Justin Sun, Circle targeted in letter to US senators re ‘crypto’ terror funding

Justin Sun’s Tron blockchain is once again being flagged as terror groups’ go-to financing option, while USDC issuer Circle is catching some rare political flak for its Tron ties.

This weekend, the Wall Street Journal dropped its latest article detailing the Hamas terror group’s efforts to fund its operations via blockchain-based transfers. This installment focused on the ties between Hamas and Iran and how the targeted killing of a Hamas commander led to increased use of Gaza-based money exchanges to settle cross-border transactions.

The blockchain emphasis reportedly began in mid-2019 when Palestinian businessman Zuhair Shamlakh assumed control of the ‘hawala’ network of off-the-books remittances formerly run by an assassinated Hamas commander. To evade Israeli oversight, Shamlakh turned to digital assets to receive “large-scale transfers” from Iran that could be redeemed for cash at the Gaza-based/Hamas-controlled exchanges. One of these exchanges, Al Mutahadun, was controlled by Shamlakh.

These exchanges also handled legitimate international money transfers, but officials at Israel’s National Bureau for Counter-Terror Financing (NBCTF) claimed that “as much as half the money going through the exchanges went to Hamas.” Data generated by Israel-based analytics firm BitOK showed digital wallets flagged by the NBCTF—belonging to both Hamas and the Palestinian Islamic Jihad (PIJ) group—received around $134 million in blockchain assets.

Israel began targeting Al Mutahadun in 2019, eventually tracing the digital wallets’ activities to the Binance digital asset exchange. The NBCTF pressured Binance to freeze certain accounts, but the WSJ quoted an Israeli official calling these intercepted wallets “a drop in the ocean” in terms of terror groups’ overall digital asset funding streams.

The report noted that the Gazan exchanges’ use of digital assets was “more sophisticated” than Hamas’s early efforts to crowdfund via public appeals to donate BTC. The report added that the exchanges “moved funds overwhelmingly” using Tether’s USDT stablecoin on the Tron blockchain.

The NBCTF said the Gazan exchanges “often changed the wallet addresses they used each day and sent funds through mixers.” These wallets also received transfers from the Russia-based Garantex exchange, which has been targeted by U.S. authorities for helping customers evade economic sanctions imposed on Russia following its 2022 invasion of Ukraine.

‘Crypto Twitter’ strikes back

This weekend’s report follows other recent articles by the WSJ, the Financial Times, and blockchain intelligence analysts TRM Labs detailing the role that ‘crypto’ plays in helping to fuel terror attacks. This has caused no shortage of outrage in the world of ‘Crypto Twitter,’ with numerous accounts claiming the mainstream media rely on a poor understanding of blockchain data to make their sensational claims.

Elliptic, the blockchain analytics firm whose work was cited in some of the above reports, published a note on October 25 claiming to be “setting the record straight on crypto crowdfunding by Hamas.” Elliptic claimed the WSJ had published “misinterpretations of the level of crypto fundraising by Hamas” while insisting that there “was no evidence to support the assertion that Hamas has received significant volumes of crypto donations.”

Yet several sharp-eyed sleuths pointed out that Elliptic had gone back and edited some of its previous reports on this subject to downplay the significance of digital assets in terror-related funding. And efforts by Elliptic and others to minimize blockchain-based finance in this debate aren’t convincing the people who hold the power to punish those who fail to interdict this funding.

For instance, on November 9, Deputy Treasury Secretary Wally Adeyemo told Reuters that the coming weeks would see “actions taken by our allies and partners,” including “shutting down charities or going after individuals who may be helping to facilitate payments for Hamas.”

While Adeyemo acknowledged that digital assets weren’t the top channel for terror financing, that could change “if the crypto industry doesn’t put in place safeguards and take seriously their anti-money-laundering responsibilities.” Adeyemo warned terror groups that the authorities would “continue to act as long as you act, to cut off your access to financing.”

On November 8, Brian Nelson, the Treasury’s top sanctions official, met with private sector companies—including blockchain firms and fiat payment processors—to discuss ways to counter terror financing. While some firms are presumably more on board with this effort than others, some names being circulated as key participants in this terror funding might surprise you.

The Circle of mistrust

Following the October 7 attacks by Hamas against Israeli citizens, bipartisan groups of U.S. legislators began penning letters urging the White House to take further action against the entities that facilitate terror funding. Some of these letters singled out Binance and Tether as overdue for criminal prosecution by the Department of Justice.

On November 9, a new letter was sent by the non-profit ethics watchdog group Campaign for Accountability (CFA) to Senators Sherrod Brown (D-OH) and Elizabeth Warren (D-MA), both members of the Senate Committee on Banking, Housing and Urban Affairs. The CFA asked the pair to urge the Department of the Treasury to go beyond its recent targeting of so-called ‘coin mixing’ services and target terror groups and money launderers’ use of ‘chain hopping’ to obfuscate the trail of illicit assets.

The CFA singled out “an Asia-based network of trading platforms and cryptocurrencies” that is responsible for “billions of dollars in transactions by alleged organized crime groups and sanctioned entities.” This Asian network, “revolving around the blockchain system TRON, is headed by Chinese national Justin Sun” and was the conduit for “much of the recent alleged terrorist funding through digital assets.”

The CFA cites the TRON Foundation and other Sun-controlled entities having “a historical and ongoing relationship with Circle Internet Financial LLC,” the U.S.-based issuer of the USDC stablecoin. Circle and Sun have been dealing with each other since mid-2019 when Sun acquired the Poloniex exchange from Circle. (More on Poloniex in a moment.)

The CFA cites NBCTF actions targeting terror groups’ use of USDC, Tether’s USDT, and TRON’s native token, TRX. The CFA further cites ChainArgos data that “multiple large flow addresses that have redeemed USDC for USD (presumably through Circle’s bank accounts) have also received funds from wallets Israeli intelligence flagged as belonging to Hamas or Hezbollah.”

The CFA notes Circle’s introduction of its Cross Chain Transfer Protocol that makes it easier for USDC to ‘chain hop,’ while citing a recent Elliptic observation that increased efforts by law enforcement to target coin mixers and non-compliant exchanges “is leading to a ‘crime displacement’ effect where criminals are resorting to cross-chain crime as an alternative.”

Elliptic cited the popularity of the TRON-based SunSwap platform among terror groups for obtaining financing, noting that both USDT and USDC are among the digital tokens traded on SunSwap. The CFA believes “it’s reasonable to ask if Sun’s network also may cause broader harms. And, thanks to their involvement with Circle, which has benefitted from a regulatory framework slow to catch up to crypto firms that skirt the rules, reputable banking institutions may find they unwittingly have participated in facilitating criminal organizations such as Hamas.”

Circle has seen USDC’s market cap shrink for over a year and shed another $1.5 billion in just the past three weeks. Currently struggling to stay over $24 billion, USDC’s cap has fallen by around $32 billion since June 2022. Over the same period, Tether’s USDT stablecoin has gained around $20 billion to its current record high of around $87 billion.

It’s widely presumed that, since USDT and other sketchy stables lack access to U.S. banking, USDC is being swapped for USDT on exchanges, effectively serving as a fiat offramp for Tether customers—including those with less than stellar reputations. While Circle has a far better reputation on Capitol Hill than the Tether/Bitfinex cabal, the bloom could come off that rose if USDC is seen as an integral piece of the terror financing chain.

A hack by any other name

Meanwhile, Sun-owned platforms can’t seem to stop being hacked. Last week saw $126 million worth of various tokens stolen from Poloniex. The tokens included BTC, ETH, TRX, USDT, and Sun’s TUSD stablecoin, along with several illiquid meme-coins, all of which were contained in a single Poloniex hot-wallet. The more high-profile (aka liquid) of these ill-gotten tokens were soon swapped for ETH and TRX and sent to new wallets.

Sun tweeted that “the losses are within manageable limits, and Poloniex’s operating revenue can cover these losses.” Sun offered customers his apologies “for any inconvenience this may have caused” while offering “a 5% white hat bounty” to the hacker if they returned the stolen assets within a week.

This is the second major hack of a Sun-owned platform in recent months, following the theft of around 5,000 ETH worth $8 million from the HTX (formerly Huobi) exchange in September. Then, as now, Sun offered his braggadocio boasts about the insignificance of the stolen sums, as well as making the same 5% ‘bounty’ offer to the hacker(s).

Some online observers have claimed that North Korea’s infamous Lazarus Group may have been behind the latest hack, although evidence of their involvement has yet to be disclosed. Sun’s ‘bounty’ offers usually contain a threat that if the offer is turned down, law enforcement agencies will be contacted. But given that Sun has spent much of his life on the run from multiple agencies, we assume his threat is more hollow than a dollar store chocolate Easter bunny.

And if we were a Poloniex customer, we’d keep a sharp eye on any assets left on the exchange. Since Sun took control of HTX earlier this year, he has been silently replacing HTX customers’ USDT with stUSDT, his ‘staked’ version of USDT that offers even less proof than Tether regarding its alleged reserve assets. Remember, kids, whether it’s terror or just old-fashioned theft—if you see something, say something.

Watch CoinGeek Conversations with Yves Mersch: Digital currency regulation and the role of BSV blockchain