Audit log

Every state-changing event for Bitcoin Xchange (Syria-based, ISIS-Linked): moderation decisions on community submissions, plus corrections and updates from the news pipeline. URL-based decisions carry three independent witnesses — the original source, an Internet Archive snapshot taken at submission time, and a Solana memo signed by our publicly-disclosed publisher key.

1. #1publishby system:backfill

   2026-06-26 17:04:25Z
   Score: ? → ? (no score change)
   anchoranchored

   chain

   ●mainnet-betaslot 429,062,481

   sig

   5ufXtH4Cbnb5…oSVinvAqcopyexplorer ↗

   hash

   9vNfLWGTSarH…igvXRvyScopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (16050 B) ▸

   {"actor":"system:backfill","investigation_id":"3e49786b-944c-4251-9a0d-7dac931261b9","kind":"publish","page_slug":"bitcoin-xchange-syria-based-isis-linked","published_at":"2026-06-26T17:04:24.989Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"Bitcoin Xchange (Syria-based, ISIS-Linked)","sections":[{"content":"On June 22, 2026, OFAC designated Bitcoin Xchange — formally identified in designation records as 'BITCOIN EXCHANGE AGENT IDLIB'S NO.1 COIN EXCHANGE,' with an alternative name of 'BITCOIN XCHANGE' — under Executive Order 13224, the primary U.S. counterterrorism sanctions authority. The entity is listed with locations across Idlib, Salqin, Darkush, and Sarmada, Syria, and is classified as a financial and insurance activities enterprise. OFAC cited the entity for having 'materially assisted, sponsored, or provided financial, material, or technological support for, or goods and services to or in support of' the Islamic State of Iraq and the Levant (ISIL/ISIS). The designation was part of a coordinated action targeting three individuals and six entities across Europe, the Middle East, and West Africa. All U.S. persons are prohibited from transacting with Bitcoin Xchange, and any assets subject to U.S. jurisdiction must be blocked. Secondary sanctions risk applies under EO 13224 to non-U.S. persons who transact with the designated entity.","heading":"OFAC Designation and Regulatory Status","severity":"critical","sources":[{"credibility":1,"name":"Treasury Targets ISIS Facilitators and Disrupts Terrorist Financial Networks — U.S. Department of the Treasury","type":"regulatory","url":"https://home.treasury.gov/news/press-releases/sb0537"},{"credibility":1,"name":"Counter Terrorism Designations — Office of Foreign Assets Control, June 22, 2026","type":"regulatory","url":"https://ofac.treasury.gov/recent-actions/20260622"}]},{"content":"Bitcoin Xchange was established in late 2020 and is controlled and directed by Abdelhakim Boukich, described by the U.S. Treasury as a former Dutch national who relocated to Syria and operates as an extremist financial facilitator. Boukich is also known by the aliases 'Abu Sulayman Alholandi' and 'Muhammad Babili.' OFAC designated Boukich individually alongside the entity on June 22, 2026, under the same EO 13224 authority. Treasury's press release states that Boukich and Bitcoin Xchange transferred money on behalf of ISIS associates originating from Norway, Belgium, the Netherlands, South Africa, and the United States. The alias 'Alholandi' — an Arabic rendering connoting 'the Dutchman' — is consistent with Boukich's reported Dutch origin and subsequent relocation to Syrian territory.","heading":"Founder and Control: Abdelhakim Boukich","severity":"critical","sources":[{"credibility":1,"name":"Treasury Targets ISIS Facilitators and Disrupts Terrorist Financial Networks — U.S. Department of the Treasury","type":"regulatory","url":"https://home.treasury.gov/news/press-releases/sb0537"},{"credibility":2,"name":"OFAC Targets ISIS Crypto Financing Network, Including Bitcoin Xchange — TRM Labs","type":"research","url":"https://www.trmlabs.com/resources/blog/ofac-targets-isis-crypto-financing-network-including-bitcoin-xchange"}]},{"content":"TRM Labs, which provided blockchain analytics support to inform the OFAC designation, attributed approximately USD 10 million in total incoming and outgoing volume to addresses linked to Bitcoin Xchange, with hundreds of transactions connected to ISIS-linked fundraising campaigns. TRM identified Bitcoin Xchange's infrastructure through a pattern of address reuse across multiple unrelated fundraising campaigns — campaigns that featured different beneficiaries and narratives but shared the same underlying wallet infrastructure, indicating centralized control rather than independent operators. The entity functioned as a conversion layer: donors outside Syria sent cryptocurrency through Telegram-based ISIS fundraising campaigns, and Bitcoin Xchange or associated exchangers converted those funds to cash for delivery into displacement camp ecosystems, reportedly charging a fee of 2 to 5 percent per transaction. Primary cryptocurrencies used across the broader network include Tether USDT on the TRC20/Tron network and Bitcoin.","heading":"On-Chain Activity and Transaction Volume","severity":"critical","sources":[{"credibility":2,"name":"OFAC Targets ISIS Crypto Financing Network, Including Bitcoin Xchange — TRM Labs","type":"on_chain","url":"https://www.trmlabs.com/resources/blog/ofac-targets-isis-crypto-financing-network-including-bitcoin-xchange"}]},{"content":"Bitcoin Xchange operated as a core off-ramp in a layered ISIS financial network. Donors in Western countries and Africa sent cryptocurrency via Telegram-based campaigns targeting supporters of ISIS members detained in camps such as al-Hol and Roj in northeast Syria. Syria-based exchangers including Bitcoin Xchange served as the pooling and conversion layer, receiving donated crypto and disbursing cash to recipients inside or connected to those camp ecosystems. The broader network designated alongside Bitcoin Xchange on June 22, 2026 included: Miloud Abderrahmane (France-based individual facilitator); Spider Gayrimenkul ve Genel Ticaret and Alkaram Danismanlik Gayrimenkul (Turkish money transfer entities based in Istanbul); and three Nigeria-based bureaux de change — Nine to Nine Exchange Bureau de Change, Manhattan Bureau de Change, and Generation Currency Bureau de Change — all linked to Nigerian individual Mukhtar Adamu Muhammad. TRM Labs also identified a second Idlib-area exchange with potential connections to Turkey-based operatives as part of the same network infrastructure. The broader ISIS crypto-financing model documented by MEMRI and the Combating Terrorism Center at West Point involves ISIS-affiliated Telegram channels sharing wallet addresses and QR codes, with fundraising campaigns running continuously for detained fighters and families.","heading":"Role in ISIS Financing Infrastructure","severity":"critical","sources":[{"credibility":2,"name":"OFAC Targets ISIS Crypto Financing Network, Including Bitcoin Xchange — TRM Labs","type":"research","url":"https://www.trmlabs.com/resources/blog/ofac-targets-isis-crypto-financing-network-including-bitcoin-xchange"},{"credibility":1,"name":"Treasury Targets ISIS Facilitators and Disrupts Terrorist Financial Networks — U.S. Department of the Treasury","type":"regulatory","url":"https://home.treasury.gov/news/press-releases/sb0537"},{"credibility":2,"name":"How ISIS Uses Cryptocurrency: The Case of Al-Hol Camp — MEMRI","type":"research","url":"https://www.memri.org/reports/how-isis-uses-cryptocurrency-case-al-hol-camp-and-model-future"},{"credibility":2,"name":"Examining Digital Currency Usage by Terrorists in Syria — Combating Terrorism Center at West Point","type":"research","url":"https://ctc.westpoint.edu/examining-digital-currency-usage-by-terrorists-in-syria/"}]},{"content":"According to OFAC's formal designation records, Bitcoin Xchange maintained a physical presence across multiple locations in northwestern Syria: Idlib, Salqin, Darkush, and Sarmada. These cities and towns are all located within Idlib Governorate, a region of Syria that as of 2026 remains outside Syrian government control and has been governed by various armed factions. The entity's formal name in OFAC records — 'BITCOIN EXCHANGE AGENT IDLIB'S NO.1 COIN EXCHANGE' — references Idlib explicitly. Prior research by the Combating Terrorism Center at West Point identified a predecessor Syria-based entity called 'BitcoinTransfer,' also operating from Idlib, that had processed over USD 280,000 in Bitcoin connected to terrorism financing schemes as of 2020; it is not established whether Bitcoin Xchange and BitcoinTransfer are organizationally connected.","heading":"Geographic Presence and Physical Locations","severity":"high","sources":[{"credibility":1,"name":"Counter Terrorism Designations — Office of Foreign Assets Control, June 22, 2026","type":"regulatory","url":"https://ofac.treasury.gov/recent-actions/20260622"},{"credibility":2,"name":"Examining Digital Currency Usage by Terrorists in Syria — Combating Terrorism Center at West Point","type":"research","url":"https://ctc.westpoint.edu/examining-digital-currency-usage-by-terrorists-in-syria/"}]},{"content":"The June 22, 2026 OFAC action targeting Bitcoin Xchange is part of a continuing U.S. government effort to disrupt ISIS's use of cryptocurrency for operational financing. According to reporting by The Defiant, Chainalysis, and Crowdfund Insider, the Treasury action is notable for its geographic breadth — targeting entities across France, Syria, Turkey, and Nigeria within a single coordinated designation. Researchers at MEMRI documented that as recently as April 2026, ISIS-affiliated fundraisers explicitly instructed donors to use Tron USDT (TRC20) wallets 'to avoid surveillance,' and in February 2026 Bitcoin campaigns raised approximately USD 7,400 for detainee relocations. The Islamic State's global financial network has adapted to blockchain analytics pressure by shifting toward stablecoins on privacy-favorable chains and using Telegram as a primary distribution channel. Syria-based exchangers like Bitcoin Xchange sit at the cash-out layer of this architecture, making their designation a significant disruption to the network's ability to convert crypto fundraising proceeds into spendable local currency.","heading":"Broader Context: ISIS Crypto Financing Ecosystem","severity":"high","sources":[{"credibility":2,"name":"OFAC Sanctions ISIS Financial Facilitators — Chainalysis","type":"research","url":"https://www.chainalysis.com/blog/ofac-sanctions-isis-financial-facilitators-june-2026/"},{"credibility":2,"name":"Treasury Sanctions Three Individuals and Six Entities for Routing Crypto to ISIS — Cryptonews.net","type":"news_article","url":"https://cryptonews.net/news/security/33048474/"},{"credibility":2,"name":"US Department of Treasury Targets Crypto-Enabled Networks Supporting ISIS in June 2026 Sanctions — Crowdfund Insider","type":"news_article","url":"https://www.crowdfundinsider.com/2026/06/287193-us-department-of-treasury-targets-crypto-enabled-networks-supporting-isis-in-june-2026-sanctions/"},{"credibility":2,"name":"How ISIS Uses Cryptocurrency: The Case of Al-Hol Camp — MEMRI","type":"research","url":"https://www.memri.org/reports/how-isis-uses-cryptocurrency-case-al-hol-camp-and-model-future"}]}],"sources_used":[{"credibility":1,"name":"Treasury Targets ISIS Facilitators and Disrupts Terrorist Financial Networks — U.S. Department of the Treasury","type":"regulatory","url":"https://home.treasury.gov/news/press-releases/sb0537"},{"credibility":1,"name":"Counter Terrorism Designations — Office of Foreign Assets Control, June 22, 2026","type":"regulatory","url":"https://ofac.treasury.gov/recent-actions/20260622"},{"credibility":2,"name":"OFAC Targets ISIS Crypto Financing Network, Including Bitcoin Xchange — TRM Labs","type":"research","url":"https://www.trmlabs.com/resources/blog/ofac-targets-isis-crypto-financing-network-including-bitcoin-xchange"},{"credibility":2,"name":"OFAC Sanctions ISIS Financial Facilitators — Chainalysis","type":"research","url":"https://www.chainalysis.com/blog/ofac-sanctions-isis-financial-facilitators-june-2026/"},{"credibility":2,"name":"The US Takedown of Crypto-Linked Terrorist Financing — Elliptic","type":"research","url":"https://www.elliptic.co/blog/the-us-takedown-of-crypto-linked-terrorist-financing"},{"credibility":2,"name":"Treasury Sanctions Three Individuals and Six Entities for Routing Crypto to ISIS — The Defiant","type":"news_article","url":"https://thedefiant.io/news/regulation/treasury-sanctions-three-individuals-six-entities-routing-crypto-isis"},{"credibility":2,"name":"US Department of Treasury Targets Crypto-Enabled Networks Supporting ISIS in June 2026 Sanctions — Crowdfund Insider","type":"news_article","url":"https://www.crowdfundinsider.com/2026/06/287193-us-department-of-treasury-targets-crypto-enabled-networks-supporting-isis-in-june-2026-sanctions/"},{"credibility":2,"name":"Treasury Sanctions Three Individuals and Six Entities for Routing Crypto to ISIS — Cryptonews.net","type":"news_article","url":"https://cryptonews.net/news/security/33048474/"},{"credibility":2,"name":"How ISIS Uses Cryptocurrency: The Case of Al-Hol Camp and a Model for the Future — MEMRI","type":"research","url":"https://www.memri.org/reports/how-isis-uses-cryptocurrency-case-al-hol-camp-and-model-future"},{"credibility":2,"name":"Examining Digital Currency Usage by Terrorists in Syria — Combating Terrorism Center at West Point","type":"research","url":"https://ctc.westpoint.edu/examining-digital-currency-usage-by-terrorists-in-syria/"},{"credibility":2,"name":"OFAC Sanctions ISIS Operators for Financing Terror Group with Crypto — FINCHANNEL","type":"news_article","url":"https://finchannel.com/ofac-sanctions-isis-operators-for-financing-terror-group-with-crypto/131854/crime/2026/06/"}],"summary":"Bitcoin Xchange is a Syria-based money services business established in late 2020 and controlled by Abdelhakim Boukich, a former Dutch national operating from Syria. On June 22, 2026, the U.S. Department of the Treasury's Office of Foreign Assets Control (OFAC) formally designated the entity under Executive Order 13224 for materially supporting ISIS by facilitating cryptocurrency-to-cash conversions on behalf of ISIS associates across multiple countries. On-chain analysis by TRM Labs attributed approximately USD 10 million in total transaction volume to addresses linked to Bitcoin Xchange, with hundreds of transactions connected to ISIS-linked fundraising campaigns.","timeline":[{"date":"2018-12-01","event":"A predecessor Syria/Idlib-based entity called BitcoinTransfer begins processing Bitcoin transactions later linked to terrorism financing; over USD 280,000 passes through it. Organizational connection to Bitcoin Xchange is not established.","source":"Combating Terrorism Center at West Point","source_url":"https://ctc.westpoint.edu/examining-digital-currency-usage-by-terrorists-in-syria/"},{"date":"2020-12-01","event":"Bitcoin Xchange established in late 2020 by Abdelhakim Boukich and Syria-based associates, operating as a money services business in Idlib Governorate.","source":"U.S. Department of the Treasury press release","source_url":"https://home.treasury.gov/news/press-releases/sb0537"},{"date":"2025-10-01","event":"ISIS-affiliated organizations announce receiving Tether donations for detainees at al-Hol and Roj camps, promoting a centralized fund system; broader network in which Bitcoin Xchange operates continues activity.","source":"MEMRI Cyber and Jihad Lab","source_url":"https://www.memri.org/reports/how-isis-uses-cryptocurrency-case-al-hol-camp-and-model-future"},{"date":"2026-02-01","event":"ISIS-linked Bitcoin campaigns raise approximately USD 7,400 for detainee relocation operations channeled through Syria-based exchanger network.","source":"MEMRI Cyber and Jihad Lab","source_url":"https://www.memri.org/reports/how-isis-uses-cryptocurrency-case-al-hol-camp-and-model-future"},{"date":"2026-04-01","event":"ISIS-affiliated fundraisers instruct donors to use Tron USDT (TRC20) wallets explicitly to avoid blockchain surveillance; Syria-based exchanges continue operating as cash-out layer.","source":"MEMRI Cyber and Jihad Lab","source_url":"https://www.memri.org/reports/how-isis-uses-cryptocurrency-case-al-hol-camp-and-model-future"},{"date":"2026-06-22","event":"OFAC designates Bitcoin Xchange (formally 'BITCOIN EXCHANGE AGENT IDLIB'S NO.1 COIN EXCHANGE') and its controller Abdelhakim Boukich under Executive Order 13224 for materially supporting ISIS. Five additional entities across Turkey and Nigeria and two other individuals are designated in the same action.","source":"U.S. Department of the Treasury / OFAC","source_url":"https://home.treasury.gov/news/press-releases/sb0537"}]},"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 5a3e4004-9f92-478f-8a98-7aa4ef72e6c4copy