On June 23, the U.S. Department of the Treasury's Office of Foreign Assets Control (OFAC) designated three individuals and six entities for facilitating financial transactions on behalf of the Islamic State of Iraq and Syria (ISIS). Spread across Europe, the Middle East, and West Africa, these facilitators helped the group move funds among its regional affiliates. Treasury Secretary Scott Bessent said in the announcement that ISIS continues to seek new tools to finance attacks, and that the United States will use every tool at its disposal to crush its remaining capabilities.
The action makes more sense against a larger backdrop. On May 16 of this year, a coordinated U.S.–Nigeria operation killed Abu-Bilal al-Minuki, the number two figure in ISIS, who had led the group's General Directorate of Provinces and provided operational guidance and funding to its regional offices. According to Treasury's 2026 National Terrorist Financing Risk Assessment and FinCEN's April 2025 advisory on ISIS financing, sustained counterterrorism pressure has pushed ISIS into a highly decentralized network that leans on relatively autonomous cells and affiliates. What ties those nodes together is a web of financial facilitators scattered around the world, and this is exactly the layer OFAC went after.
Who Was Sanctioned
The three individuals each play a distinct role. Miloud Abderrahmane, a French national based in France, conducted transactions with multiple ISIS-affiliated individuals, including some in Syria, and also provided instructions and manufacturing information on explosives to ISIS supporters. Abdelhakim Boukich, based in Syria and a former Dutch national, controls Bitcoin Xchange, a Syria-based money service business that he and his associates set up in late 2020 and used to move money for ISIS associates originating in Norway, Belgium, the Netherlands, South Africa, and the United States. Mohamad Alhmidan, already sanctioned by OFAC back in 2016 for providing logistical and financial support to ISIS, controls Spider, a Turkey-based money service business that began as a hawala operating in Syria and was used to move funds out of ISIS-controlled areas.
The West Africa branch of this network runs through Mukhtar Adamu Muhammad, a Nigerian national who serves as a financial facilitator for ISIS in West Africa (ISIS-WA) and controls three Nigeria-based bureaux de change. Those three businesses were swept into the designation because they are owned or controlled by Muhammad.
The pattern is clear. OFAC did not target frontline operatives but the financial plumbing that keeps the organization running. Whether it is a hawala in Syria, a bureau de change in Turkey, or crypto addresses in the hands of a facilitator in France, they all play the same role: keeping money moving across financial systems that have otherwise been cut off.
The Two Tron Addresses BlockSec Tracked
The sanctions list includes two Tron addresses, both belonging to the France-based facilitator Miloud Abderrahmane. BlockSec found that the two addresses sit in a clear upstream–downstream relationship on-chain.
One is the main address Abderrahmane uses to consolidate and distribute funds; the other is his deposit address at Binance, which serves as one of the main address's exits to an exchange. In other words, funds are first aggregated at the main address, then routed out to exchanges through the Binance deposit address. Looking at the fuller flow, Abderrahmane receives funds from exchanges such as KuCoin and pushes funds out to Binance, KuCoin, LBank, and others. Both ends connect to mainstream platforms, with his own addresses sitting in the middle. That shape lines up exactly with the role of a financial intermediary.
Figure 1. On-chain fund flow of Miloud Abderrahmane's main address, with both inflows and outflows connecting to KuCoin, Binance, and LBank (Source: BlockSec MetaSleuth)
The two designated addresses:
- Main address: TBXMiRqUp1XH1zLazWu8cWitMAScv4HsYq
- Binance deposit address: TDFj8tYzfLDkwEMo4MJ2DfrbpMztuCCnan
The full fund-flow graph is available on MetaSleuth: https://metasleuth.io/result/tron/TBXMiRqUp1XH1zLazWu8cWitMAScv4HsYq?source=483c007e-bdeb-4d03-9585-48c160346b38
A Money Trail That Leads to a Hamas-Affiliated Entity
The more revealing part is how these addresses connect to the wider picture. BlockSec also detected fund links between Abderrahmane's address and several terror-financing addresses seized by Israel's National Bureau for Counter Terror Financing (NBCTF). One link stands out: through a small network of just 10 addresses within a minimum distance of three hops, Abderrahmane's funds connect to DUBAI COMPANY FOR EXCHANGE, an exchange house that has been identified as a terror-affiliated entity for providing substantial assistance to Hamas.
Figure 2. Through a small network of 10 addresses within 3 hops, the main address links to an exchange house identified as a Hamas-affiliated entity (Source: BlockSec Phalcon Compliance)
What makes this link matter is that it ties a sanctioned ISIS facilitator to a Hamas-affiliated exchange entity in just a few short hops. The fund networks of different terrorist groups are not isolated on-chain; they cross through a shared set of intermediaries, exchange houses, and consolidation addresses. Once that overlap is reconstructed, the value to law enforcement and compliance teams goes well beyond confirming a single suspect. It means following the money to surface an entire cluster of related addresses that had not been labeled before.
What This Means for Exchanges and Payment Firms
For exchanges, payment firms, and stablecoin-related businesses, the immediate takeaway is that the designation names not only individuals but specific on-chain addresses, and those addresses may have moved funds in and out of major exchanges well before they became public. Abderrahmane's funds connect to platforms like Binance, KuCoin, and LBank on both ends, which means any point in that chain without real-time on-chain risk screening could unknowingly receive funds tied to terror financing.
Compared with traditional offshore networks, on-chain money has one defining trait: it is highly transparent. A transfer may pass through many layers of addresses and even cross multiple chains, but as long as a key address or entry point can be pinned down, an analysis system can follow the transaction path and reconstruct scattered nodes into a complete fund-flow graph. Terror-financing monitoring is one of the most fitting applications of that capability.
BlockSec's Phalcon Compliance scores on-chain addresses for risk in real time, drawing on a large-scale address label library, fund-path analysis, and behavioral detection. When an address intersects with a known high-risk entity, or its fund behavior matches a specific risk pattern, the system generates a risk report and flags the potential associated network. All individuals, entities, and addresses in this latest sanctions list have already been added to BlockSec's intelligence database, and we will continue to track their on-chain activity.
Try Phalcon Compliance to screen addresses and transactions for risk in real time.
Cryptocurrency is a neutral technology, but when it is used for terror financing, money laundering, and sanctions evasion, the damage extends beyond the security of any single region to the trust the entire industry rests on. BlockSec's vision is to build a Web3 world that is secure, compliant, and where on-chain risk is visible.
