In December 2025, Australia was shaken by a horrific antisemitic attack on Bondi Beach, in Sydney, that claimed 15 lives and sent shockwaves through Jewish communities worldwide. While the investigation remains ongoing, Australian and international officials have publicly indicated that they are examining the potential involvement of Iran and their proxies, raising difficult questions about how foreign terror networks may be operating, directly or indirectly, on Australian soil.
This attack did not take place in isolation. Australian authorities have confirmed that two arson attacks targeting a Melbourne Synagogue, and Kosher restaurant, in December 2024, were carried out by operatives linked to Iran, allegedly acting under the direction of the Islamic Revolutionary Guard Corp. These cases established that hostile state-linked actors were willing, and able, to conduct antisemitic, deadly violence, inside Australia.
Together, these incidents point to a deeply concerning pattern. Australia is not merely a distant observer of Middle Eastern conflict dynamics, but may be increasingly exposed as an operational and financial environment exploited by terrorist and proxy networks.
From our perspective, cryptocurrency and Australian financial infrastructure play an under-examined, but integral role in this threat landscape.
The Flotilla Networks: Humanitarian Messaging, Convert Financing
One part of this ecosystem appears to revolve around a network of activist organisations publicly promoting the “humanitarian flotilla” missions aimed at ‘breaking the blockade on Gaza’. The hub of these organizations appear to fall under the Global Sumud Flotilla, established in July 2025, which encompasses several interlinked groups, including
- Global March to Gaza,
- Maghreb Sumud Flotilla,
- Freedom Flotilla Coalition,
- Sumud Nusantara
Some of which have existed since 2005 or earlier.
These organisations publicly frame their activities as human initiatives and actively encourage activists to join local communities to support missions logistically and financially. However, their internal coordination mechanisms raise serious red flags.
The Freedom Flotilla Coalition was founded by Zaher Birawi, who is also the chairman of the International Committee for Breaking the Siege of the Gaza Strip. Birawi is affiliated with Hamas and the Muslim Brotherhood, and holds connections with other umbrella networks known for channeling funds to Hamas.
Communication across these groups is largely conducted via Telegram, with separate national channels that reportedly take direction from a central international steering committee.
In the Australian context, the Global Movement to Gaza Australia Telegram group is reportedly owned and administered by Saif Abukeshek, a member of the Global Sumud Flotilla Steering Committee, and a confirmed Hamas operative.
Public fundraising campaigns for the Global Sumud Flotilla, Freedom Flotilla Coalition, and Global March to Gaza accept bank transfers and credit card payments, while intelligence sources indicate that cryptocurrency donations are accepted privately, including from members of the Australian flotilla community.
This dual-track fundraising model, with public humanitarian messaging paid with private crypto-based transfers, mirrors patterns previously observed in terror-financing cases globally.
Crypto, by design, allows rapid cross-border value transfer with limited frictions, making it an attractive tool for networks seeking to avoid scrutiny or detection.
Iran and Australian Exchanges
The second dimension of concern relates to Iran’s broader use of cryptocurrency to move funds internationally, and the use of Australian financial infrastructure to do so.
Iran faces severe restrictions in accessing traditional financial systems, due to sanctions. As a result, cryptoassets have increasingly been used to move money to proxy operatives, such as Hamas, Hezbollah, and the PIJ, as well as aligned groups abroad.
Intelligence and compliance investigations have demonstrated that Australian crypto exchanges have, in multiple instances, been used as transit points, enabling funds to be converted, layered and redistributed beyond Iran’s borders.
Australia presents uniquely attractive jurisdictions for illicit crypto movement. It combines a mature banking system, a growing digital asset sector, strong global connectivity and historically uneven enforcement of crypto compliance with constant regulatory changes. For threat actors, this creates an environment where funds can be quietly received, exchanged and re-routed with less immediate scrutiny than in higher-risk or heavily monitored jurisdictions.
The NOMINIS platform recognised Iranian linked terror and broker funds, including from IRGC-associated services and an Iranian exchange, flowing both indirectly and directly into accounts held at Australian crypto exchanges. This underscores the role of domestic infrastructure in cross-border risk exposure.
The below screenshot from the NOMINIS platform demonstrates terror funds from IRGC-linked services sent indirectly to an account held in an Australian Exchange. The technique of indirectly moving funds is common among terror actors, as this obfuscates the flow of assets moving.
A following screenshot below shows funds from Iranian Brokers sent directly to an account held in Australian Crypto Exchange.
Finally we can recognise funds from an Iranian Exchange, sent directly to an account held in Australian Crypto Exchange.
While it remains that there is no existing evidence connecting these specific Iranian transactions to the attack that took place on Bondi Beach, this is a red flag for compliance that should be investigated further.
It can be said with certainty that without robust AML/CTF frameworks in place, blockchain monitoring, and intelligence-sharing, Australia risks further becoming an unwitting node in global terror-financing networks.
Narrative Warfare and Normalisation of Antisemitic Violence
Compounding the financial threat is a growing narrative trend across parts of global media and online discourse : the framing of deadly antisemitic attacks as an inevitable response as a result of Israel’s military actions during the course of the Israel Gaza war.
This framing obscures a more troubling reality. Designated terrorist organisations and their state sponsors are actively shaping narratives, mobilizing activists, and exploiting humanitarian language to legitimize violence against Jewish targets worldwide. These efforts are not spontaneous, they are organised, funded and strategically coordinated.
When groups, using ‘humanitarian language’ with documented links to Hamas or Iran, are able to fundraise, recruit and operate inside democratic societies, using modern financial tools and permission digital platforms, the risk extends far beyond any single attack.
A call for Infrastructure Level Accountability
The tragedy at Bondi Beach should serve as a wake-up call. Terror-financing today does not rely solely on suitcases of cash, or opaque offshore banks. It flows through crypto wallets, messaging apps, networks with ‘humanitarian’ goals, and lightly regulated financial infrastructure.
Australia has the regulatory capability, technological expertise and intelligence partnerships required to address this threat, but only if the problem is acknowledged and the solution is enforced in full.
Ignoring the financial and infrastructure dimension of modern terror networks does not make them disappear - it only ensures that a future attack does not come as a surprise.
All research content and accompanying reports are provided for informational purposes only and should not be relied upon as professional advice. Accessing these materials does not create any professional relationship or duty of care. Readers are encouraged to consult appropriately qualified professionals for guidance. We uphold the highest standards of accuracy in all the information we provide. For any questions or feedback, please contact us at contact@nominis.io.
.jpg)