- Trending
- Comments
- Latest
Hamas-linked Telegram channels raised over $1,000 monthly in late 2024 using the platform’s Stars tipping feature, which converts into Toncoin cryptocurrency after a 21-day period, creating what counterterrorism researchers describe as a critical blind spot in terrorist financing detection.
The new discovery, detailed in a new report by counterterrorism researchers Laurence Bindner and Raphael Gluck of the JOS Project/Jihadoscope for the Global Network on Extremism & Technology (GNET), reveals how terrorist financing is evolving beyond traditional cryptocurrency wallets and crowdfunding platforms that have faced increased scrutiny from regulators and law enforcement.
Telegram Stars are an in-app digital currency that users purchase to support content creators, pay for premium features, or reward posts they appreciate. The system operates similarly to tipping mechanisms on platforms like Twitch or YouTube’s Super Chat.
But unlike those mainstream platforms with robust moderation systems, Telegram’s infrastructure allows Stars to be converted into Toncoin (TON), the cryptocurrency of The Open Network after a 21-day waiting period and a minimum threshold of 1,000 Stars. This conversion process provides what researchers describe as a crucial layer of financial obscurity.
“Without the publication of a TON address, which the contributor cannot see, there is no visibility for the Toncoin wallet address on the blockchain,” the GNET report states.
“Stars are seen as support for creators rather than as a method of payment or financial transfer; therefore, they appear ‘innocent.'”
The implications are stark: while cryptocurrency tracking has become increasingly sophisticated, allowing authorities to trace Bitcoin and other transparent blockchain transactions, the Stars-to-Toncoin pathway creates a blind spot in terrorist financing detection.
Analysis of a Hamas-linked “mirror channel”—created to replicate content from blocked official Hamas channels—shows measurable, repeated exploitation of the Stars system:
At current exchange rates, Stars cost roughly $0.015 to purchase and can be redeemed for approximately $0.013 each.
The channel actively solicits these donations with specific messaging: “Brothers and sisters who are unable to send donations via email, you can send your donations by interacting with the channel’s posts by liking them with Stars.”
Similarly, GazaNow—a media outlet designated and sanctioned by U.S. and UK authorities over links to Hamas—has encouraged supporters to “donate by purchasing Stars and sending them.”
The researchers note that Hamas has discontinued publicly sharing Bitcoin and other cryptocurrency addresses after authorities gained access to and seized several wallets on transparent blockchains, making the more obscure Stars pathway increasingly attractive.
The problem extends beyond Telegram. Bindner and Gluck also discovered an ecosystem of al-Shabaab-linked accounts operating on Substack, the newsletter platform that has become popular among independent writers and content creators.
While there’s no direct evidence yet of al-Shabaab accounts accepting payments on Substack, the researchers warn that the platform’s “freemium” subscription model and compatibility with cryptocurrency payment processors like OpenNode create similar vulnerabilities.
“This does not indicate current financial abuse but rather a vulnerability to which the platform is exposed,” the report states. “Past patterns show social media ecosystems occupied by terrorist groups are often built out and, once established, look to exploit the platform resources for their benefit.”
Multiple al-Shabaab accounts were found maintaining a presence on Substack with “limited removal,” often using a “relay method” that links to spaces on other platforms, including Telegram, RocketChat, and Signal, ensuring that when one account is deleted, others can share new links.
The exploitation of Telegram Stars and potential abuse of Substack subscriptions represent what researchers describe as a growing trend: terrorist groups targeting “creator economy” tools that weren’t designed with counterterrorism financing safeguards in mind.
“Digital financial products should be assessed the same way as any financial transaction,” the report recommends. “Anything that involves cashing out to a cryptocurrency wallet should include the same KYC (Know Your Customer) safeguards implemented by many wallets.”
The researchers emphasize that while micropayments may not meet the larger revenue needs of established terrorist networks, they serve a critical strategic purpose: diversification and backup options as primary fundraising methods face increasing disruption.
“The appeal includes small donation opportunities that add up, lack of oversight, plausible deniability for donors, and use as a supplementary method if primary fundraising is interrupted,” according to the report.
The exploitation of micropayment systems for terrorist financing stands in sharp contrast to legitimate humanitarian applications of blockchain technology, such as the Afghan-built HesabPay platform that processes $60 million monthly in aid to conflict zones with full transparency and compliance measures.
While HesabPay demonstrates how blockchain can enhance accountability in humanitarian aid, with UNHCR using it to support over 86,000 Afghan families, the Telegram Stars case shows how similar technologies can be weaponized when proper oversight is absent.
The contrast highlights a central challenge: the same features that make blockchain-based systems useful for delivering aid in sanctioned countries (speed, low fees, reduced intermediaries) can also make them attractive for illicit financing when compliance infrastructure is lacking.
Neither Telegram nor Substack responded to requests for comment on the findings, though both platforms have terms of service that prohibit use by terrorist organizations.
Telegram has faced mounting pressure from governments worldwide to improve content moderation, including the arrest of founder Pavel Durov in France in 2024 on charges related to the platform’s insufficient cooperation with law enforcement. The company has since made some moderation improvements but remains a favored platform for extremist content.
Current U.S. sanctions frameworks focus primarily on traditional financial institutions, cryptocurrency exchanges, and designated individuals. Micropayment systems and creator economy platforms have largely fallen outside this regulatory scope, creating what researchers describe as exploitable “grey areas.”
“Terrorist networks facing greater oversight will find monetization products built around creator economies more appealing while remaining under the radar as far as monitoring is concerned,” Bindner and Gluck warn.
The researchers recommend several measures for policymakers and technology platforms:
The Global Internet Forum to Counter Terrorism (GIFCT), a coalition of over 30 tech platforms working to prevent terrorist exploitation online may provide a framework for addressing these emerging threats, though micropayment systems have not been a primary focus to date.
While the amounts currently moving through Telegram Stars remain modest compared to historical terrorist financing operations, the researchers emphasize that the trend represents an important evolution in tactics.
“Terrorist organizations are increasingly struggling to maintain an online presence in an environment increasingly hostile to their activities,” the report concludes. “Micropayments and their exploitation are at an early and opportunistic stage, but they are occurring, with transactions happening on an ongoing basis.”
As financial sanctions and crypto tracking become more sophisticated, terrorist groups continue to demonstrate adaptability, migrating toward less-scrutinized systems with weaker compliance infrastructure.
The question facing counterterrorism officials and technology platforms is whether they can close these loopholes before they become the next primary channel for illicit financing.
Note: A ceasefire between Israel and Hamas took effect on October 10, 2025, bringing an end to two years of hostilities. The U.S. claims Hamas will disarm as part of this agreement. Fundraising across Hamas channels has been less pronounced since the ceasefire, which may account for reduced Star contributions in recent months.
