CommandEleven Intelligence
X YouTube
Contact Us

The Money: How Terrorist and Criminal Finance Share the Same Rails – Part II

The Money, Part II of Transcontinental Convergence: terrorist and criminal finance share the same rails

CommandEleven Intelligence Desk · Transnational Threats Desk, status as of November 12, 2026

Bottom Line Up Front

Terrorist groups and criminal organizations use the same financial plumbing, and governments have documented it in sanctions, indictments and advisories. What the public record does not show is a financial partnership between a specific terrorist group and a specific criminal syndicate. In every case we could document, the overlap is shared infrastructure: hawala operators and exchange houses, dollar stablecoins on a cheap blockchain, underground banking, and networks of shell companies. The one true merger is legal, not operational. Washington now designates several Mexican cartels and Brazil’s Primeiro Comando da Capital (PCC) as terrorist organizations, so sanctions law treats their money as terrorism finance. This is Part II of our Transcontinental Convergence series.

Key Judgments

  • CONFIRMED: On June 22, 2026 the U.S. Treasury sanctioned Islamic State (ISIS) financiers in Syria, Türkiye and Nigeria. Treasury says one of them, Spider, began as a hawala in Syria and was used to move money out of ISIS-held territory, and that a Syria-based money service business, Bitcoin Xchange, moved money for ISIS associates in several countries.
  • CONFIRMED: On July 1, 2026 the Treasury added 134 cryptocurrency addresses (131 on Tron, 3 on Monero) to its sanctions entry for ISKPhorasan (ISKP), and Tether froze the 131 Tron balances. The $1.4 million received and $880,000 sent since 2023 are blockchain-analytics figures from Chainalysis and are REPORTED.
  • CONFIRMED: The Treasury’s Financial Crimes Enforcement Network (FinCEN) said on August 28, 2025 that Chinese money laundering networks launder Mexican cartel drug proceeds in the United States. It counted about $312 billion in suspicious transactions from 2020 through 2024. Those are flagged reports, not proven laundering, and FinCEN does not tie the networks to terrorist groups.
  • CONFIRMED: On October 14, 2025 the U.S. sanctioned 146 targets in Cambodia’s Prince Group, which runs at least ten scam compounds, and cut Huione Group off from the U.S. financial system. Treasury says Huione laundered at least $4 billion between August 2021 and January 2025, including North Korean cyber-heist proceeds. No terrorist group appears in the release.
  • CONFIRMED: The UK National Crime Agency (NCA) found that a Russian-linked laundering network helped organized crime groups, including the Kinahan cartel, turn drug cash into cryptocurrency. The Treasury sanctioned the network on December 3, 2024. We found no public source connecting the Kinahan group to Southeast Asian scam compounds.
  • ASSESSED: The money overlap is parallel use of the same rails, not coordination. The rails are cheap, fast and lightly supervised, so any network that needs to move value will find them.
  • DATA DEFICIT: We looked for public sources on five links that circulate in commentary and found none (see “Links We Could Not Source” below). They are not part of this analysis.

Sourcing and Analytical Confidence

We grade every claim on one scale. Sanctions designations, indictments and agency advisories are official allegations and are reported as such. Blockchain-analytics figures come from private firms and are labeled. “(Unconfirmed)” is an inline hold tag only.

TierMeaning
CONFIRMEDDocumented by an official source, a primary document or multiple independent credible sources
REPORTEDCredible outlet or analyst, not independently verified by us
ASSESSEDOur judgment from the confirmed and reported record
DATA DEFICITWe looked and the public record does not answer the question

Three Kinds of Overlap

“Convergence” can mean three different things in finance, and they carry different policy meanings. Shared infrastructure is when different actors use the same hawala dealers, exchange houses, stablecoins or shell companies without dealing with each other. A shared service provider is when one professional launderer serves both a criminal client and a terrorist or state client. A shared legal label is when the law puts criminals and terrorists in the same category. The record documents the first and third well, the second thinly, and no case in which a terrorist group and a criminal syndicate moved money to or for each other.

Three kinds of financial overlap (shared infrastructure, shared service provider, shared legal label), each tiered

Hawala and Exchange Houses: The Oldest Rail

Hawala is an informal system in which a dealer in one place pays out against a matching credit held by a dealer elsewhere, so money moves without crossing a border. It is legal in many countries and heavily used for remittances. The Treasury’s June 22, 2026 action shows how that rail appears in terrorism finance. It named Spider, a Türkiye-based business that “originated as a hawala in Syria” and was used to move money from ISIS-held areas to areas it did not control. It also named a Syria-based money service business, Bitcoin Xchange, and three Nigerian bureaux de change tied to an ISIS West Africa financial facilitator. The release says ISIS has become more decentralized and that Treasury will pursue its finances “regardless of the financial instrument, method of transmission, or location.” (Treasury, June 22, 2026)

Hezbollah’s network follows the same pattern with a different instrument. On August 20, 2026 the Treasury sanctioned ten individuals in Lebanon, Türkiye, the UAE and Iran who allegedly moved cash for Hezbollah on commercial flights and through Turkish exchange houses and front companies, outside the formal banking system. Treasury put the flow at up to hundreds of millions of dollars and tied the network to the IRGC Qods Force. That is an official allegation; no transaction-level data is public. (AML Watcher, August 24, 2026)

Neither action describes a criminal syndicate as a partner. What both show is that a terrorist financier and a criminal launderer can use the same type of intermediary, a licensed or semi-licensed exchange business, because it is the most available way to move cash across borders.

Stablecoins and Wallets: The New Rail

The July 1, 2026 action against ISKP is the clearest recent crypto case. The Treasury added 131 Tron and 3 Monero addresses to the ISKP sanctions entry. ISKP’s media arm, the al-Azaim Foundation, had used its “Voice of Khorasan” publication to solicit crypto donations, which is the link between the wallets and the group. Chainalysis reported that the Tron addresses received more than $1.4 million and sent more than $880,000 since 2023, and Scorechain’s review notes some exposure to Syria-based exchangers. Tether froze the 131 Tron balances. (Scorechain; Cointelegraph)

The scale matters. These are small sums by organized crime standards, and the issuer was able to freeze the Tron balances. In our assessment, crypto is one rail among several for terrorist fundraising, and the recent public record shows it as a modest and traceable one, not a replacement for cash and hawala.

Crime’s Rails: Chinese Underground Banking and the Cartels

FinCEN’s August 2025 advisory describes a service, not a partnership. Chinese money laundering networks buy Mexican cartels’ U.S. dollars and resell them to Chinese citizens who want to get money out of China past the country’s currency controls, which lets the cartels turn bulk dollars into usable funds. The advisory counts about $312 billion in suspicious transactions across 137,153 Bank Secrecy Act reports from January 2020 through December 2024. Suspicious means flagged, and the figure includes activity that may be unrelated. The advisory notes that several of the cartels involved are designated Foreign Terrorist Organizations and does not allege that the networks finance terrorism. (FinCEN, August 28, 2025)

Scam Compounds: Industrial Fraud, Not Terror Finance

Southeast Asian scam compounds are the largest criminal money story in this series, and the record ties them to criminal and state actors, not to terrorist groups. The October 14, 2025 action named Prince Group, led by Chen Zhi, as a transnational criminal organization with at least ten scam compounds in Cambodia and more than 100 shell and holding companies. A U.S. indictment of Chen Zhi was unsealed in the Eastern District of New York. FinCEN used its Section 311 authority to cut Huione Group off from the U.S. financial system, and Treasury says Huione laundered at least $4 billion, including proceeds from North Korean cyber heists. That makes a state actor, North Korea, a client of the laundering infrastructure, and it is the only sovereign link in the release. (Treasury, October 14, 2025)

Earlier drafts of this series named KK Park in Myanmar and tied the compounds to European crime groups. The Treasury release names neither, and we did not find a source we could defend for either claim, so we left them out.

The Treasury sanctioned the Kinahan organized crime group in 2022 (Treasury). On December 3, 2024 it sanctioned five individuals and four entities in a Russian-linked network, after an investigation by the UK National Crime Agency. According to the NCA, the Smart Group and TGR Group laundering operations helped organized crime groups, including the Kinahan cartel and UK drug gangs, convert drug cash into cryptocurrency so it could be reinvested without moving physical cash. The NCA reported 84 arrests and more than £20 million seized. A Treasury official said the network also served Russian elites and “the Kremlin”; that is a REPORTED characterization of purpose, not a court finding. (TRM Labs)

This is a shared-service-provider case: one network serving both a criminal group and Russian state interests. It is not a case of the Kinahan group working with a terrorist group, and the public record does not connect it to the Southeast Asian compounds.

Update, November 12, 2026: Daniel Kinahan was arrested in Dubai on April 15, 2026, extradited to Ireland on August 9 and charged with directing a criminal organization. He has not been convicted. The assessment above is unchanged. (OCCRP)

Convergence is clearest in the law. Several Mexican cartels are designated Foreign Terrorist Organizations, and the State Department designated the PCC in May 2026. On July 1, 2026 the Treasury used its terrorism authority, Executive Order 13224, to sanction a São Paulo network accused of laundering more than $30 million of PCC drug proceeds through U.S. banks and back to Brazil using crypto. (King & Spalding)

The practical effect, in our assessment, is that banks, exchanges and stablecoin issuers face drug and fraud proceeds under the terrorism-finance regime and the compliance obligations and penalties that come with it. That changes the compliance picture and the charges available. It does not show that the PCC or any cartel works with an Islamic State affiliate.

Two Actions on One Day, Not One Network

The Treasury announced the ISKP wallets and the PCC network on the same day, and some headlines paired them as an “ISKP and cartel” action. The sources we reviewed state no operational or financial tie between the two. They are separate cases handled in one announcement, and treating them as one network would be exactly the unsourced link this series avoids.

Documented money links, with tier and primary source for each (Treasury, FinCEN, NCA)

These claims circulate widely, including in earlier drafts of this series. We looked for a public source for each and are not carrying any of them.

ClaimWhat we foundTier
The ’Ndrangheta brokers Captagon from the Levant into EuropeThe July 2020 Salerno seizure of 84 million pills was presented by Italian financial police as ISIS-made, and they named the Camorra, not the ’Ndrangheta, as the group that brought it into Italy. Other outlets later reported links to Hezbollah and the Syrian government, so even the attribution moved. (CNN)DATA DEFICIT
Baloch insurgents finance themselves through a smuggling taxThe West Point CTC Sentinel analysis of the Baloch insurgency we reviewed has no financing section, and we found no other source we could defend.DATA DEFICIT
The Kinahan group clears crypto stolen by Southeast Asian scam compoundsThe documented link runs to a Russian laundering network. The Prince Group release names neither the Kinahan group nor KK Park.DATA DEFICIT
Cartel profits are cleared through Southeast Asian casino and junket corridorsFinCEN describes currency-control evasion by Chinese buyers of cartel dollars, not casino corridors.DATA DEFICIT
The TTP moves money through hawalaA UN Monitoring Team report says the Afghan Taliban give the TTP financial support, including about $43,000 a month to the family of leader Noor Wali Mehsud (Dawn), which is REPORTED. We found no public source on hawala use.DATA DEFICIT (hawala); REPORTED (Taliban support)

What To Watch

  • Further Treasury actions naming exchange houses, money service businesses or hawala operators for ISIS or Hezbollah facilitators.
  • More stablecoin addresses added to terrorist sanctions entries, and how fast issuers freeze them.
  • Any indictment or court filing that places a terrorist group and a criminal syndicate in the same transaction.
  • Whether the terrorism designations of cartels and the PCC produce prosecutions that treat drug proceeds as support for a terrorist organization.
  • Whether any government or UN source ties a Southeast Asian scam compound to a designated terrorist group.

What Would Change Our Assessment

  • A government, UN or court document showing a direct payment, loan or settlement between a designated terrorist group and a criminal organization.
  • A prosecution showing that a launderer knowingly served a terrorist client and a criminal client in the same transaction chain.
  • A credible source documenting any of the five unsourced links above, which we would add with a tier.

Calls We Will Score

  1. By February 28, 2027: The U.S. Treasury will announce at least one further sanctions action that names exchange houses, money service businesses or hawala operators serving the Islamic State or Hezbollah.
  2. By March 31, 2027: The Treasury will add further stablecoin addresses to the sanctions entry of at least one terrorist group.
  3. By June 30, 2027: No government, UN or court document will publicly tie a Southeast Asian scam-compound operator to a designated terrorist group.

We score each call on its due date and publish the result, hit or miss, on the Foresight Record.

What This Assessment Does and Doesn’t Establish

  • Does establish: that sanctions and enforcement actions document terrorist and criminal financiers using the same types of intermediaries (hawala and exchange houses, stablecoins, underground banking, shell companies), and that U.S. law now treats cartel and PCC money as terrorism finance.
  • Does not establish: that any terrorist group and any criminal syndicate coordinate or trade with each other, that crypto has replaced cash and hawala for terrorist groups, that the $312 billion in suspicious activity is proven laundering, or that any scam compound funds terrorism. Sanctions findings are official allegations. Analytics figures come from private firms. Nothing here describes methods for moving or hiding money.

Frequently Asked Questions

Do terrorist groups and cartels move money together?

The public record shows them using the same types of intermediaries, such as exchange houses, hawala dealers, stablecoins and professional launderers. It does not show a specific terrorist group and a specific cartel moving money to or for each other.

Is crypto the main way terrorist groups raise money?

Not on the evidence we reviewed. The recent ISKP case involved about $1.4 million received since 2023, according to Chainalysis, and Tether froze the balances. The June 2026 ISIS action centered on hawala and exchange businesses.

Why does it matter that cartels and the PCC are designated terrorist organizations?

It brings their finances under terrorism sanctions and compliance rules, even without any operational link to a jihadist group.

What is Part III about?

Part III, The Corridors, looks at the smuggling and supply routes that connect the Sahel, the Middle East and South Asia, who controls them and who pays, with each link tiered.

Sources

Picture of CommandEleven Intelligence Desk

CommandEleven Intelligence Desk

CommandEleven Intelligence is a private intelligence agency delivering Intelligence as a Service: sourced collection, graded judgments and forecasts for decision-makers. Our analysts work from a human-sourced network across South Asia, the Middle East and North Africa, and Central Asia. Every judgment is graded Confirmed, Assessed or Speculative. Founded in 2015, we publish openly on terrorism, regional conflict and geopolitical risk, and we protect sources and methods under a written scope agreed with each client.

Related dossiers