read. Finally, no blockchain data was collected for this study, so all figures on payments and frozen funds come from published analysis. As of 25 September 2026, all 25 monitored posts remained accessible on the self-hosted server, and 21 of 22 image attachments could still be opened. 

The Address That Wasn’t There

The earliest of the three designated Monero addresses does not occur in the text of the corpus at all. It occurs fifteen times as a QR code across nine distinct images, and only in a single channel, between 2 March 2025 and 3 May 2026 – 486 days between the wallet’s first appearance and Treasury’s action – and it was still in circulation 59 days before that action. Each of these messages has a text length of zero characters; as such, there is nothing for a keyword search to find. 

Figure 1: Nashir Pakistan donation panel, 2 March 2025. Identifiers masked.

The poster (Figure 1) carries the masthead of Nashir Pakistan, a regional outlet distinct from the al-Azaim brands most commonly monitored, so surveillance organised only around al-Azaim brands would miss it. And optical character recognition (OCR) does not solve the issue, as the address is set in a decorative serif face, and machine-reading the panel returns a string with four glyph errors that matches nothing on the sanctions list. The QR code beside it decodes to the exact address on the first attempt.

Three of Three, and None of 131

With the attachment layer read, all three designated Monero addresses first appeared on the self-hosted Rocket.Chat server 87, 394 and 486 days before designation, respectively. Two are reproduced in the corpus exactly as Treasury published them; the third differs by a single character, and as the next section shows, the invalid character was Treasury’s. None of the 131 designated TRON addresses appears in any of the three layers examined. One document suggests why: the four-language donation card in Figure 2 directs donors to send zakat and infaq via Monero and, for other currencies, to contact a bot. That is one documented instance of addresses being handed out privately, not a general rule for every non-Monero chain, and because only 46% of messages were retrieved, not finding the TRON addresses does not prove they were never posted publicly.

Figure 2: Four-language donation card, 16 November 2025. Identifiers masked.

The private route is not invisible, though. The outlets’ contact footers carry 13 identifiers for the encrypted messaging app Session, strings of preformatted text that can be recognised by a machine. These are not payment instructions, but rather gateways to payment instructions, and one of them was posted in three language channels over the same period – no wallet here did.

A Sanctions Entry That Could Not Be Read

The second designated Monero address was published with a lowercase “l” as its 27th character. The Base58 alphabet Monero uses excludes that character precisely to prevent confusion with the digit “1”. As published by Treasury, the entry could not be decoded, and no exact-match screening system could match it to the wallet the group was promoting.

The searchable Specially Designated Nationals (SDN) List entry still carried the invalid string until it was corrected in the 10 September list update, 71 days after designation, though the archived action notice of 1 July still carries the original string. While the erroneous entry remained, an exact-match screening pipeline working as designed would have returned the sanctioned wallet as not sanctioned.

The Same Pattern in Print

The practice of confining donation addresses to machine-readable image layers extends beyond chat messages into ISKP’s periodical publications. The publication archive contains 158 files, of which 157 are valid PDFs and 156 could be converted page by page into images for QR scanning in September 2026. Collectively, they make up 2,299 pages which were scanned, finding a Monero donation QR (Figure 3) close to the end of six separate publications: four full issues of the English-language magazine Voice of Khurasan and two regional editions with the QR on page 95. All six share the same wallet, which is not one of the designated ones – a single code printed on multiple products. If an analyst or automated system followed only the English magazine, they would see only four of the six publications and miss the two regional editions. In all cases, the address appears only within the QR code, not in the extractable text.

This corroborates Tulga’s December 2024 Insight, which found that the magazine’s donation section, introduced in issue 29, appears in most subsequent issues. It also shows the reason for failed detections directly: a pipeline that classifies a document as “has a text layer, therefore search the text” skips donation QRs near the end of four magazine issues.

Figure 3: Donation QR on page 91 of the 92-page Voice of Khurasan issue 33 (cover-dated March 2024; posted 29 February 2024). Identifiers masked.

The Recovered Register

Eleven addresses were recovered across all layers (Table 1): ten Monero and one TRON, three of them designated. The inclusion rules require a checksum-valid address (a string whose embedded mathematical error-checking code confirms it is a correctly formatted address with no typographical errors) in solicitation material carrying ISKP media-outlet branding. Other checksum-valid Bitcoin and Ethereum strings are excluded because they appeared as bare text without donation appeals or media-outlet branding, leaving no empirical evidence connecting them to ISKP campaigns. Identifiers are truncated.

Table 1. Solicitation-linked addresses under the stated inclusion criteria, by layer. Windows cover dated sightings in the collected corpus; lead time runs to the 1 July 2026 update. XMR = Monero; XMR sub = Monero subaddress.

Two Attempts to Become Illegible

As Daria Alexe argues, automated micro-transfers can frustrate detection on the blockchain itself. Solicitation, in this corpus, could not be broken into smaller, less visible pieces in the same way: to reach a donor it did not already have access to, the group had to publish something a stranger could read and act upon. During 2026, the group twice tried to make its donation address harder to find, and both times reversed the attempt in the same message.

On 5 April 2026, a broadcast on al-Azaim’s Farsi-language channel announced that the group’s current Monero donation address had been deactivated and that donors should contact the outlet to obtain the active one. It gave no contact details and printed the new address in full in the same message. In May, that address was posted in two languages with a space inserted mid-string, apparently to defeat automated scanners, accompanied by a note telling donors there is no space between the characters (Figure 4). Across the 2024–2026 corpus, the observed windows shortened from twelve months to ten months, then to five weeks.

Figure 4: Spaced wallet string, 11 May 2026. Identifiers masked. Translations added by the author.

This reflects an observable limit on adaptation within this corpus rather than a claim about timing. It complements Adam Rousselle’s argument that propaganda ecosystems generate the trust that decentralised fundraising depends on, and aligns with his recommendation that platforms forward discovered identifiers to investigators. What distinguishes this argument from Rousselle’s is legibility rather than trust: each attempt to reduce the readability of a solicitation address was reversed within the same message, likely because readers must be able to parse the address to engage in a transfer. This limit also complements Alexe’s proposed countermeasures, which can only kick in when money moves – the solicitation takes place before the transfer.

The Asymmetry

The persistence of these identifiers illustrates a gap between freezing funds on the blockchain and the continued visibility of the appeals that raise them. Tether froze the balances on all 131 designated TRON addresses; however, the three Monero addresses exist on a privacy-preserving ledger and cannot be frozen by any issuer, and their solicitation remained publicly accessible. Because privacy-preserving currencies cannot be frozen on-chain, monitoring pipelines must inspect graphical payloads rather than relying solely on extractable text. These findings therefore support six changes.

1. Decode, and then validate, QR codes and their results. The QR beside the designated address was read correctly the first time, but OCR of the same panel had four errors and therefore did not match the sanctions list. Since decoding is not self-validating and both detectors here disagreed, companies should treat a decode as a lead until it passes its format and checksum rules, and confirm important negatives with a second decoder.
2. Scan messages that contain no text. Each time the 486-day address was detected, it was in a zero-length message. A pipeline that gates on the presence of text will not notice these instances.
3. Never let “has a text layer” decide whether a document is inspected. Text extraction and page rendering are different problems. In six publications, the donation QR sat on a page whose text extracted cleanly and contained no wallet address.
4. Validate before alerting, in every modality. During the primary extraction run, a naive TRON pattern returned 75 candidates, one of which passed checksum validation, and a second pattern returned 44 candidates, none of which passed checksum validation. The majority of false positives were substrings of Monero addresses. Shape is not evidence in text, images, or barcodes.
5. Screen wallet addresses by decoded key, not by published string. One character meant that a register entry could not be matched to the group’s wallet for 71 days. Undecodable entries should be returned to the issuing authority for closer assessment as a matter of course.
6. Route recovered addresses onward rather than only deleting the post. Deleting a post removes its reach and can discard the identifier, making it more difficult for researchers to trace and identify future solicitation attempts using the same language or addresses.

—

Aamir Hayat is an independent researcher and analyst specialising in how terrorist actors exploit emerging technologies. His research examines Islamic State Khorasan Province (ISKP) and other transnational networks, particularly their use of artificial intelligence, online propaganda and cryptocurrency, and the resulting challenges for counter-terrorist financing.

—

Are you a tech company interested in strengthening your capacity to counter terrorist and violent extremist activity online? Apply for GIFCT membership to join over 30 other tech platforms working together to prevent terrorists and violent extremists from exploiting online platforms by leveraging technology, expertise, and cross-sector partnerships.

The views and opinions expressed in this Insight are the authors’ own and do not necessarily reflect those of GNET or any of its partners.

Aamir Hayat

More by Aamir Hayat

Share

0 0 0

Tags: Financing, Islamic State