TLDR: An Iranian-owned money transfer service operating in Afghanistan claimed it did not handle cryptocurrency. Later, it was revealed it was indeed involved in cryptocurrency after referring to a contact whose wallet had exposure to exchanges in Iran, an Iranian-owned exchange in Canada, and terror financing.
These findings are part of a wider, ongoing Nominis investigation into informal finance across the Middle East and beyond.
The Importance of HUMINT in Terror Financing Investigations
Through HUMINT operation, the Nominis Intelligence team were able to establish contact with an Iranian-owned money transfer service, operating in Afghanistan.
While the service stated it did not conduct cryptocurrency transactions, they referred analysts to a contact engaged in crypto-based transfers. Subsequent on-chain analysis of this contact’s USDT (TRC20) wallet, TW*****oi, identified exposure to Iran-based exchanges including Nobitex, Aban Tether, Efex, Wallex, an Iranian-owned exchange in Canada, and terror financing.
As part of the US’s campaign ‘Economic Fury’, OFAC designated Nobitex and Wallex on 2 June 2026. Meanwhile, Aban Tether was sanctioned 2 months later, on 7 August 2026.
The contact also had exposure to the exchange in Canada, demonstrating that this network was not limited to the Middle East.
Why Informal Money Transfer Thrives in Afghanistan
Cryptocurrency has developed a limited but increasingly significant role in Afghanistan's financial ecosystem, particularly since the Taliban returned to power in August 2021.
The disruption of the formal banking system, shortages of physical currency and reduced international banking relationships created demand for alternative ways to transfer and store value. Some Afghans have used cryptocurrency for savings and remittances, while blockchain-based systems have also been used for humanitarian payments.
Hawala is central to the discussion because it has long been the main way money moves in Afghanistan. It is a traditional, trust-based system of value transfer run by networks of brokers (hawaladars), and it grew up alongside very limited formal finance: only around 15 percent of Afghans had access to bank accounts and formal financial services . Since 2021, the banking disruption has pushed more Afghans towards hawala, so cryptocurrency is entering a landscape where informal transfer was already the norm.
Terrorist Organizations and Their Use of Crypto
The Taliban authorities have taken measures against cryptocurrency trading, including reported closures of cryptocurrency businesses and arrests of dealers.
These restrictions make Afghanistan's domestic cryptocurrency market difficult to measure. Some activity may therefore occur through informal or less visible channels.
The lack of reliable public data means that estimates of the overall size of Afghanistan's cryptocurrency economy should be treated cautiously.
U.S. Treasury reporting states that ISIS-K, which is also operational in Afghanistan, has increased its understanding and use of virtual assets. Treasury also notes that ISIS continues to rely extensively on traditional mechanisms, including cash and hawala.
ISIS-K views the Taliban as insufficiently hard-line, accusing them of abandoning global jihad, engaging in-house nationalism centered strictly on Afghanistan, and compromising with regional and international powers. Conversely, the Taliban views ISIS-K as a dangerous internal threat to their monopoly on power and governance.
In a specific Afghanistan-linked example, The Treasury reported that since late 2021 an ISIS network based in Somalia had sent funds to Afghanistan, using a range of mechanisms including virtual-asset service providers and hawalas. The Treasury assessed that ISIS-K was also storing some funds in virtual assets.
This demonstrates that virtual assets and hawala can exist within the same financial network rather than functioning as separate systems.
Civilian Use
Cryptocurrency and blockchain technology have also been used for legitimate purposes.
UNHCR has used HesabPay, an Afghan payment provider built on the Algorand blockchain, to deliver humanitarian assistance in Afghanistan. The system can use prepaid cards and digital payment infrastructure to provide assistance where conventional banking access is limited.
UNHCR's current Afghanistan information also confirms that cash assistance can be provided through HesabPay prepaid cards, which can be used at ATMs, point-of-sale terminals and agent locations.
This demonstrates that blockchain-based financial infrastructure has applications beyond cryptocurrency trading and illicit finance.
Why Compliance Teams Should Care
In this case, sanctions and terror-financing exposure sat behind a business that presented themselves as the somewhat ‘normal standard’ for informal money transfer operators, and denied any crypto use.
Compliance teams are unlikely to deal with these businesses directly, but can still receive funds from wallets connected to their network. The standout lesson is the value of HUMINT: on-chain data showed the exposure, but only human intelligence could reveal who is behind it, and real-world associations such as the relationship between the money transfer service, and the contact.
On its own, TW*****oi is an anonymous TRC20 address. On-chain analysis shows where its funds come from and where they go, but not who controls it or what business it serves. HUMINT engagement supplied that context, tying the wallet to an Iranian money transfer operation in Afghanistan. Without it, the exposure would be visible but unexplained, and the businesses behind it would remain hidden behind their denial.
Nominis Assessment
Nominis assesses that Iranian-linked money transfer operators in Afghanistan are using USDT to move value outside the formal banking system, and that this activity connects them to exchanges now under US sanctions.
This case is unlikely to be isolated; operators that deny crypto use, work only through messaging apps and keep no public footprint can still sit one hop from sanctioned Iranian exchanges and terror financing. By the time a designation lands, that exposure is often already on a firm's books.
The bottom line is that on-chain analysis alone would not have uncovered this network. It took HUMINT to connect a business that denies using crypto to the wallet behind its transfers.
Nominis combines human intelligence with on-chain analysis to flag these links before they become a compliance problem. Through wallet screening, transaction monitoring and forensic investigations, Nominis helps compliance teams be first to flag and first to know.
Talk to our team to find out more.
All research content and accompanying reports are provided for informational purposes only and should not be relied upon as professional advice. Accessing these materials does not create any professional relationship or duty of care. Readers are encouraged to consult appropriately qualified professionals for guidance. We uphold the highest standards of accuracy in all the information we provide. For any questions or feedback, please contact us at contact@nominis.io.
