How Terrorist Networks Deploy AI to Evade Cryptocurrency Finance Detection
Research by Daria Alexe reveals how the Islamic State-Khorasan Province and Hamas use autonomous AI agents to fragment cryptocurrency donations into undetectable micro-transactions
A new study by Daria Alexe at the Global Network on Extremism and Technology (GNET) reveals that the Islamic State-Khorasan Province (ISKP) and Hamas-affiliated fundraising networks have deployed artificial intelligence to automate cryptocurrency laundering through “agentic smurfing”—fragmenting large donations into thousands of sub-threshold micro-transactions routed across multiple blockchains.
Alexe’s analysis demonstrates how this approach exploits fundamental vulnerabilities in Anti-Money Laundering (AML) systems designed to detect large transfers but remain blind to distributed, high-frequency nano-transactions. ISKP’s estimated monthly cryptocurrency revenues of $25,000 to $100,000 have funded multiple operations across Russia, Iran, Turkey, and Western Europe, whilst Hamas-linked networks continue soliciting donations despite publicly announcing a cessation of crypto fundraising in April 2023.
How Agentic Smurfing Works
Alexe outlines four operational phases enabling terrorist organizations to evade detection. AI agents generate disposable “burner wallets” used for single transactions before abandonment, defeating address-based blacklisting. Machine learning algorithms optimise transaction timing and routing to blend micro-transfers within legitimate blockchain activity—ISKP notably exploited TRON’s high-volume network to execute transfers during peak trading hours.
Funds are deliberately fragmented into $50 to $500 transfers, remaining below regulatory thresholds like the FATF Travel Rule ($1,000) and FinCEN reporting requirements ($10,000). A $100,000 donation can thus be split into 2,000 separate transfers across multiple days and wallets. Cross-chain atomic swaps enable instantaneous peer-to-peer cryptocurrency exchanges across blockchains without intermediary oversight, with Elliptic documenting $21.8 billion in cross-chain laundered funds in 2025—a fivefold increase from 2022.
Alexe traces ISKP’s cryptocurrency infrastructure to its propaganda apparatus, which increasingly shares cryptocurrency best practices including guidance on bypassing Know Your Customer controls. TRM identified hundreds of ISKP-linked transactions ranging from $100 to $15,000, with TRON accounting for 58% of identified illicit crypto volume in 2025. Critically, ISKP exploits kinship networks amongst Central Asian migrants, leveraging family trust bonds to fundraise—making donor identification extraordinarily difficult for investigators.
Hamas-affiliated networks demonstrate parallel adaptation. Despite U.S. and UK sanctions following the October 2023 attack, the organisation GazaNow continued receiving tens of thousands in crypto donations. Alexe documents these networks adopting “bridge-hopping”—rapidly transferring funds between Ethereum, TRON, and Binance Smart Chain—creating forensic complexity that overwhelms traditional tracking.
The Detection Gap
Alexe identifies structural misalignment in counter-terrorism finance frameworks. Current systems rely on value thresholds that assume serious threats involve large sums, yet the March 2024 Moscow Crocus City Hall attack—funded with only approximately $2,000 in cryptocurrency—demonstrates terrorists can accomplish high-impact operations with fragmented micro-donations. Chainalysis 2026 data shows illicit cryptocurrency addresses received 154 billion USD in 2025, a 162% increase over 2024.
Proposed Solutions
Alexe proposes three integrated countermeasures. First, AI-driven micro-transaction clustering using behavioural pattern recognition to identify “micro-transaction storms”—anomalous spikes in coordinated sub-threshold transfers. Second, real-time multi-chain coordination through public-private intelligence-sharing frameworks. Alexe cites the T3 Financial Crime Unit—a TRON-Tether-TRM Labs partnership that froze over $300 million in illicit proceeds by late 2025—as a scalable model. Third, sandboxed AI analysis incorporating cryptographic intent-verification layers to prevent autonomous agents from being repurposed for terrorist financing.