Study Maps Cryptocurrency-Linked Illicit Activity on the Arabic Dark Web
Summary
A peer-reviewed study analyzed Arabic-language dark web content from July 2024 to June 2025, identifying 95 cryptocurrency addresses linked to illicit activity and highlighting differences between public and privacy coins.
Key points
- Researchers narrowed more than 3.1 million initial results to 4,711 results containing cryptocurrency addresses, then identified 95 unique addresses tied to illicit activity.
- The study grouped activity into six categories, including unverified humanitarian aid solicitations, cyber threat actors, terrorism financing, and child sexual abuse material.
- More than 85% of tracked payments flowed to unverified humanitarian aid solicitation addresses; one address received about $50,000.
- Bitcoin and USDT appeared predominantly on Telegram, while Monero and Zcash were concentrated on Tor-based onion sites.
- The researchers could not determine funds received by privacy-coin addresses because of transaction obfuscation.
- None of the 95 addresses appeared on both Telegram and Tor; some Monero addresses had been observed since early 2022.
Article Details
- Publisher
- DarkOwl.com (Blog)
- Report Period
- July 2024–June 2025
- Scope
- Arabic-language dark web content containing cryptocurrency addresses, analyzed for illicit activity, cryptocurrency type, source network, frequency, and funds received.
- Sample Size
- 95 unique cryptocurrency addresses tied to illicit activity, identified after de-duplication.
- Key Statistics
- More than 3.1 million initial results were filtered to identify 4,711 results containing cryptocurrency addresses.
- The 4,711 results yielded 95 unique addresses tied to illicit activity after de-duplication.
- More than 85% of tracked payments flowed to Unverified Humanitarian Aid Solicitation addresses; one such address received approximately $50,000.
- MENA received roughly $338.7 billion in on-chain cryptocurrency value in 2024, ranking seventh globally.
- None of the 95 addresses appeared on both Telegram and the Tor network.
- Recommendations
- Agencies with limited resources should weigh investigative coverage toward Tor, where the report says the most serious crimes are concentrated, while recognizing that Telegram accounts for greater volume.
- Coordinate public awareness efforts about unverified humanitarian aid solicitations to address substantial financial flows and risks to trust in legitimate aid organizations.
- For terrorism-financing and CSAM investigations involving privacy coins, supplement traditional blockchain analysis with darknet monitoring and forensic tools, and build relationships with Virtual Asset Service Providers.
People
Threat Actors
313 TeamIdentified in the article as a pro-Iranian hacktivist group associated with cyber threat actors in the study.ISISThe article reports specific ties between the study’s terrorism-financing activity and ISIS.LulzSecIdentified in the article as a pro-Iranian hacktivist group associated with cyber threat actors in the study.
Vendors
ChainalysisSpecialized tools like Crystal Expert, TRM Labs, and Chainalysis Reactor can analyze transaction histories, identify clustering patterns, and link addresses to real-world entities.DarkOwlThe researchers used DarkOwl Vision as the primary tool for identifying and analyzing Arabic-language content containing cryptocurrency addresses.TRM LabsSpecialized tools like Crystal Expert, TRM Labs, and Chainalysis Reactor can analyze transaction histories, identify clustering patterns, and link addresses to real-world entities.
Products
DarkOwl VisionThe researchers used DarkOwl Vision as the primary tool for identifying and analyzing Arabic-language content containing cryptocurrency addresses.Discordone of the world’s largest databases of dark web content, spanning Tor, I2P, ZeroNet, Telegram, and Discord, without requiring investigators to directly access dangerous or illicit networks themselves.I2PDarkOwl Vision indexes one of the world’s largest databases of dark web content, spanning Tor, I2P, ZeroNet, Telegram, and Discord, without requiring investigators to directly access dangerous or illicit networksTelegramVision indexes one of the world’s largest databases of dark web content, spanning Tor, I2P, ZeroNet, Telegram, and Discord, without requiring investigators to directly access dangerous or illicit networksTorof widespread internet access, high cryptocurrency adoption, and anonymizing technologies like the Tor network has created fertile conditions for illicit activity — much of it conducted in Arabic and largelyZeroNetDarkOwl Vision indexes one of the world’s largest databases of dark web content, spanning Tor, I2P, ZeroNet, Telegram, and Discord, without requiring investigators to directly access dangerous or illicit networks
Tools
Chainalysis ReactorSpecialized tools like Crystal Expert, TRM Labs, and Chainalysis Reactor can analyze transaction histories, identify clustering patterns, and link addresses to real-world entities.Crystal ExpertSpecialized tools like Crystal Expert, TRM Labs, and Chainalysis Reactor can analyze transaction histories, identify clustering patterns, and link addresses to real-world entities.TRM LabsSpecialized tools like Crystal Expert, TRM Labs, and Chainalysis Reactor can analyze transaction histories, identify clustering patterns, and link addresses to real-world entities.