Methodology
The authors monitored the official and unofficial channels, as well as internal discussions of ISKP media operatives and supporters, between September 2024 and February 2025. The monitoring took place on Telegram, Element, RocketChat, and Teleguard, where ISKP operatives and its supporters are active and coordinate their online fundraising activities. We analyze the ongoing crypto fundraising efforts and interactions between ISKP’s Tajik, Uzbek, Russian Pashto, Persian, and Urdu-speaking media contingents, which operate alongside other IS advocacy foundations. The authors also monitored the crypto addresses and related transactions that were part of these fundraising campaigns using various open-source tools, including TronScan, BlockChair, and Arkham Intelligence.
Introduction
In our previous Insight, we explored the coordinated fundraising efforts and interactions between pro-Islamic State Khorasan Province (ISKP) media propagandists and entities and foreign IS women held in northern Syrian detention camps. This Insight shifts focus to ISKP’s official multilingual propaganda arm, Al-Azaim Foundation, and its key role in fundraising for ISKP primarily through cryptocurrency donations. While ISKP promotes the use of Monero in the Voice of Khorasan magazine, our monitoring of these financial networks reveals that ISKP media predominantly uses stablecoins like TRC 20 to move and store funds.
Charity for Mujahideen: al-Azaim Uzbek’s Reinvigorated Fundraising Endeavours
Following the crackdown on ISKP’s Tajik and Russian media channels on Telegram after the March 2024 Moscow concert hall attack, ISKP’s Al-Azaim Uzbek has stepped in to fill the void by gradually spearheading ISKP’s public-facing crowdfunding operations. The need for this transition became clear in June 2024 after Al Azaim Russian media, for the first time on Telegram and Rocket Chat, advertised an independent crowdfunding campaign focusing on providing humanitarian aid for IS families in Afghanistan. It did this by circulating the TRC 20 address which received $5,000 in just two weeks, between 4 and 18 June 2024. This raised concerns that the donations could instead be redirected for planning terrorist attacks. ISKP’s Tajik media networks, also previously under the guise of relief aid for detained IS families in Syrian camps, purportedly funnelled the crypto donations to the perpetrators of the Moscow concert hall attack. ISKP has thus effectively radicalised and mobilised disaffected Muslim populations in the Central Asia region—primarily Tajiks – by leveraging its sophisticated multilingual propaganda through al-Azaim media. It has built extensive and deeply entrenched recruitment and financial networks across Russia and Central Asia. Until March 2024, ISKP’s Tajik network relied not only on Bitcoin and TRC2 20 donations but also encouraged direct bank transfers. It gave out bank transfer details of IS-linked purported financial intermediaries based in Russia who held accounts with SBER, the largest state-owned Russian bank, which the U.S Treasury has sanctioned.
Figure 1: Poster circulated by ISKP Uzbek propagandists urging supporters to send money for IS families in Syria.
The crackdown on ISKP’s Tajik and Russian language media channels and its rather restricted presence on Telegram has consequently pushed al-Azaim’s Uzbek wing to adopt a more discreet and strategic approach to fundraising efforts. Instead of openly soliciting funds, Al-Azaim Uzbek circulates fundraiser appeals for IS women and fighters in Syria’s detention facilities within internal supporter Telegram discussion groups, where supporters are urged to send TRC 20 donations. As discussed in the first Insight, they also depend on leading ISKP propagandists to bolster their propaganda outreach and promote their donation drives. A key strategy likely involves redirecting funds to the organisation through crowdfunding initiatives led by Uzbek IS loyalist women in Syrian camps (Fig 2). Additionally, potential donors and recruits are often directed to a Telegram bot, which, in some cases, provides alternative money transfer options. It also connects them with ISKP Uzbek recruiters to facilitate their migration (hijrah) to Afghanistan, joining the group’s ranks and personally allowing them to send money transfers directly to the recruits and ISKP-related financial intermediaries. The bot is also promoted by ISKP Uzbek propagandists to generate mass awareness and to ensure that supporters directly contact the official ISKP operatives evading scrutiny and infiltration attempts by security agencies.
Figure 2: An image posted on Telegram boasting the fruits of a crowdfunding initiative.
On some occasions, Al-Azaim Uzbek has coordinated its media operations with its Russian counterpart, actively cross-sharing propaganda and links to the al-Azaim Russian Telegram Bot, also hinting at the prospect of joint fundraising campaigns. Given the previous misuse of funds by the Tajik ISKP network for recruitment and violence, the Al-Azaim Uzbek can also divert the funds gathered through its crowdfunding campaigns to ISKP’s operational activities. Monitoring the transaction trail revealed that the TRC-20 address created in September 2024 was still operational and being utilized by Al-Azaim Uzbek in February 2025.
Al-Azaim Tajik’s Crowdfunding Campaign in Sync with IS-linked Media Groups
The Al-Azaim Tajik and other ISKP Tajik supporter media entities have also been struggling to establish a sustained long-term presence on Telegram due to the regular bans and takedowns. Al-Azaim Tajik operates on Telegram via two main bots, spreading propaganda, enabling communication between ISKP members and supporters, and sharing TRC-20 coordinates with prospective donors.
However, at the start of Ramadan, Al-Azaim Tajik bots shared an audio message originally published in 2024. The message emphasized the proper observance of the holy month and the importance of charitable giving to the needy as a religious obligation, particularly during Ramadan. The message was produced by Sheikh Zaid Badri, ISKP’s most prominent Tajik- and Farsi-speaking ideologue, who has released numerous religious lectures and anti-Taliban sermons over the past four years.
Notably, the authors observed that the TRC-20 coordinates used by Al-Azaim Tajik were also provided by the pro-Turkish IS media outfit, Al Basair Foundation, for their crowdfunding pleas for detained IS women on Telegram. This revealed the nature of ISKP media’s collaborative fundraising nexus with IS-led networks in Turkey. Additionally, the Tajik, Uzbek, and Russian branches of Al-Azaim widely disseminated a propagandist leaflet (Figure 3) issued by Al-Basair media, asserting that only the ‘Caliph’ or authorised IS representatives are permitted to collect Zakat for IS detainees in Syria, barring any unauthorized collection of donations or defrauding of IS detainees and supporters in the name of aid.
Figure 3: Al-Basair Media’s poster circulated, urging supporters to send funds and cautioning them against unauthorized aid collections for IS detainees except under the oversight of IS officials.
This highlights an overlap in ISKP’s Tajik and Turkish financial networks. ISKP has increasingly exploited Turkey as a critical logistical and financial conduit. This is evident from the involvement of Central Asian nationals — primarily Uzbeks and Tajiks based in Turkey — involved not only in ISKP’s transnational recruitment and fundraising schemes but also in attacks. For example, a Tajik national apprehended by the FBI in New York in March in support of IS and ISKP facilitated more than $50,000 between 2021 and 2023. He was believed to be in direct contact with long-time ISKP operatives in Turkey, including Tajik nationals. Among them was a key conspirator in IS’s claimed Jan 2024 attack on Santa Maria Church in Istanbul, as well as a longtime ISKP recruiter and financier, Shamil Hukumatov. IS sympathizers in Europe have also been exhorted to send donations through Western Union transfers in Turkey and PayPal.
Additionally, TRC-20 addresses associated with Al-Azaim’s Uzbek, Russian, and Tajik branches received regular transfers from a common crypto address, which appears to be the central financial node in all of ISKP’s coordinated fundraising activities. Furthermore, half of the money processed through these addresses was channelled through major centralised exchanges like Kraken, Bybit, Binance, and Hibtc. Decentralized non-KYC exchanges, such as FixedFloat, also funnelled transfers to the wallet address of Al-Azaim’s Turkish-Tajik wings, highlighting IS/ISKP’s gradual experimentation with decentralized crypto exchanges and DeFi tools to obscure the trail of funds.
Al-Azaim’s Pashto-Farsi Crowdfunding Nexus and the ISKP Exception
The Pashto and Farsi wings of the al-Azaim Foundation ostensibly operate closely together on the media front. With frequent bans on their Telegram presence, these ISKP media wings have been more active on encrypted applications RocketChat, Element, and Teleguard. They regularly post propaganda, IS attack claims and other security developments. ISKP media operatives who serve as admins for the Pashto chat rooms also moderate the Farsi discussion groups. Al-Azaim’s Pashto and Persian Telegram bots also share links to their Element and RocketChat channels, which are cross-promoted among bots and channels across all three of Al-Azaim’s media wings, highlighting a tightly coordinated media strategy between them. These same accounts used by these ISKP media operatives frequently share content from the al-Azaim Urdu and media outlets of Nashir Al Pakistan and Nida-e-Haq of Islamic State in Pakistan Province.
In contrast to the closely linked and collaborative fundraising operations managed by Al-Azaim’s Central Asian and Russian wings, the fundraising environment of the Pashto, Persian and Urdu branches varies significantly. The al-Azaim Pashto and Farsi wings primarily focus on circulating propaganda. Notably, Pashto and Farsi-speaking supporters, as observed from their discourse in ISKP discussion chat rooms, show a lack of interest and engagement in organizing independent or coordinated fundraising campaigns or discussing secure ways to send donations to the group. The only time these media wings and supporters highlight the importance of fundraising is through ISKP’s Voice of Khurasan, which calls upon untraceable Monero cryptocurrency donations. This suggests that crypto donations do not make up the majority of their fundraising efforts. Instead, Pashto- and Farsi-speaking propagandists who manage these channels likely rely on hawala transfers, collect offline donations from supporters in Afghanistan and Pakistan, or rather directly rely on IS’s regional al-Siddiq financial office for sustaining their media operations. However, on recent occasions, some ISKP media personnel who serve as the administrators of both the private Pashto and Persian discussion channels on Element circulated a common TRC 20 wallet address as a part of their united fundraising efforts.
On the other hand, the Islamic State in Pakistan Province’s (ISPP) media outlet, Nashir Al-Pakistan, launched a fundraising campaign soliciting cryptocurrency donations under the pretence of aiding victims affected by the February 2023 earthquake in Turkey and Syria. This raises concerns about the entanglement of humanitarian aid with extremist ideology, posing significant ethical and transparency challenges. A notable example is the exploitation of the Israel-Hamas conflict by jihadist groups to raise cryptocurrency donations. Further, the ISPP media operatives, in their discussion channels on Telegram, have lately given out TRC 20 and Monero addresses along with accepting transfers via Pakistani mobile wallet JazzCash and digital bank application Easypaisa. Thus, Pakistan stands out as a crossroads for key IS financial activities, with both ISKP and ISPP leading separate fundraising campaigns via their online media entities, albeit with different pathways.
Figure 4: Nashir Pakistan of ISPP branch regularly sharing Monero coordinates for donations on different platforms.
While ISKP’s financial flows are managed by IS’s regional al-Siddiq office, the office also oversees the Qawqaz province, which includes the Caucasus region. This further underscores the intricate and clandestine nature of ISKP’s transnational financial networks. In June 2024, the US Department of the Treasury designated Adam Khamirzaev as the IS emir of Georgia and responsible for the January 2024 Santa Maria Church attack in Istanbul. These deeply embedded financial networks span not only Russia, Türkiye, and Central Asia but also Europe, with IS supporter networks organising crowdfunding initiatives for ISKP. Further, the arrest of a German national and another man in the UK for sending more than €16,000 to ISKP reflects the group’s growing capability to mobilise its followers worldwide to contribute to its cause.
Conclusion
The interconnected nature of the ISKP fundraising mechanism is highly complex and multifaceted. While distinct overlaps are evident among certain branches—such as the Turkish, Uzbek, Tajik, and Russian networks—the financial ties and interactions between the Pashto, Farsi, and Urdu ISKP media branches remain obscure. ISKP ties also extend to IS Somalia, which financed the deadly 2021 Kabul airport bombing.
The Insights of this study also reinforce the findings of the latest UNSC report, which states that ISKP has shifted from generating revenue through abduction and extortion to fundraising via cryptocurrency in the tens of thousands of dollars. The same QR codes and virtual addresses were repeatedly used for laundering funds, a trend which aligns with our research, demonstrating the group’s confidence in its ease of use with cryptocurrencies. USDT currency and Tron blockchain thus remain the primary choice for IS, ISKP and their associated fundraising campaigns. The adoption of Monero in the short term remains unlikely due to technical complexities and usage restrictions, such as the delisting of Monero and other privacy coins by major exchanges.
While many centralised exchanges (CEXs) enforce strict Know-Your-Customer (KYC) measures, others that operate under weak regulations — facilitating money laundering for criminal and extremist organisations — should be rigorously monitored, taken down and sanctioned. There must also be real-time information sharing between exchanges and blockchain analytics firms to monitor, flag, and freeze crypto assets linked to IS, ISKP, and other hostile actors. Automated systems with real-time monitoring should cross-reference transactions against updated watchlists of suspicious addresses used in terror financing. Strengthening international cooperation and regular and rapid cross-border data sharing between law enforcement and the crypto industry is also essential to quickly dismantling the financial infrastructure of militant groups.
Mona Thakkar is a Research Fellow at ICSVE, where she focuses on monitoring militant jihadist groups and their financial networks. X: t16_mona
Riccardo Valle is an Italy-based researcher and the founder of Militancy Chowk. He conducts research on international jihadi non-state actors in different areas, particularly but not exclusively in Afghanistan and Pakistan. X: @Valle_Riccardo