In this report, we explain the political context of the post-Assad era in Syria and crypto’s role in the government’s downfall in late 2024.
We also examine how crypto has been used to fund HTS and its allies’ operations.
Finally, we look at the implications for crypto investigators, regulators, and industry role-players.
The fall of Bashar al-Assad’s Ba’athist party regime
The Ba’athist Party’s rule of Syria ended on December 8, 2024, when its president, Bashar al-Assad, conceded defeat and took up exile in Russia with his family.
This was the end of a regime that first came to power by coup d’état in 1963 and continued under the leadership of Al-Assad’s father, Hafez al-Assad, from 1971 up to his death in 2000, and was since led by Bashar Al-Assad himself until events of early December 2024.
After years of conflict, a coalition of HTS, the Syrian National Army, and several other opposition groups launched a successful offensive on November 27, 2024, which overcame the Syrian Arab Armed Forces, swept through to Damascus, the capital, and took over key governorates and cities along the way, resulting in dramatic victory in early December.
Above: Map of Syria showing its geographical location in the Middle East, governorates and major cities (Source: Britannica). To track of the evolving territorial situation in post-Assad Syria, see the Institute for the Study of War (ISW) updates.
Hay’at Tahrir al Sham (HTS) and fundraising through cryptocurrencies in Syria
Prior to their recent offensive, HTS was primarily confined to Idlib, where it held its stronghold. To support their operations, they relied on Sham Cash, a digital payment system. Initially, Sham Cash was widely used by HTS, various opposition groups, and Syrians living in Idlib to facilitate financial transactions.
Above: A screenshot of the code on ShamCash app which was used to financially support HTS military operations.
Sham Cash: a crypto-friendly Syrian digital payment system
Sham Cash supports peer-to-peer (P2P) money transfers, allowing individuals to send and receive funds by sharing personal codes. It also allowed unrestricted cash withdrawals through over-the-counter (OTC) agents. The platform supported payments in both Turkish Lira and US Dollars.
Open-source intelligence (OSINT) investigations revealed that HTS also uses cryptocurrency wallet addresses to receive donations intended to support its military operations.
The Crystal Intelligence team obtained a screenshot of a conversation with a media activist based in Idlib, who provided a crypto wallet address for donations to support HTS military operations.
Soliciting crypto donations for HTS operations
In the screenshot below an Idlib-based activist explained that funds transferred via crypto would later be transferred to the Sham Cash app, which would then be used to sponsor their military activities.
The mentioned wallet is hosted on a major exchange and managed to collect over 279,000 USDT (as of December 27, 2024) in two years.
The Crystal team noticed a spike of activity for the mentioned wallet from November to December 2024: during that period, it received 159,617 USDT (as of December 27, 2024).
Above: Screenshot showing Idlib-based activist explaining how funds are used.
Analysis of donations to this address showed a significant spike in activity prior to the offensive in Aleppo, with additional funds transferred as it gained momentum.
Above: Analysis of donations from November 9 – December 17, 2024.
Our team also noticed that during the period covered, the mentioned wallet was mostly funded via a Turkish exchange: there were at least 20 transfers with a total volume of $107,427 USD.
In addition, HTS’s media outlet, “Agency of Sham,” has openly called for crypto donations to actively support its cause.
One such campaign (pictured below) featured a USDT wallet address with a message encouraging donations for “the liberation of Syria,” framing contributions as more than just financial support, but as direct involvement in their military campaign.
Above: The Agency of Sham call for donations to a crypto wallet address.
Broader crypto activity through organizations affiliated with HTS
Beyond HTS itself, several organizations in Syria, either affiliated with HTS or supportive of its cause, use cryptocurrency to fund their operations.
Of many such, two organizations were identified:
One provides interpretations and translations of Islamic texts, along with commentary on current events from an Islamic perspective, specifically targeting Russian audiences. It operates across various social media platforms, including YouTube and Telegram. This organization is linked to Soldiers of the Caucasus, a Chechen-led jihadist faction with ties to HTS. Additionally, a Russian language humanitarian charity connected to this Islamic teaching group is dedicated to supporting Muslims – particularly widows and orphans – in Syria, the Gaza Strip, and Afghanistan.
Above: A message on the Telegram Channel of the Islamic Teaching Organization discussing the “United Ummah” campaign and sharing cryptocurrency wallet addresses. The text is written in Russian.
The first paragraph translates roughly as: “We notice that with the increasing aggression against our brothers in Palestine, their needs are growing and the aid provided is decreasing. By the grace of Allah, we have collected and sent over $300,000, but over the last month the amounts have decreased significantly. Therefore, we are launching the “One Ummah” campaign, uniting all people of good into a united front.”
Among the wallet addresses (pictured below) associated with the organization is one with a strong connection to an address included in the Israeli National Bureau for Counter Terror Financing sanctions list suggesting links to Hamas-owned addresses.
Above: A screenshot of the charity organization’s Telegram page on the left, and messages which include wallet addresses for donation purposes on the right.
The message above on the right translates roughly to “Friends, to ensure security, we recommend using only unverified wallets and avoiding fund transfers from centralized exchanges.”
Above: The wallet address associated with the charity organization illustrated in Crystal’s blockchain analytics tool.
The image above shows a wallet address for USDT, BTC, and XMR associated with the charity organization. The USDT wallet address is linked to an NBCTF (National Bureau of Combating Terrorist Financing) sanctioned wallet address.
Cryptocurrency and conflict: closer than ever?
From observing developments in Syria, cryptocurrency clearly can and is changing the world. Though it may not be the only factor in determining the outcome of a rebellion, cryptocurrency provides both ready access to funds and an easy way of receiving donations.
This is a double-edged sword:; it comes with significant risks that the industry needs to both acknowledge and, more crucially, manage.
It is clear to crypto investigators, regulators, and businesses that the crypto industry needs to enhance blockchain monitoring to track transactions associated with flagged wallet addresses. Additionally, the industry must implement and maintain mechanisms which identify trends in the illicit flow of funds and set alerts for highlighting and tracking abnormal activities and transactions.
