Treasury Sanctions Three Individuals and Six Entities for Routing Crypto to ISIS

The U.S. Treasury’s Office of Foreign Assets Control designated three individuals and six entities on June 22 for facilitating financial transactions on behalf of the Islamic State of Iraq and Syria, targeting a network that used money service businesses and cryptocurrency to move ISIS funds across Europe, the Middle East, and West Africa.

The action covers a Syria-based bitcoin exchange, two Turkish money services firms, three Nigerian currency bureaus, and the individuals who own or operate them. OFAC identified two TRON blockchain addresses linked to a French national designated for conducting transactions with ISIS affiliates and providing explosives-related instructions to ISIS supporters.

Bitcoin Xchange’s Syria-to-Europe Pipeline

Abdelhakim Boukich, a former Dutch national now based in Syria, was designated for establishing and directing Bitcoin Xchange, a Syria-based money service business. According to the Treasury press release, Boukich and Bitcoin Xchange transferred money on behalf of ISIS associates from multiple countries, including Norway, Belgium, the Netherlands, South Africa, and the United States. The SDN listing notes Boukich is also known as “Abu Sulayman Alholandi” and “Muhammad Babili.”

Two Turkish MSBs, Spider Gayrimenkul Ve Genel Ticaret Limited Sirketi and Alkaram Danismanlik Gayrimenkul Ic Ve Dis Genel Ticaret Limited Sirketi, were also designated. Both are owned and controlled by Mohamad Alhmidan, previously designated by OFAC for facilitating logistical and financial support for ISIS and helping foreign terrorist fighters. Spider originated as a hawala operating in Syria, transferring money from ISIS-controlled territory to other regions; Alkaram operates as a front for Spider.

TRON Wallets, French National

Miloud Abderrahmane, a French national, was designated for conducting transactions with ISIS affiliates based in Syria and for providing ISIS supporters with instructional and manufacturing information on building explosives. Blockchain analytics firm Chainalysis published analysis of the TRON wallets linked to Abderrahmane in connection with the designations.

OFAC added two TRON addresses to the SDN list: TBXMiRqUp1XH1zLazWu8cWitMAScv4HsYq and TDFj8tYzfLDkwEMo4MJ2DfrbpMztuCCnan. The TRON designation makes this one of the comparatively rare OFAC actions specifying on-chain addresses at the level of individual wallet identifiers, rather than sanctioning an exchange or custodian.

Nigeria’s ISIS-WA Bureaus

The designations extend to West Africa through Mukhtar Adamu Muhammad, a Nigeria-based financial facilitator for ISIS in West Africa (ISIS-WA). Muhammad owns, controls, or directs three Lagos- and Kano-based bureaus de change: Nine to Nine Exchange Bureau de Change, Manhattan Bureau de Change, and Generation Currency Bureau de Change. All three are now on the SDN list alongside Muhammad.

Treasury’s 2026 National Terrorist Financing Risk Assessment noted that sustained counterterrorism pressure has pushed ISIS toward more decentralized cells and reliance on regional facilitators. The June 22 action reflects that assessment, targeting a geographically distributed network spread across Syria, Turkey, France, and Nigeria.

SDN Consequences

All property and interests in property of the nine designated parties that are in the United States or held by U.S. persons are blocked and must be reported to OFAC. U.S. persons are prohibited from transacting with them. Foreign financial institutions that knowingly facilitate transactions on behalf of designated parties face secondary sanctions risk, including potential loss of access to U.S. correspondent banking.

The action was taken under Executive Order 13224, as amended, the counterterrorism authority under which ISIS was first designated as a Specially Designated Global Terrorist in October 2004.

Earlier this month, OFAC separately targeted Iranian crypto rails, adding Nobitex and three other Tehran-based exchanges to the SDN list under the “Economic Fury” campaign; the June 22 action targets a distinct, geographically distributed ISIS facilitation network spanning Syria, Turkey, France, and Nigeria.