Cryptocurrency Crowdsourcing by Russian-Speaking Foreign Fighters in Syria

In August 2020, the US Department of Justice announced that it had successfully dismantled three cryptocurrency terrorist-financing campaigns, including some operated by Al-Qa’ida-linked groups in Idlib, Syria. One such group is Malhama Tactical (MT), a Russian-speaking jamaat (military brigade) affiliated with Hayat Tahrir Al-Sham (HTS). MT, inter alia, provides tactical training to various HTS armed factions, and has also fought on the battlefield alongside HTS. MT has also been a pioneer among Russian-speaking militant factions in Idlib in promoting the use of Bitcoin as a more secure method for facilitating crowdsourced donations.

MT from QIWI to BTC

MT was created in April 2016 by Sukhrob Baltabayev, an ethnic Uzbek from Russia. Baltabayev travelled to Aleppo, Syria in April 2014, and associated himself with Jamaat Sayfullaha Shishani, a Chechen-led brigade which in early 2014 pledged bayah to HTS’s predecessor, the Al-Qa’ida-linked faction Jabhat al Nusra (JAN). Prior to travelling to Syria, Baltabayev had been a small-scale entrepreneur who designed websites for businesses in Kazan, Russia. In Aleppo, Baltabayev adopted the kunya Abu Rofik Tatarstani and the online pseudonym Muslim Abdullaev, and described himself on his VKontakte account as a ‘blogger, publicist and military trainer’ who had served as a sniper in the Russian elite special forces. His role in Aleppo, however, was mainly as a fundraiser. Baltabayev used the Russian VKontakte social network to crowdsource donations from supporters, claiming that donors could directly participate in jihad by financing the recruitment of new mujahideen, training, weapons and ammunition. Like other Russian-speaking militants in Syria, Baltabayev used the Russian QIWI Koshelek electronic payment system to facilitate the transfer of funds from supporters in Russia. Donors can use QIWI’s network of terminals to deposit cash and send it to an account controlled by the terror-funding network. The funds raised are transferred to Turkey, and then sent to recipients in Syria via smuggler networks or the hawala system. QIWI is easily accessible and familiar to donors in Russia. However, Russia’s Federal Security Service (FSB) has frequently succeeded in tracking and arresting individuals who send money to Syria via QIWI, often because terror funders post the QIWI account details openly on social media.

In 2016, the FSB separately arrested two men, Robert Sakhiev and Lenar Nizamutdinov, on terror-funding charges, after they remitted money to Baltabayev via QIWI. In January 2017, Russian media reported that Sakhiev had also allegedly conspired to commit a terrorist attack on an aviation factory in Kazan, and that Al-Qa’ida members in Syria, to whom he had ‘periodically sent money’, were likely behind the plot. At this point, Baltabayev had attracted the attention of Western media outlets, who, in February 2017, dubbed MT ‘the Blackwater of Jihad’ in reports on its training camps for HTS militants. Any public link with international terrorism – including in Russia – would be an embarrassment for the newly formed HTS, which was seeking to distance itself from Al-Qa’ida and thus from any ambitions for external attacks. Baltabayev’s increasing visibility thus posed a risk to HTS, which would not have wanted Moscow, or the regime of Bashar Al-Assad, to know of – and strike – the locations of its MT-run training camps.

On 7 February 2017, MT announced on its Twitter account that Baltabayev and his pregnant wife had been killed in an air strike. In a private chat with this author, posing as a potential funder from Malaysia on 9 February 2017, a source claiming to be a member of MT in Syria said, from a now-deleted Twitter account, that the strike had targeted the apartment block where Baltabayev was living with his family, killing his pregnant wife. Baltabayev, however, was unharmed. To avoid further attacks, MT social media announced that he had been killed. Shortly afterward, Baltabayev returned to social media, posing as ‘Abu Salman Belarus’, the new amir of MT, and promoting Bitcoin as a new mechanism for MT’s supporters to fund his work. In a private chat with the author again posing as a potential funder from Malaysia on 8 June 2018, Baltabayev explained that the move to cryptocurrency had several benefits as he saw it: as a more secure alternative than QIWI for donations from Russia, and as an opportunity to allow donors outside Russia to help MT, which would bring more money to the group. Baltabayev’s move was also inspired by the increasing media attention around jihadi groups using cryptocurrencies for fundraising, in particular Al-Sadaqah, which opened an account on Twitter in November 2017 that solicited donations through Bitcoin. Baltabayev was aware that, if MT started using Bitcoin too, it would attract more media attention to the group, which would also boost its prestige and fundraising potential.

Was Bitcoin a Success for Baltabayev?

Two Bitcoin wallet addresses shared by Baltabayev via MT’s social media in 2018 (1LVwtwghTiorsXKtozvHHQCME3qRcse3DP and 1J5x4is2cqHZFYDeaef2bih5WVWuvEcLdA) were included in the list of accounts blacklisted by the US in 2020. However, analysis of Bitcoin’s open blockchain ledger shows that the total amount sent to the two wallets from July 2018 until their seizure by the US Department of Justice in 2020 was just $115.72. The account beginning 1LVw received two donations, on 13 July 2018 ($41.09) and 22 July 2018 ($28.59), while the account beginning 1J5x received two donations of $23.02 each on 13 August 2018. From July 2018 until his (real) death in August 2019, Baltabayev, as the fictitious Abu Salman Belarus, gained considerable exposure and kudos on social and traditional media – something unmatched by any other small, Russian-speaking jamaat in Syria. MT media activists operated highly accessible social media platforms in English and Arabic as well as Russian, and even ran a Telegram channel – which anyone could join – where it broadcast information about its training camps alongside donation solicitations. MT’s Bitcoin addresses were publicly available and easy to find. It is interesting, therefore, that MT’s high profile did not translate into a significant amount of Bitcoin donations. Indeed, this somewhat surprising reality, particularly in light of media fears regarding the potential use of Bitcoin as a terror-funding mechanism by groups in Idlib, has been noted by other researchers. In a recent report on terrorist use of cryptocurrencies, the Combating Terrorism Center at West Point quoted Collin Almquist of Chainalysis as saying that ‘[We] see a lot of misinformation in the headlines about millions of dollars of Bitcoin being raised for terrorist organizations, and that’s not true’.

However, as Baltabayev predicted, MT's use of Bitcoin as a fundraising mechanism did help it to attract a great deal of attention and publicity, which undoubtedly added to its prestige and notoriety. This may well have contributed to increased donations to MT from other, harder-to-trace sources, such as direct sponsorship from private donors, donations-in-kind of weapons, or increased recruitment.

Infrastructure

As jihadi groups in Idlib began to experiment with offering Bitcoin, infrastructure was also emerging in the province to support the use of cryptocurrency for receiving payments directly in Syria, without having to cash out Bitcoin donations in Turkey and then transfer dollars or Turkish lira to Syria through couriers or hawala networks (which takes longer, is harder to organise, and incurs increased costs). By December 2018, cryptocurrency exchanges had begun operating in Idlib. Blockchain analyst group Chainalysis has identified one of these, BitCoinTransfer, as being used by MT. Another, BitCoinExchange, advertises in English, Russian and Arabic on Telegram, and claims it has physical offices in Idlib city, Darkush and Sarmada. It also runs a 24-hour phone line for clients, providing assistance in setting up accounts with Binance, buying and selling a range of cryptocurrencies including Tether, and handling transactions using a variety of wallets including Payeer and PayPal, which allow users to hold both crypto and fiat currencies. The emergence of these businesses reflects the growing popularity of cryptocurrencies as a money-transfer mechanism in HTS-controlled territory. For Idlib’s foreign-fighter population, their use goes beyond ‘terror funding’ in the literal sense of direct financing of terrorist groups for military purposes. They offer foreign militants in Idlib ways to make digital payments, such as for goods purchased online for transfer via Turkey, or to pay people-smuggling networks to transport them or family members out of Syria.

However, on 21 September 2021, On the Ground News, an English-language media group in northwest Syria, reported on its Telegram channel that HTS had closed all cryptocurrency exchanges and ‘threatened those working in the Crypto Currency [sic.] to stop transactions’. This development suggests that HTS is concerned (or wishes to appear to be) about the rise of the Idlib cryptocurrency market, perhaps because of the reports that cryptocurrency exchanges in Idlib were being used for terror financing and money laundering, including by the Islamic State. Yet despite the apparent crackdown, militants in Idlib are continuing to offer cryptocurrency options for donations, and while BitCoinExchange ceased all posting to its Telegram channel on 21 September 2021, its ‘customer service’ Telegram account remains active as of 4 May 2022, suggesting that it is still operating, albeit more covertly.

Future of Bitcoin for Small Foreign-Fighter Groups in Syria

Although groups such as MT ostensibly have not succeeded in raising large sums via Bitcoin, and while Bitcoin is not completely risk-free for donors, as a means to receive, transfer on or cash out payments, it remains safer than QIWI for Russian-speaking groups, who continue to offer it as part of a wider portfolio of money-transfer and money-laundering mechanisms. Blockchain analysis of Bitcoin addresses used in recent public fundraising appeals by Russian-speaking groups in Idlib reveals that these appeals remain extremely small-scale, raising just tens of dollars at most. There is evidence of a growing awareness of the need to mitigate donor risk around cryptocurrency donations. While some militants continue to share Bitcoin addresses publicly, they increasingly include disclaimers warning donors of the dangers of Bitcoin as a donation mechanism, while others, such as a group soliciting donations for Islamic State women in Al-Hawl camp, and Faruq Shami, an ethnic Tajik close to Tawhid Wal Jihad, the Uzbek HTS faction recently sanctioned by the US, now ask potential donors to contact them privately to obtain Bitcoin wallet addresses. It is possible that, over time, larger or more ambitious brigades or those with more technical skill will follow the example of larger, more sophisticated groups such as the Izz ad-Din Al-Qassam Brigades, the military wing of Hamas, who avoid address reuse and generate a fresh, single-use address for each donor. However, for smaller groups seeking to maximise fundraising potential by offering donors a range of (ostensibly) safe and easy donation mechanisms, Bitcoin will likely continue to be a favoured option. Indeed, a Ramadan 2022 fundraising campaign ‘for military needs’ run by Idlib-based Chechen militants linked to HTS offered Bitcoin, Ethereum and QIWI options, and successfully raised $908.85 through Bitcoin (the group announced on their Telegram channel that the monies were put towards the purchase of a ballistic chronograph and 24 shells).

The views expressed in this Commentary are the author’s, and do not represent those of RUSI or any other institution.

Have an idea for a Commentary you’d like to write for us? Send a short pitch to commentaries@rusi.org and we’ll get back to you if it fits into our research interests. Full guidelines for contributors can be found here.