OFAC Targets ISIS Crypto Financing Network, Including Bitcoin Xchange

Key takeaways

• OFAC designated three individuals and six entities today for facilitating ISIS financial flows, including Bitcoin Xchange — a Syria-based money service business TRM has been tracking since early 2022 as a core off-ramp for ISIS-linked cryptocurrency fundraising campaigns. Addresses attributed to Bitcoin Xchange by TRM, have a total (incoming and outgoing) volume of around USD 10 million with hundreds of transactions with ISIS-linked fundraising campaigns.
• Syria-based crypto exchangers and hawala operators have long served as integral part of ISIS fundraising campaigns. They serve as the pooling and conversion layer for ISIS donation campaigns targeting members, detainees, and families held in camps like al-Hol and Roj — converting donated crypto to cash for a fee.
• Notably, TRM previously identified another Syria-based exchange likely linked to Bitcoin Xchange that operates out of Idlib, with potential connections to Turkey-based operatives.
• OFAC’s designation also included an individual named, Abdurrahmane Miloud, with two TRX addresses linked to him published in the designation, one of which has exposure to ISIS-linked fundraising campaigns tracked by TRM. 

Today, US Treasury’s OFAC designated three individuals and six entities across Europe, the Middle East, and West Africa for facilitating ISIS financial flows. Among those designated: Abdelhakim Boukich, a former Dutch national operating from Syria, and Bitcoin Xchange, the Syria-based money service business he controls and directs. TRM has been tracking Bitcoin Xchange and the broader ecosystem of Idlib-area crypto exchangers since early 2022.

Bitcoin Xchange is not an isolated actor. It is part of a layered financial infrastructure that ISIS-linked networks have relied on to sustain fundraising campaigns for members, detainees, and families — most of them held [until recently] in displacement camps like al-Hol and Roj in northeast Syria. The model is straightforward: donors send cryptocurrency, often through Telegram-based campaigns that circulate across ISIS-affiliated channels and supporters. Syria-based exchangers and hawala operators receive those funds, convert them to cash, and deliver them into the camp ecosystem, typically for a fee of 2 to 5 percent. 

What makes these networks analytically distinctive is the donation address pattern. When TRM analysts see the same address appearing across multiple ostensibly unrelated campaigns — different stated beneficiaries, different posting accounts, different campaign narratives — that address is almost certainly controlled by a local exchanger or hawaladar, not by any single campaign organizer. The exchanger provides the infrastructure. The campaigns are the distribution layer on top of it.

TRM began tracking this exchange layer in early 2022, when its role in facilitating cryptocurrency use by ISIS-linked campaigns in Syria became apparent through on-chain analysis. Bitcoin Xchange was established in late 2020 by Boukich and his Syria-based associates, and over time its transaction flows connected donors across Norway, Belgium, the Netherlands, South Africa, and the United States to ISIS associates on the ground. Today's OFAC action confirms what the blockchain data has shown: these Syria-based MSBs are the connective tissue of ISIS crypto finance — the point where decentralized online fundraising becomes operational cash in a displacement camp.

Today's action also extends beyond Syria. OFAC designated Mukhtar Adamu Muhammad and three Nigeria-based money service businesses — Nine to Nine Exchange Bureau de Change, Manhattan Bureau de Change, and Generation Currency Bureau de Change — for facilitating financial transfers on behalf of ISIS in West Africa. TRM has identified multiple ISIS-linked fundraising campaigns out of Nigeria, some of which relied on money service businesses. This reflects the same structural dynamic that Treasury's 2026 National Terrorist Financing Risk Assessment describes: sustained counterterrorism pressure has pushed ISIS toward decentralized affiliates, and financial facilitators provide the connectivity between those nodes, increasingly through cryptocurrency.  

The designation of Miloud Abderrahmane, based in France, adds another dimension. Abderrahmane conducted transactions with ISIS-affiliated individuals in Syria and provided instructional and manufacturing information on explosives to ISIS supporters — a reminder that financial facilitation and operational support frequently overlap in these networks.

These networks of exchanges leave traces in the blockchain data — in the addresses they reuse, in the clustering of wallets, in the transaction patterns that persist across campaign cycles. Today's OFAC action is the result of years of patient on-chain analysis, and it demonstrates what blockchain intelligence makes possible: following the money even when it moves through informal hawala channels, Syria-based MSBs, and distributed crypto campaigns operating across multiple jurisdictions simultaneously.

Frequently asked questions (FAQs)

1. What is Bitcoin Xchange and why was it designated today?
Bitcoin Xchange is a Syria-based money service business established in late 2020 by Abdelhakim Boukich, a former Dutch national operating from Syria. OFAC designated it today for transferring money on behalf of ISIS associates originating from multiple countries, including Norway, Belgium, the Netherlands, South Africa, and the United States. Boukich controls and directs the operation, and the business has functioned as a core financial node connecting ISIS-linked donors abroad to operatives and networks on the ground in Syria.

2. How do Syria-based crypto exchangers fit into the broader ISIS fundraising ecosystem?
They serve as the off-ramp and pooling layer for ISIS-linked donation campaigns targeting members, detainees, and families held in displacement camps like al-Hol and Roj in northeast Syria. Donors send cryptocurrency through Telegram-based campaigns circulating across ISIS-affiliated channels. Syria-based exchangers and hawala operators receive those funds, convert them to cash, and deliver them into the camp ecosystem — charging a fee of between 3 and 5 percent for the service.

3. What is TRM's analytic methodology for identifying exchanger-controlled donation addresses?
The strongest signal is address reuse across unrelated campaigns. When the same donation address appears across multiple campaigns with different stated beneficiaries, different posting accounts, and different campaign narratives, that address is almost certainly controlled by a local exchanger or hawaladar rather than any individual campaign organizer. The exchanger provides the underlying financial infrastructure; the individual campaigns are the distribution layer on top of it.

4. What do today's Nigeria-based designations signal about the evolution of ISIS's financial networks?
They confirm the structural shift that Treasury's 2026 National Terrorist Financing Risk Assessment describes: sustained counterterrorism pressure has pushed ISIS toward increasingly decentralized affiliates, with financial facilitators providing the critical connectivity between those nodes and ISIS's General Directorate of Provinces. The designation of Mukhtar Adamu Muhammad and three Nigeria-based money service businesses reflects ISIS in West Africa's growing reliance on local MSB networks to move funds across the region.

5. What compliance obligations do financial institutions have following today's OFAC action?
All property and interests in property of the designated individuals and entities that are in the United States or in the possession or control of US persons must be blocked and reported to OFAC. Transactions involving designated persons are prohibited unless authorized or exempt. Financial institutions also face potential secondary sanctions exposure for knowingly conducting or facilitating significant transactions on behalf of designated persons, including the risk that OFAC could prohibit or impose strict conditions on their US correspondent banking relationships.