Amid Turmoil in Syria, ISIS Members and Families Escape Detention Centers That Have Long Driven Crypto Fundraising Efforts

Key takeaways:

• ISIS fundraising campaigns adapt quickly — ISIS supporters mobilize to exploit the situation on the ground, launching or reviving donation campaigns aimed at sustaining detainees, enabling escapes, and reinforcing ideological ties — including on-chain fundraising.
• Crypto remains a core payment rail — While cash and hawala systems remain prominent, cryptocurrency, particularly Tether (USDT),  is frequently solicited. Campaigns offer donors operational security advice and use privacy-enhancing tools to avoid detection.
• Terror financing risk is tangible — funds from campaigns like these have supported terror operations, including a deadly attack in Moscow in 2024. Donors linked to these efforts have been convicted or charged in multiple countries, including the US and Sweden.
• Blockchain intelligence enables disruptions –—Authorities across several jurisdictions have used blockchain intelligence to arrest and prosecute individuals tied to ISIS financing. TRM is tracking dozens of active campaigns and continues to support counterterrorism efforts globally.

‍

{{horizontal-line}}

‍

On January 19, 2026, dozens of Islamic State (ISIS) fighters, along with women and children, reportedly escaped from detention centers and displacement camps as the Syrian Democratic Forces (SDF) withdrew in the face of Syrian government advances. The camps have been a focus of fundraising financing campaigns, some of which are linked to arrests for terrorist financing, including multiple within the United States. 

The SDF had controlled displaced persons camps and prisons in northeast Syria since ISIS lost its last swath of territory in 2019 – Syrian government forces now control these facilities, and the future of the SDF is uncertain. According to US officials, approximately 200 escaped, although the Syrian government has allegedly recaptured most of them. Releasing these prisoners has long been a priority for ISIS and its supporters, and a major cause driving donations – including crypto, with supporters online urging each other to take advantage of the security changes on the ground. 

These developments have renewed attention on the fate of the thousands of ISIS fighters and family members in these detention camps and prisons, and the fundraising campaigns that both sustain detainees and can enable their escape. 

The fundraising campaigns

Fundraising campaigns for ISIS members and families are primarily organized on encrypted messaging and social media platforms. They are operated by ISIS supporters or the detainees themselves, often drawing initial attention by stating their purpose as improving the living conditions of the detainees and their families. The administrators also claim money raised will facilitate prisoner’s escape, and use the cause to generate sympathy for ISIS more broadly. While cash and money service businesses remain central, cryptocurrency is increasingly solicited and used as a key method for receiving funds.

While the US government has begun relocating hundreds of ISIS male prisoners from Syria to Iraq, the future of the tens of thousands, primarily women and children, still held in the Syrian camps remains unknown. As such, the fundraising campaigns are likely to continue using the cause of ISIS prisoners and their families in Syrian camps to solicit donations.

The role of cryptocurrency

Fundraising campaigns for ISIS members and families held in northeast Syrian displacement camps and prisons have become a persistent driver of cryptocurrency adoption among ISIS supporters globally. Donations typically flow to nearby local exchanges and hawala brokers, who convert crypto into cash that can be delivered directly to the detainees. Most cryptocurrencies can be sent as donations, although Tether (USDT) remains the preference for most involved.  

Organizers solicit donations globally, with campaigns in multiple languages employing varying levels of operational security, including the use of privacy coins and temporary wallet addresses. While most donations are relatively small (ranging from a few dollars in USD to several thousand), the cumulative total can be substantial. Ultimately, the campaigns have become a key channel for ISIS supporters to move funds across borders and maintain networks within the camps. The fundraising campaigns frequently provide donors with blockchain specific operational security tips to avoid detection, improving ISIS supporters' crypto knowledge.

How ISIS uses cryptocurrency donations

These campaigns often present themselves as humanitarian in nature, however there is clear evidence that the funds raised often benefit ISIS as an organization, not just individual detainees or their families. ISIS members use donations as leverage and distribute only to those in the camps who maintain ISIS’s ideology. Funds raised by some campaigns have even been used to carry out terrorist attacks, as was the case in the March 2024 attack on a music hall in Moscow. 

Donations to these campaigns can also be a potential indicator of radicalization. For example, TRM tracked a fundraising campaign linked to an individual who pleaded guilty in July 2025 of plotting an attack on the US elections in Oklahoma – that individual had donated cryptocurrency. In December, 2024, an individual from Virginia was convicted for providing material support to ISIS by directly aiding ISIS fighters and financing the escape of detainees. Similarly, an individual in Sweden who was recently charged with joining ISIS had donated to a separate campaign. 

Repeated donations can also be an indicator of a broader in-country network. For example, over a 12-month period, TRM identified dozens of transfers from a country in Southeast Asia to cryptocurrency addresses linked to multiple campaigns. 

Disruptions and the role of blockchain intelligence

Most of the cryptocurrency-related terrorism arrests of ISIS supporters around the world have been directly linked to these campaigns. This includes countries such the US, Canada, Spain, Germany, Sweden and Indonesia. Blockchain intelligence has played a critical role in all those disruptions. 

These campaigns have proven that ISIS financiers have embraced the relative anonymity and speed of cryptocurrency fundraising. TRM is tracking several dozen terror financing campaigns and is proud to work with governments across the world to identify and disrupt terrorism financing. 

‍

{{horizontal-line}}

Frequently asked questions (FAQs):

1. What triggered the recent ISIS prisoner escapes in Syria?

On January 19, 2026, Syrian Democratic Forces (SDF) reportedly withdrew from parts of northeast Syria as Syrian government forces advanced. This created openings that enabled dozens of ISIS fighters and affiliates to escape from detention camps and prisons.

2. How are these developments connected to terrorist financing?

The camps — long a focus of ISIS-linked donation drives — became central to renewed fundraising efforts following the escapes. Fundraisers claim the funds are for detainee welfare or escape, but TRM analysis shows that some proceeds have supported terror operations or ideological enforcement.

3. What role does cryptocurrency play in these fundraising efforts?

Cryptocurrency, particularly Tether (USDT), is widely used by ISIS supporters to collect donations. Funds are often converted to cash through local exchanges or hawala brokers near the camps. Campaigns use privacy-enhancing techniques to obfuscate flows and avoid detection.

4. Has crypto-based terror financing led to arrests?

Yes. Authorities in the US, Canada, Germany, Spain, Sweden, and Indonesia have made multiple arrests tied to these crypto-driven campaigns. In many cases, blockchain intelligence was central to identifying suspects and disrupting plots.

5. Are there signs of global support networks behind these donations?

Yes. TRM has observed repeated donations over time from the same regions — including one case involving dozens of transactions from Southeast Asia to multiple campaign-linked wallet addresses — suggesting broader networks of radicalization or financial coordination.

6. What does TRM do in response?

TRM is actively tracking dozens of these campaigns and supporting governments worldwide in identifying and disrupting illicit financial activity. We provide the blockchain intelligence and tools needed to counter terrorist financing in real time.