OFAC Sanctions 134 ISKP Cryptocurrency Addresses Tied to USD 2 Million in Terrorist Financing

Key takeaways

• On July 1, 2026, OFAC updated its Specially Designated National listing for ISKP with 134 cryptocurrency addresses that have moved over USD 2 million.
• ISKP has relied heavily on USDT for years, with transactions ranging from roughly USD 10 to 15,000, while also soliciting Monero donations publicly through its Voice of Khurasan magazine since late 2023.
• TRM has tracked ISKP's cryptocurrency financing since 2022, including funds tied to the March 2024 Moscow theater attack that killed over 125 people, where TRM identified the flow of funds to an ISKP-controlled wallet within hours.
• Disruptions including the 2025 capture of Ozgur Altun near the Afghanistan-Pakistan border have removed key financiers and media operators, though ISKP's fundraising infrastructure has continued to decentralize across multiple subgroups in response.
• The July 1 designation is the second time OFAC has specifically targeted ISKP's use of cryptocurrency, following the July 2023 designation of Ali Shafiu and a TRON address linked to ISIS-K's media operations.

{{horizontal-line}}

On July 1, 2026, OFAC updated its Specially Designated National (SDN) listing for the Islamic State Khorasan Province (ISKP) with134 cryptocurrency addresses which have moved over USD 2 million. 

This is not the first time OFAC has targeted ISKP’s use of cryptocurrency. In July 2023, OFAC designated a Maldivian national called Ali Shafiu, along with a TRON blockchain address he controlled. Shafiu served in ISIS-K's media office and was selected as the Maldivian representative to ISIS-K leadership in Afghanistan, and the sanctioned crypto address showed on-chain links to other ISIS-K/ISIS media-unit wallets.

Background

Islamic State Khorasan Province (ISKP), ISIS's Afghanistan-based affiliate has emerged as the key transnational node in ISIS's cryptocurrency financing network. Since at least 2022, TRM has identified how the group and its supporters raise and move funds on-chain, including to finance the 2024 attack in Moscow. At the center of the cryptocurrency operations is al-Azaim Foundation for Media (AFM), ISKP's propaganda arm, which publishes the Voice of Khurasan (VoK) magazine in multiple languages to reach a global supporter base. 

A shift toward privacy coins 

In the fall of 2023, ISKP began to publicly solicit donations in Monero, and continues to this day through its VoK magazine. TRM data however continued to point to their reliance on USDT with thousands of thousands transactions ranging from roughly USD 10 to USD 15,000.

Attacks and foiled plots

ISKP has used cryptocurrency to finance attacks, most notably In March 2024, when four Tajik nationals attacked a theater in the Russian capital, killing over 125 people. Within hours of the attacks, TRM identified funds moving from the wallet that financed the attackers, to a wallet known to be controlled by ISKP. 

In June 2024, German authorities announced the arrest of an individual with German, Polish and Moroccan citizenship at the Cologne/Bonn airport related, in part, to his “transfer of nearly USD 1,700  in cryptocurrency to an address linked to the Islamic State Khorasan Province (ISKP). The individual, according to reports, applied for a position at the European Football Championship (held in Germany in June/July 2024). Over the last few months, ISKP has been encouraging its supporters to target sporting events including major soccer/football matches.  

Disruptions

In May/June 2025,  a joint operation by Pakistani and Turkish authorities captured Ozgur Altun (aka Abu Yasir al-Turki) near the Afghanistan-Pakistan border. Altun was the key individual behind ISKP media and cryptocurrency operations.  Reporting indicated he was in possession of a significant amount of cryptocurrency at the time of his capture, and his wife, Ayse Altun, was  accused of using crypto to facilitate financing for ISIS families in places like Syria. In the wake of the arrest, ISKP supporters circulated fresh operational-security guidance online — yet the group's fundraising infrastructure proved resilient, with growing evidence of it being decentralized across multiple ISKP subgroups. 

Prior to that a key disruption occurred in 2023, when TRM data led to the arrest of a key ISKP financier in Istanbul, Turkey. 

Conclusion

TRM has been tracking ISKP for years as one of the most sophisticated terrorist organizations when it comes to the use of cryptocurrency. The July 1 designation reflects the scale that this financing network has reached since 2022. The 134 addresses and the USD 2 million in flows represent years of on-chain activity spanning USDT transfers ranging from roughly USD 10 to USD 15,000, the shift toward Monero solicited publicly through Voice of Khurasan, and the financing tied to attacks including the Moscow theater assault in 2024.

Each disruption to date, from the Istanbul arrest in 2023 to the capture of Ozgur Altun near the Afghanistan-Pakistan border in 2025, has removed a key financier or media operator without eliminating the broader network, and TRM data continues to show that ISKP's fundraising infrastructure has decentralized further across multiple subgroups in response. 

The German arrest tied to a plot against the 2024 European Championship, and the rapid tracing of funds from the Moscow attackers to a wallet controlled by ISKP, both demonstrate how blockchain data has allowed investigators to move at the same speed as the network itself.

The July 1 action adds substantially to the body of on-chain evidence documenting how ISKP raises, moves, and conceals funds across currencies and platforms, and it reinforces a pattern that TRM's intelligence team has tracked since first identifying the group's cryptocurrency donations in Afghanistan in 2022. As ISKP continues to adapt its financing methods, the transparency of the blockchain remains one of the most consistent tools available to disrupt it.

{{horizontal-line}}

Frequently asked questions (FAQs)

1. What did OFAC announce on July 1, 2026?

OFAC updated its Specially Designated National listing for ISKP to include 134 cryptocurrency addresses that have collectively moved over USD 2 million.

2. What role does al-Azaim Foundation for Media play in ISKP's cryptocurrency operations?

Al-Azaim Foundation for Media is ISKP's propaganda arm and publishes Voice of Khurasan, a magazine in multiple languages that reaches a global supporter base and has been used to solicit cryptocurrency donations, including Monero since the fall of 2023.

3. Has ISKP used cryptocurrency to finance actual attacks?

Yes. TRM identified funds moving from the wallet that financed the four Tajik nationals who attacked a theater in Moscow in March 2024, killing over 125 people, to a wallet controlled by ISKP, within hours of the attack.

4. What was the connection between ISKP and the 2024 European Football Championship?

In June 2024, German authorities arrested an individual who had transferred nearly USD 1,700 in cryptocurrency to an ISKP-linked address. The individual had applied for a position at the tournament, held in Germany that summer, during a period when ISKP was encouraging supporters to target sporting events.

5. What happened with Ozgur Altun?

In May or June 2025, a joint Pakistani and Turkish operation captured Ozgur Altun, also known as Abu Yasir al-Turki, near the Afghanistan-Pakistan border. Altun was the key individual behind ISKP's media and cryptocurrency operations, and reporting indicated he had a significant amount of cryptocurrency at the time of his capture. His wife, Ayse Altun, was accused of using crypto to finance ISIS families in locations including Syria.

6. Has this been the only OFAC action against ISKP's cryptocurrency use?

No. In July 2023, OFAC designated Maldivian national Ali Shafiu along with a crypto address he controlled. Shafiu served in ISIS-K's media office and the sanctioned address showed on-chain links to other ISIS-K and ISIS media-unit wallets.