Nominis Research, in collaboration with Coleven
TL:DR
- NOMINIS, in collaboration with Coleven, a non-profit that maps the financial layer of terror networks, identified an anonymous social media account routing crypto donations toward Wataawanou, a charity widely documented as a Hezbollah front.
- NOMINIS traced the account’s published receiving addresses across five blockchains, confirming the cluster and producing indicators a compliance or sanctions team that can screen against directly . The network itself is valued at over $90m.
- One of these addresses was on Solana, a mainstream chain that rarely appears in crypto terror financing. Screening anchored to Tron, USDT, and Bitcoin would likely have missed it.
- The investigation reflects the role of charitable and humanitarian causes as core terror-financing typology, and the important of screening across all blockchains, to prevent some of the terror addresses on the more rarely used chains from falling through the gaps.
An anonymous account on X, posting humanitarian appeals for Lebanon, listed five crypto wallets for donations. Three of them looked exactly like what a sanctions analyst would expect from this kind of solicitation, whereas the fourth, an XRP address, and the fifth, a Solana address, appeared unusual.
Collaborating with Coleven, Nominis traced the cluster and tied it to a fundraising apparatus channeling money toward Wataawanou, a charity widely documented as a Hezbollah front.
Mapping the Hezbollah terror financing network
Coleven was founded to disrupt funding to organizations engaged in terrorism. It builds operational intelligence on networks, drawing on open-source research, financial analysts, corporate records, and sanctions data, then delivers actionable profiles to the institutions positioned to act on them.
Meanwhile, Nominis adds the most important aspects to terror finance disruption: the attribution of funds. In collaboration, we identified a social media account promoting a Lebanese crowdfunding apparatus, and traced the associated crypto wallets across the blockchains they were soliciting on. The result was a confirmed set of indicators that a compliance or sanctions team can ingest and act on.
It is a clean illustration of how the two functions reinforce each other: network intelligence narrows the field, and blockchain analytics confirms and operationalizes the exposure.
How the Hezbollah Crypto Fundraising Scheme Functioned
The account in question, an anonymous X profile operating as "myTruth" (@mytruth1_0), presented itself as a conduit for charitable crypto donations to Lebanon. In practice, open-source evidence indicates it was channeling funds toward Wataawanou, the "Help Each Other Association," a charity documented as a Hezbollah front. Reporting by the Alma Research and Education Center sets out the connection: the association is led by Afif Shuman, is funded through Hezbollah's Al-Qard al-Hasan financial network and Iranian sources, and uses socio-economic aid to extend the group's local influence, with field structures reportedly coordinated alongside Hezbollah units.
The fundraising mechanics matched that profile. The account directed donors to a campaign ("Embrace Lebanon 24") hosted on fundahope.com, a crowdfunding platform operated by WILLING Joint Stock Company out of Lebanon, and instructed contributors to annotate their donations with the note "wata3awanou" so funds could be routed to the association. Its posts mixed humanitarian framing with overt pro-Hezbollah media, including content built around a Muharram food-distribution campaign.
The open-source record places total crypto volume across the listed wallets in the tens of thousands of dollars. Modest in absolute terms, but exactly the kind of low-profile, retail-scale solicitation that slips past transaction monitoring calibrated for larger flows.
Nominis assesses the wider on-chain network behind this fundraising activity at roughly $90 million in cumulative value. The donation wallets themselves handled only tens of thousands, which is exactly the point. Small, low-profile solicitation can sit on top of a far larger financial apparatus, and the modest size of any single address is a feature of the method rather than a measure of the network behind it.
Tracing the crypto wallets across Five Blockchains
The account published receiving addresses across five assets. Nominis traced each as part of confirming the cluster. Three of them sit comfortably inside the patterns a sanctions analyst would expect. The fourth and fifth, a XRP and a SOL address, was highly unusual.
The USDT-on-Tron address maps onto the dominant crypto terror financing rail of the past few years.
Across 2025, the overwhelming majority of stablecoin addresses frozen for illicit activity sat on Tron, and during the June 2025 enforcement wave specifically tied to terror financing, roughly 90% of the flagged addresses were on Tron.
A USDT-TRC-20 donation address is essentially an expected finding.
Why Solana in Terror Financing Matters
The Solana address is the one that should give a screening team pause. Solana is a mainstream, high-volume settlement chain, increasingly a carrier for stablecoin payments, yet it remains uncommon in crypto terror financing casework. Elliptic, which has documented terror financing across more than thirty assets, has noted that Solana surfaces only in isolated cases rather than as a standard rail. When a fundraising network explicitly lists a Solana address alongside the usual ones, it signals that the operators are willing to receive value on blockchains their monitored counterparts may not be watching as closely.
Nominis assesses that this is a highly durable takeaway.
Screening coverage implicitly anchored to Tron, USDT, and Bitcoin will catch the bulk of activity, but it leaves gaps on exactly the blockchains an adaptive actor reaches for next. Mainstream adoption cuts both ways: the same low fees and fast settlement that make Solana attractive for legitimate payments make it attractive for a charity front collecting small donations at scale. A chain being reputable and widely used is not a reason to deprioritize it in coverage. It can be the reason an indicator is missed.
What does this finding mean?
A few practical points now follow.
First, multi-chain coverage is not optional. A network that solicits across five blockchains only needs one un-watched rail to keep moving value, so screening that stops at the chains where illicit activity has historically concentrated will reliably under-count exposure.
Second, charity and crowdfunding fronts remain a core terror-financing typology, and they are built to look benign. The humanitarian framing, the legitimate-looking crowdfunding host, and the small per-donation amounts are features of the method, not signs of innocence. Name-level intelligence of the kind Coleven produces is often what separates a genuine relief campaign from a front, which is why pairing it with on-chain tracing matters.
Third, addresses are perishable but worth ingesting now. The indicators above can be screened immediately, and the cluster they belong to can be monitored for new deposit addresses as the operators rotate them.
Finally, since terror financing networks adapt faster than static lists, the value of work like this collaboration cannot be overstated. It is cooperation like this that closes the gap between identifying a network and being able to act on it before funds move.
All research content and accompanying reports are provided for informational purposes only and should not be relied upon as professional advice. Accessing these materials does not create any professional relationship or duty of care. Readers are encouraged to consult appropriately qualified professionals for guidance. We uphold the highest standards of accuracy in all the information we provide. For any questions or feedback, please contact us at contact@nominis.io.
.jpg)
.png)