News

Federal prosecutors have moved to permanently seize some 300 cryptocurrency wallets they say U.S.-blacklisted terrorists used to collect millions of dollars their supporters around the world had raked in by fraudulently peddling coronavirus-related medical gear and running other scams.

The U.S. Attorney’s Office in Washington, D.C., which disclosed three civil forfeiture complaints, a criminal complaint, arrest warrants for two suspects and a slew of other court filings Thursday, said the case marks the largest-ever seizure of cryptocurrency from accused terrorists.

Terrorist groups like those targeted by the complaints—the Islamic State group in Iraq and Syria, al-Qassam Brigades, which acts as the military wing of Palestinian militia Hamas, and al-Qaida—previously built their financial networks “in the shadows” and “by word of mouth,” Don Fort, chief of IRS Criminal Investigation, said during a press call.

One of the alleged schemes involved an Islamic State hacker, Murat Cakar, who on Feb. 26, 2020, established FaceMaskCenter.com and four Facebook pages in Turkey to sell N95 respirator masks that he falsely claimed had been approved by the U.S. Food and Drug Administration to prevent the spread of COVID-19.

He offered the products to individuals around the world, including a U.S.-based client seeking to buy the masks and other personal protective equipment, or PPE, for hospitals, nursing homes and fire departments.

Cakar appeared on investigators’ radar in 2017 after receiving a $100,000 transfer from Zoobia Shahnaz, a Pakistani American woman who admitted two years ago to sending more than $150,000 to the Islamic State group through credit cards, bitcoins and shell firms, Patrick Reddan, acting deputy assistant director of the FBI’s counterterrorism unit, said Thursday.

“During an undercover operation, the FBI and our partners made contact with the website operators and were told that high-level PPE was available for sale,” Reddan said during the call. “In reality, there was no PPE and the money made from the site were being used to fund ISIS.”

In a separate scheme, al-Qassam Brigades began using social media accounts to solicit Bitcoin contributions in January 2019.

The Palestinian group first directed supporters to send the digital tokens to a single wallet at a U.S. cryptocurrency exchange that it held under its own name, a Palestinian phone number and an IP address in Gaza, according to a 52-page civil forfeiture complaint.

A month later, al-Qassam Brigades moved the fundraising operation in house by creating 10 interlinked addresses within their group’s IT infrastructure. In the six months that followed, those same addresses received 65 contributions for the equivalent of roughly $13,690 in bitcoins, according to prosecutors.

The group’s cryptocurrency-financing strategy eventually progressed towards a more dynamic system that generated a new, unique Bitcoin for each donation. The new setup, which is still up and running, has led to the collection of around $28,080 in bitcoins through 124 transactions as of last week, according to the complaint.

In addition to the nearly 200 cryptocurrency addresses and crypto-based assets that either accepted or made Bitcoin donations, federal prosecutors also moved to forfeit five accounts held at one financial institution that either paid for web-hosting services on behalf of the group or were connected to the main al-Qassam Brigades email addresses.

The complaints do not outline any lapses in the anti-financial crime controls of the regulated exchanges or other institutions that may have handled some of the digital tokens subject to the forfeitures, a senior Justice Department official told reporters in a subsequent background briefing.

“Those exchanges are cooperating, turning over the funds,” the official said Thursday. “They’re doing their job to follow anti-money laundering rules.”

Unregistered MSBs

A pair of Turkish nationals are the target of a related criminal complaint and arrest warrant for running unlicensed money exchange businesses, and, as part of that business, helping al-Qassam Brigades convert cryptocurrency into government-issued currency.

Mehmet Akti allegedly established a cryptocurrency account at a third-party exchange as early as October 2017 and answered in response to a due-diligence inquiry six months later that he bought and sold digital tokens as well as provided “services related to this activity,” according to a 14-page affidavit.

“Law enforcement determined that at the time of this statement, and at all times relevant to the conduct alleged, Akti was not registered with FinCEN [the U.S. Treasury Department’s Financial Crimes Enforcement Network] as an MSB,” a senior IRS criminal investigator wrote in the affidavit, referring to a money services business.

Akti received thousands of bitcoins and ethereum coins into the wallet from October 2017 to March 2019, as well as nearly $83 million in wire transfers from a bank account in Turkey held by a legal entity, Deniz Royal Dis Ticaret Limited Sirketi. The wires moved through the Turkish lender’s correspondent banks in the U.S. before re-routing to Akti.

The Turkish money exchanger allegedly then bought more bitcoins and ethereum coins, and also withdrew large amounts of digital tokens from his exchange account.

“Notably, these withdrawals were sent to over 250 unique cryptocurrency wallet addresses and involved transactions totaling over $90 million, suggesting that Akti had hundreds of customers for whom he transmitted money as an unlicensed MSB,” the IRS investigator claimed in the affidavit.

At least six of these customers were either based in the U.S. or held wallets at U.S. exchanges, while at least one transaction, dated Feb. 14, 2019, allowed al-Qassam Brigades to cash out the equivalent of $772 in bitcoins at the current exchange rate.

The second Turkish national targeted by federal prosecutors in Washington, Husamettin Karataş, allegedly established a cryptocurrency wallet on March 20, 2019, to which Akti sent nearly half of the digital tokens he liquidated from his account after yet another know-your-customer inquiry by the exchange the month prior.

The activity Karataş carried out in the following six months involved some of the same entities, customers and patterns previously evident in Atki’s illicit money-exchange business.

The pair’s cryptocurrency accounts also shared common IP addresses and logins, “further linking” their operations, prosecutors noted in the forfeiture complaint.

The coordinated U.S. action, which has already netted $2 million in seized assets, separately targeted 155 cryptocurrency accounts linked to a scheme by al-Qaeda and some of its affiliates, primarily in Syria, to raise digital tokens through Telegram and other social media platforms, either openly, or under the pretense of collecting charitable donations.

Contact Valentina Pasquali at vpasquali@acams.org