Stablecoins have become the payment method of choice for terror financing, and the reasons are practical. There's no exchange-rate risk to explain away, settlement takes minutes, and the value remains without fluctuating. The FATF's March 2026 targeted report on stablecoins and unhosted wallets backs this up at the industry level: terrorist financiers, money launderers, and state-linked actors have all gravitated toward stablecoins, largely through unhosted wallets that never touch a regulated intermediary. There are now over 250 stablecoins in circulation with a combined market cap above $300 billion, plenty of room for illicit value to sit alongside legitimate volume.
The role of USDT
In our own casework, we recognise the same trends. In a joint investigation with Coleven, we traced an anonymous social media fundraising account, posing as Lebanese humanitarian relief, back to Wataawanou, a documented Hezbollah front. Donations were collected in small amounts designed to stay under monitoring thresholds, and moved largely through USDT on Tron, still the dominant rail for crypto terror financing. The wider network we mapped came to roughly $90 million in cumulative on-chain value. Our research into cartel laundering methodologies shows the same mechanics on the criminal side: brokers convert cash from drug sales into USDT in small, threshold-avoiding batches before it moves up to cartel leadership. In one case we traced, a single broker's conversions ran $30,000, then $73,000, then $173,000, all cash to USDT. The same laundering accounts handled funds for the Sinaloa Cartel, Iran's IRGC, and North Korean hackers at the same time, laundering-as-a-service infrastructure open to whoever shows up with cash to convert.
It would be natural, when building a compliance program, to therefore decide to particularly pay attention to, and especially scrutinise stablecoin movements. However, there is a second trend that the industry must pay attention to.
Vigilance beyond Stablecoins remains Critical
As the pattern of stablecoin popularity gets more visible, illicit actors adapt. We're increasingly seeing terror financing activity move onto Solana, a chain that's still relatively uncommon in this kind of casework and correspondingly under-screened. In the Coleven case itself, the fundraising account published receiving addresses across five chains, including one on Solana alongside the expected USDT-on-Tron addresses, spreading exposure so that screening focused only on Tron and standard stablecoins would have missed it. We saw the same shift in a separate case with ChangeNOW, where a Hezbollah-linked, IRGC-proxy fundraising network operated entirely through Solana wallets.
The best practice takeaway is straightforward: don't build monitoring around today's dominant rail and assume it stays dominant. A program tuned only to catch USDT on Tron will miss the network that moves to Solana, or the one that avoids stablecoins altogether once it senses it's being watched. Risk scoring should treat stablecoin flows as high-signal by default, not low-risk. Wallet screening needs to cover the chains actors are moving to, not just the ones they're known for. And typology detection has to track behavior, not just the asset and chain that happened to be popular last quarter.
This is why Recommendation 15 compliance, Travel Rule enforcement, and beneficiary verification matter at NOMINIS, not as checkbox exercises, but as the controls that catch the $500 transfer and the wallet cluster behind it on day one, wherever that cluster happens to be operating.
Stablecoins are a genuine improvement in how money moves across borders, and they carry the overwhelming majority of legitimate crypto volume. But the data doesn't support treating them, or any single chain, as a fixed picture of where the risk sits. Illicit actors adapt to scrutiny. Compliance programs need to adapt with them.
.png)
