Binance, TRM Labs provided key intel in ISIS members’ arrest

The joint investigation with Tajikistan authorities resulted in the arrest of individuals connected to a regional ISIS affiliate

article-image

Dushanbe, Tajikistan’s capitol; Source: Ronan Shenhav/Shutterstock, modified by Blockworks

share

Binance said its investigative team aided in capturing ISIS-linked individuals in Tajikistan and Turkey.

The crypto exchange said it played a role in the arrest of several individuals linked to the Islamic State Khorasan Province (IKSP), an affiliate of the broader militant group, including ranking member Shamil Hukumatov.

“These ISKP members were actively involved in imminent attack planning, and their arrests are regarded as a huge win for counterterrorism efforts both regionally and globally,” Binance said in a blog on Friday. 

Since Dec. 2022, Tajikistan’s Financial Monitoring Department and TRM Labs collaborated with the exchange to mitigate risks from the IKSP, the blog said.

Additional agencies from Tajikistan, like the State Committee for National Security, also participated in the operation.

Tigran Gambaryan, head of financial crime at Binance, told Fortune that the probe entailed scrutinizing a Telegram channel frequented by ISIS affiliates and subsequently identifying the cryptocurrency wallet a terrorist leader used for receiving donations.

A Binance spokesperson told Blockworks that the company’s investigations team members perform routine open-source threat intelligence scans. 

“It was during these routine scans that this particular Telegram group was identified,” they added.

Nonetheless, specifics about how Binance managed to locate the individual were not disclosed.

A spokesperson for the Financial Monitoring Department said that intelligence and investigative assistance from Binance was instrumental in advancing its counterterrorism efforts.

“This led to successful arrests of key ISKP members that we’ve been targeting for a while now,” the spokesperson added.

The move highlights Binance’s involvement in collaborating with law enforcement to track down crypto assets related to organized crime.

Markus Thielen, Matrixport’s research chief, noted that Binance has cooperated with law enforcement on multiple occasions to halt illicit activities and identify the individuals responsible for such transactions.

He expects illicit activities to shift to mixers and decentralized exchanges.

“The result will likely be that more of those illicit activities will move to mixers, such as Tornado Cash, and other decentralized exchanges,” he told Blockworks.

Tornado Cash was sanctioned by the US Treasury last year, meaning that US residents are prohibited from dealing with the crypto mixer.

Binance has previously faced allegations of circumventing legal frameworks, including claims that it bypassed US sanctions to permit trading for customers in Iran and Russia. Additionally, reports suggested the exchange enabled users in China to evade local regulatory barriers.


Get the news in your inbox. Explore Blockworks newsletters:

Tags

Upcoming Events

Old Billingsgate

Mon - Wed, October 13 - 15, 2025

Blockworks’ Digital Asset Summit (DAS) will feature conversations between the builders, allocators, and legislators who will shape the trajectory of the digital asset ecosystem in the US and abroad.

Industry City | Brooklyn, NY

TUES - THURS, JUNE 24 - 26, 2025

Permissionless IV serves as the definitive gathering for crypto’s technical founders, developers, and builders to come together and create the future.If you’re ready to shape the future of crypto, Permissionless IV is where it happens.

Brooklyn, NY

SUN - MON, JUN. 22 - 23, 2025

Blockworks and Cracked Labs are teaming up for the third installment of the Permissionless Hackathon, happening June 22–23, 2025 in Brooklyn, NY. This is a 36-hour IRL builder sprint where developers, designers, and creatives ship real projects solving real problems across […]

recent research

Unlocked by Template (7).png

Research

Union’s improvements upon Tendermint consensus through CometBLS, coupled with ZK proving through Galois, allow for a broadly scalable, cost efficient, and low latency IBC implementation that is feasibly scalable across every existing blockchain, virtual machine and runtime. The implementation offers modular crosschain interoperability without the need for trusted intermediaries.  

article-image

Kraken’s chief security officer Nick Percoco said the exchange turned the tables on a North Korean hacker

article-image

Or is it approximately the least cypherpunk thing we could do?

article-image

Over 20% of SOL-USD swap volume goes through SolFi

article-image

CEO Vlad Tenev calls expected clarity on listing crypto asset securities “a big opportunity”

article-image

Big Tech pulled US indexes back into the green Thursday, as investors waited for two more Mag 7 first-quarter reports after the bell

article-image

Charts and takeaways from Tuesday’s jobs report and Wednesday’s GDP print, as the economy digests the tariff war