Terrorist Financing Shifts to USDT on TRON: 25 Years After 9/11
Twenty-five years after the 9/11 attacks, a detailed review by blockchain intelligence firm TRM Labs shows that terrorist financing has undergone a structural transformation. The hawala brokers and cash couriers that moved the estimated USD 500,000 cost of the 9/11 plot are still operating, but they now sit beneath a cryptocurrency layer dominated by USDT on the TRON network. For accounting firms, auditors, and CFOs building AML frameworks around digital assets, the practical takeaway is immediate: stablecoin flows can no longer be treated as a residual risk category. They are the primary channel for some of the world's most scrutinised illicit actors.
From Hawala to Blockchain: The 25-Year Arc
The counter-terrorist-financing regime built after 9/11 was designed around the tools of 2001. Sanctions designations, suspicious-activity reporting obligations, and pressure on correspondent banks were calibrated to catch money moving through the international banking system. Hawala, the trust-based broker settlement network, was the blind spot: a broker in one city would hand out cash on the word of a broker in another, the two offsetting each other through unrelated transfers, leaving no wire record and nothing to subpoena.
The cryptocurrency transition
Hamas's military wing, the Izz al-Din al-Qassam Brigades, was among the first designated terrorist organisations to formally solicit cryptocurrency donations, beginning around 2019 with Bitcoin fundraising appeals. The operational logic was straightforward. As ISIS's physical caliphate collapsed, its affiliates in Afghanistan, Somalia, Nigeria, and the Sahel needed to push small sums across borders where correspondent banking barely functions. Cryptocurrency met that need with speed, low fees, and no requirement for a bank account.
By early 2023, the UN Analytical Support and Sanctions Monitoring Team had documented ISIS's Somalia-based al-Karrar office moving roughly USD 25,000 per month in cryptocurrency to Islamic State Khorasan Province in Afghanistan. TRM's own data confirmed the pattern: ISIS affiliates transferring operational funds among themselves on-chain, with a particular focus on supporting members and families detained in Syrian camps.
Why USDT on TRON became the instrument of choice
The dominant instrument is now Tether's USDT issued on the TRON network. The reasons are straightforward from a pure utility standpoint: value is pegged to the US dollar (eliminating price volatility between fundraising and disbursement), transaction fees are negligible, and settlement is final within seconds. For organisations coordinating across multiple jurisdictions with unreliable infrastructure, those properties are significant advantages.
Fundraisers have adopted a specific operational pattern. A fresh deposit address is generated for each donor, the addresses are distributed over encrypted messaging platforms, and the addresses are rotated constantly. This frustrates address clustering, blacklisting, and real-time interdiction. Collected funds are then typically converted back to local currency through regional exchanges and informal brokers — the same cash-out endpoint that hawala provided in 2001, now reached via an on-chain path that leaves a permanent record.
The Expanding Use Case: From Fundraising to Attack Finance
Until recently, terrorist organisations used cryptocurrency primarily for general fundraising and covering operating costs. That scope has widened materially.
Weapons procurement and dual-use goods
ISIS affiliates in Africa have publicly solicited cryptocurrency specifically to purchase weapons and drones. Yemen's Houthis have used it to procure dual-use goods applied to uncrewed aerial vehicles and counter-UAV equipment, including components sourced through a Russian broker reselling Chinese-manufactured systems. The supply chain runs on-chain at one end and through informal brokers at the other.
The Crocus City Hall precedent
The March 2024 attack on Crocus City Hall in Moscow, carried out by Islamic State Khorasan Province and killing approximately 145 people, included cryptocurrency in the direct financing of the operation itself. This is a significant escalation in the documented use case. Prior cases involved general funds flowing to organisations; Crocus City Hall involved crypto moving to finance a specific attack. For compliance professionals, this distinction matters because it shifts the risk model: a stablecoin transfer to a designated entity's wallet is no longer merely a sanctions violation, it may constitute material support for a specific act of violence.
AML Implications for Accounting Firms and CFOs
The structural shift in how terrorist financing moves has direct consequences for firms that hold, process, or account for digital assets. Effective crypto accounting software and broader AML controls need to be calibrated to the current threat model, not the one that existed when most compliance manuals were written.
Stablecoins are high-risk by default
USDT on TRON has now appeared in documented enforcement actions across multiple jurisdictions and multiple designated organisations. Firms that treat stablecoin inflows as lower-risk than other crypto assets because they are "just dollars" are miscalibrating. The stability that makes USDT operationally attractive to terrorist fundraisers is the same property that makes it attractive to legitimate users. Compliance controls need to differentiate by counterparty and transaction pattern, not by asset type alone.
Rotating deposit addresses and clustering analysis
The rotating-address pattern documented by TRM, and confirmed by the US Justice Department across five separate enforcement actions since March 2025 recovering roughly USD 560,000 from Hamas-aligned flows, is specifically designed to defeat simple blacklist-matching. A wallet address that has never appeared on an OFAC SDN list is not clean by default. Firms need blockchain analytics capabilities that can trace funds across address hops and flag behavioural patterns, not just perform point-in-time address screening. This is where digital asset accounting software that integrates on-chain monitoring, rather than operating purely as a ledger tool, becomes material to an AML control framework.
The cartel-terrorist overlap and expanded designation scope
In 2025, the US government designated eight cartels and transnational gangs as Foreign Terrorist Organizations. This formally pulled the shared professional laundering economy of the Americas into the counter-terrorist-financing mandate. Accounting firms with clients in the Americas that touch crypto need to reassess whether any counterparties connected to those networks have migrated into scope under the expanded FTO framework. The laundering infrastructure, regional exchanges, informal brokers, cross-chain swaps, was already shared. The legal exposure is now also shared.
Sham charities and crowdfunding compliance
Prosecutors have unwound cases involving fake charitable organisations that collected funds on mainstream crowdfunding platforms and moved proceeds onward in cryptocurrency. In one documented case, around USD 30,000 moved through approximately 80 transactions to a Palestinian Islamic Jihad member. In another, more than USD 116,000 reached a Hamas member. Accounting firms that provide services to nonprofits or charitable entities holding crypto need explicit procedures for verifying that fundraising flows match stated charitable purposes, and that downstream recipients are not designated.
For a detailed look at how on-chain monitoring connects to sanctions obligations in practice, see our analysis of how blockchain analytics intersects with sanctions compliance. The parallel enforcement pattern involving stablecoins and OFAC is also visible in the DOJ's $61M USDT forfeiture over Iranian oil sanctions.
Where Enforcement Stands and What Comes Next
The TRM analysis notes that the number of law enforcement arrests and seizures involving cryptocurrency and material support for terrorism has risen steadily since 2020. In 2026, coordinated public-private action froze roughly USD 475 million linked to Central Bank of Iran wallets across two OFAC actions, with a stablecoin issuer executing the freeze directly. That issuer-level freeze capability is, at present, one of the most powerful interdiction tools available, faster and more certain than traditional asset restraint orders.
The freeze-resistance threat
The Financial Action Task Force has flagged the prospect of proprietary stablecoins engineered to resist freezing and seizure, effectively combining the settlement speed of stablecoins with the unfreezability of cash. TRM expects continued experimentation with cross-chain swaps and privacy coins toward that end. If freeze-resistant stablecoins achieve meaningful adoption among designated actors, the issuer-level interdiction tool currently available to OFAC and foreign equivalents would be significantly weakened. Firms with exposure to newer or less-regulated stablecoin issuers should monitor this risk explicitly.
Generative AI on the horizon
Generative AI has not appeared in any documented terrorist financing case to date. TRM expects it to emerge first in low-signal forms: synthetic identities used to open accounts at virtual asset service providers, or mass-produced multilingual donation appeals scaled across encrypted platforms. Both scenarios have direct implications for customer due diligence processes. Identity verification that relies solely on document matching will struggle against synthetic identity fraud at scale. Compliance programmes built on crypto bookkeeping software need to be paired with CDD procedures that can detect behavioural anomalies, not just document-level inconsistencies.
What Firms Should Do Now
Three practical steps follow from the current threat picture.
Calibrate stablecoin risk scoring
Risk models that treat USDT and USDC as equivalent to fiat for AML purposes need to be updated. USDT on TRON in particular should carry a higher inherent risk score pending enhanced due diligence on the specific counterparty and transaction context.
Connect crypto accounting software to on-chain monitoring
Ledger-level bookkeeping captures what happened. On-chain monitoring captures what the funds touched before they arrived. Firms need both layers connected, so that a suspicious-activity report can be drafted with on-chain provenance data attached, not reconstructed after the fact from exchange records that may arrive weeks later under a subpoena.
Review nonprofit and charitable client portfolios
The sham charity typology documented in recent prosecutions is not exotic. It uses mainstream platforms and small transaction sizes specifically to avoid triggering automated thresholds. Any accounting or audit engagement involving a nonprofit that accepts crypto donations requires explicit procedures for verifying downstream recipient legitimacy.
Source: TRM Labs
Frequently Asked Questions
Why has USDT on TRON become the preferred instrument for terrorist financing?
USDT on TRON combines dollar-pegged value stability with near-zero fees and near-instant settlement. For organisations coordinating across jurisdictions with weak banking infrastructure, those properties make it operationally superior to Bitcoin and many other assets. The stable value also means funds do not lose purchasing power between collection and disbursement.
What is the rotating deposit address technique and why does it matter for compliance?
Fundraisers generate a unique deposit address for each donor and rotate addresses frequently, distributing them over encrypted messaging apps. This defeats simple blacklist screening because most addresses have never appeared on a sanctions list. Effective controls require behavioural and graph-based analytics, not just point-in-time address lookups.
How does the 2025 FTO designation of cartels affect crypto AML obligations?
Designating eight cartels and transnational gangs as Foreign Terrorist Organizations means that providing material support to those organisations, including processing their crypto transactions, now carries the same legal exposure as dealing with a conventional terrorist group. Firms with Latin American counterparty exposure should reassess their risk classifications accordingly.
Can stablecoin issuers freeze terrorist-linked funds, and is that reliable?
Yes. Tether and other major issuers have demonstrated the ability to freeze wallets on request from law enforcement and regulators, as illustrated by the OFAC actions in 2026. However, FATF has flagged the risk of proprietary stablecoins specifically engineered to resist freezing. Firms should not treat issuer-freeze capability as a permanent safety net when evaluating newer or less-regulated stablecoin issuers.
What should accounting firms do differently in their crypto AML controls right now?
Three changes are most urgent: raise the inherent risk rating for USDT on TRON flows pending enhanced due diligence; integrate on-chain provenance data into suspicious-activity reporting workflows rather than relying solely on ledger records; and introduce explicit procedures for verifying downstream recipient legitimacy in any nonprofit or charitable client that accepts crypto donations.