{"id":4837,"date":"2019-07-15T18:50:21","date_gmt":"2019-07-15T16:50:21","guid":{"rendered":"http:\/\/www.itstime.it\/w\/?p=4837"},"modified":"2019-10-30T18:37:17","modified_gmt":"2019-10-30T17:37:17","slug":"suspicious-crowdfunding-campaigns-in-bitcoin-and-their-exploitation-of-exchange-services-by-daniele-maria-barone","status":"publish","type":"post","link":"https:\/\/www.itstime.it\/w\/suspicious-crowdfunding-campaigns-in-bitcoin-and-their-exploitation-of-exchange-services-by-daniele-maria-barone\/","title":{"rendered":"Suspicious crowdfunding campaigns in bitcoin and their exploitation of exchange services – by Daniele Maria Barone"},"content":{"rendered":"

The world\u2019s attention to the war in Syria is allowing jihadist groups to change their narrative, by disguising their intents behind a false image built around humanitarian aid or struggle against war criminals oppressing innocent people.<\/p>\n

This is potentially giving terrorist organizations and their sympathizers the chance to widen the heterogeneity of their affiliates by globally leveraging through the internet on the atrocities and injustice brought by the war, overlapping issues exclusively concerning violent extremism or radicalization.<\/p>\n

In economic terms, this branch of the global jihadist web communication strategy is translating into a growing number of apparently decentralized (i.e. carried out by individuals or small groups) crowdfunding campaigns accepting bitcoin for either explicit militaristic or charity purposes.<\/p>\n

These campaigns are very numerous and are generating more and more difficulties either in how to identify their real intent (if terrorist related or just scams) and in tracking down the total amount of funds received.<\/p>\n

Indeed, on Telegram, these calls for donations are usually only advertised by explicit jihadist chat groups without ever interacting directly with them; create mirror groups to avoid the risk of being blocked or tracked; provide several donation methods (e.g. PayPal, fundraising platforms on the public web, various bitcoin addresses).<\/p>\n

In order to better explain this trend, the following analysis will focus on a few topic cases related to this opaque calls for bitcoin, as Sadaqa al-Kahir<\/strong> and al-Ikhwa<\/strong>, self-proclaimed charity groups aimed at giving aid in Syria, and al-Sadaqa<\/strong>, a jihadist campaign raising money to support the mujahideen and some of the bitcoin addresses and transactions processed to finance these groups.<\/p>\n

Binance bitcoin address (\u2026<\/strong>bu1s<\/a>)<\/strong><\/p>\n

Before deepening into the analysis of these campaigns, is worth doing a short explanation on the bitcoin address “\u2026<\/strong>bu1s<\/a>” (last four characters of the bitcoin address), which is where the most majority of the donations that will be traced are sent.<\/p>\n

As explained by Bellingcat[1]<\/sup><\/a> and Cointelegraph[2]<\/sup><\/a>, this address belongs to Binance<\/strong>, a very well-known crypto exchange service, which allows users to trade cryptocurrencies for fiat money or other digital currencies. In particular, it was discovered that this exchange service has been used to send bitcoin to Izz ad-Din al-Qassam Brigades, the military wing of Hamas[3]<\/sup><\/a>.<\/p>\n

This doesn\u2019t mean or proves at all a direct implication of the exchange service in terrorism financing, but it only means that these funds have been exchanged (after a few steps) into cash or other digital currencies by exploiting Binance.<\/p>\n

The transactions of these campaigns, usually, before reaching Binance bitcoin address, made a donation to other bitcoin addresses. These bitcoin addresses may belong either to other exchange services working as middlemen between the crowdfunding campaign and Binance or could belong to a mixing service (to disguise the sender and the receiver)[4]<\/sup><\/a>, to launder and hide the bitcoin donated before being cashed through Binance, or could also belong to private parties involved in this pattern.<\/p>\n

Below, a description of each campaign and of some of the most significant transactions analyzed.<\/p>\n

Al-Sadaqah Donation Campaign (\u2026 <\/strong>Nwpf<\/a>, <\/strong>\u2026qLez<\/a>)<\/strong><\/p>\n

Since November 2017\u00a0al-Sadaqah\u00a0(the charity) organization, began a still ongoing fundraising campaign on Telegram, other social media such as Twitter, and on the deep web[5]<\/sup><\/a>\u00a0to raise bitcoin from Western supporters. The explicit intent of the call for bitcoin is to finance the\u00a0mujahideen\u00a0fighting against the Assad regime in northeastern Syria[6]<\/sup><\/a>. Nowadays, the organization\u2019s Twitter page has been shut down, but its English and French Telegram accounts are still online.<\/p>\n

The campaign seems not to be very popular. The BTC address advertised on al-Sadaqah, \u201c\u2026 Nwpf<\/a>\u201d, shows that from November 2017 until its last donation on October 28, 2018, has received an amount equivalent to more or less $1,000 and processed 8 transactions (4 inputs and 4 outputs). Although most of the transfers were only worth a few dollars, one Bitcoin wallet from which a transaction was made to the wallet of Al-Sadaqa stood out \u202685oC<\/a>, which has totally received the equivalent of more or less $7millions.[7]<\/sup><\/a> This Bitcoin wallet was associated with the kidnapping of a child in South Africa in May 2018 and many frauds.[8]<\/sup><\/a><\/p>\n

The wallet linked to the jihadist donation campaign[9]<\/sup><\/a> includes also another address \u201c\u2026qLez<\/a>\u201d (total received roughly $150).<\/p>\n

Going backward from the only one donation received by this address, it appears that small amount of bitcoin (a few hundred dollars) has been transferred from one bitcoin address to another and all of them have only one input and one output. The interesting data is that the more we go back to the source of the only donation made to \u2026qLez<\/a>, the more we encounter an increasing number of wealthy bitcoin addresses (as FkdG<\/a>), worth the equivalent of thousands of hundred dollars.<\/p>\n

Given that these addresses belong to e-wallets with only one bitcoin address[10]<\/sup><\/a>, they\u2019re likely to belong to private wealthy donors rather than to any crypto-exchange or trading platform.<\/p>\n

About the outputs of al-Sadaqa BTC addressees, the amount of bitcoin that their call for donations raised has been donated in full and, 4 out of these 5 outputs, as to \u201c\u2026nbQ<\/a>\u201d – “\u2026WFDD8<\/a>” – \u201c\u2026Xt6D<\/a>\u201d, carry out the same method to send their bitcoin to Binance wallet address:<\/p>\n