Coins for Bombs: The Predictive Ability of On‐Chain Transfers for Terrorist Attacks

• Published date: 01 May 2022
• Author: DAN AMIRAM,BJØRN N. JØRGENSEN,DANIEL RABETTI
• Date: 01 May 2022
• DOI: http://doi.org/10.1111/1475-679X.12430

DOI: 10.1111/1475-679X.12430

Journal of Accounting Research

Vol. 60 No. 2 May 2022

Printed in U.S.A.

Coins for Bombs: The Predictive

Ability of On-Chain Transfers for

Terrorist Attacks

DAN AMIRAM,∗BJØRN N. JØRGENSEN,†

AND DANIEL RABETTI∗

Received 30 November 2020; accepted 3 March 2022

ABSTRACT

This study examines whether we can learn from the behavior of blockchain-

based transfers to predict the f‌inancing of terrorist attacks. We ex-

ploit blockchain transaction transparency to map millions of transfers for

∗Coller School of Management, Tel Aviv University; †Copenhagen Business School and

Hanken School of Economics

Accepted by Luzi Hail. We are grateful to an anonymous reviewer,Sanjay Banerjere,John

Barrios, Thomas Bourveau, Marie Briere (discussant), Brian Burnett, Hans Christensen, Atif

Ellahie, Vivian Fang, Sivan Frenkel, Jeffrey Hoopes, Eva Labro, Christian Leuz, Shai Levi,

Tsafrir Livne, Evgeny Lyandres, Daniele Macciocchi, Mark Maffett, Maximilian Muhn, Jacob

Oded, Kasper Regenburg, Steve Rock, Sugata Roychowdhury, David Schoenherr (discussant),

Daniel Scott Cohen, Harald Uhlig, TsahiVersano, Regina Wittenberg Moerman, Avi Wohl, An-

drew Wu (discussant), Anastasia Zakolyukina, Yanlei Zhang, Peter Zimmerman (discussant),

and participants at the 2021 Journal of Accounting Research Conference, International Associ-

ation for Quantitative Finance (IAQF), 7th Fin-Fire Conference on Challenges to Financial

Stability, Crypto and Blockchain Economics Research Conference, 3rd Bergen FinTechCon-

ference, 4th Shanghai-Edinburgh Fintech Conference, 6th Fintech International Conference,

U.S. Department of the Treasury, Copenhagen Business School, and Tel Aviv University, for

invaluable comments. We thank WhiteStream for providing intel on the Sri Lanka Easter

bombing and DeepSeek for additional insights into terrorist operations on the dark web.

The authors are thankful to the Henry Crown Institute, the Danish Finance Institute, and

the Coller Blockchain Research Institute for f‌inancial support. An online appendix to this

paper can be downloaded at http://research.chicagobooth.edu/arc/journal-of-accounting-

research/online-supplements.

March 2022

427

© 2022 The Authors. Journal of Accounting Research published by Wiley Periodicals LLC on behalf of The

Chookaszian Accounting Research Center at the University of Chicago Booth School of Business.

This is an open access article under the terms of the Creative Commons

Attribution-NonCommercial-NoDerivs License, which permits use and distribution in any medium,

provided the original work is properly cited, the use is non-commercial and no modif‌ications or

adaptations are made.

428 d. amiram, b. n. jørgensen, and d. rabetti

hundreds of large on-chain service providers. The mapped data set permits

us to empirically conduct several analyses. First, we analyze abnormal transfer

volume in the vicinity of large-scale highly visible terrorist attacks. We docu-

ment evidence consistent with heightened activity in coin wallets belonging

to unregulated exchanges and mixer services—central to laundering funds

between terrorist groups and operatives on the ground. Next, we use foren-

sic accounting techniques to follow the trails of funds associated with the Sri

Lanka Easter bombing. Insights from this event corroborate our f‌indings and

aid in our construction of a blockchain-based predictive model. Finally, using

machine-learning algorithms, we demonstrate that fund trails have predictive

power in out-of-sample analysis. Our study is informative to researchers, reg-

ulators, and market players in providing methods for detecting the f‌low of

terrorist funds on blockchain-based systems using accounting knowledge and

techniques.

JEL codes: G15, G18, G29, K29, K42, M40, M41, O16

Keywords: transparency; terrorist f‌inancing; economics of blockchain;

forensic accounting; bitcoin

Right now, large parts of the f‌ield of crypto are sitting astride of—not

operating within—regulatory frameworks that protect investors and con-

sumers, guard against illicit activity, ensure for f‌inancial stability, and yes,

protect national security.

–Gary Gensler (August 2021), chair of the U.S. Securities and Exchange

Commission

1. Introduction

In recent years, international money transfers through blockchain-based

currencies have grown signif‌icantly.1The proliferation of cryptocurrencies

has had two opposing effects related to the transparency of the interna-

tional money-transfer system. On the one hand, governments, f‌inancial

institutions, and market regulators invest hundreds of millions of dollars

and numerous person hours in curtailing illegal transfers through the tra-

ditional f‌inancial system (Belasco et al. [2018]). Cryptocurrencies and, in

particular, Bitcoin, the most popular cryptocurrency, may enable criminals

to circumvent these efforts. On the other hand, fund transfers that used to

be known only to the involved parties are now transparent to anyone with

technical knowledge of the blockchain system and the ability to analyze

information in public blockchain ledgers (ICAEW [2018]). The increased

transparency of transfers may help outsiders identify and predict illicit ac-

tivities by monitoring abnormal transactions.

1As of February 2022, more than 17,000 crypto assets (e.g., blockchain-based currencies)

are listed in more than 450 crypto exchanges across the globe, totaling 1.7 trillion dollars in

market capitalization (https://coinmarketcap.com/).

coins for bombs429

This study examines whether we can learn from the behavior of

blockchain-based transfers in the vicinity of large-scale, highly visible

terrorist attacks to predict similar events.2Many Bitcoin transfers have been

attributed to illegal activities (Foley, Karlsen, and Putnins [2019]), and

cryptocurrencies can be used by terrorists for donation campaigns (Irwin

and Milad [2016], Dion-Schwarz, Manheim, and Johnston [2019]). As the

analysis of donation campaigns (i.e., transfers between donors and terror-

ist organizations) depends on leaked addresses, our focus is on terrorist

attacks (i.e., transfers between the terrorist organization and operatives on

the ground), which do not require foreknowledge of terrorist wallets. The

transparency of the blockchain system suggests that it may be possible to

identify transfers associated with terrorist attack f‌inancing. Financing at-

tacks require intense money laundering, entailing abnormal volume in the

vicinity of an event as a potential proxy for terrorist f‌inancing.3Our meth-

ods may help outsiders detect funds associated with terrorist attacks and,

perhaps more importantly, help them predict these events.4

Additional considerations motivate this study. First, the rise of blockchain

analytics provides several avenues for academic research. Fund transfers on

the Bitcoin blockchain are in the public domain and can be traced back

to wallets.5With the development of deanonymizing algorithms, such as

the one we employ here, it is possible to connect additional addresses by

checking whether a known address co-spent with other addresses on the

chain.6At the end of the mapping, we account for thousands of addresses

at the users’ wallet level, their respective balances at a given point in time,

and the f‌low of funds throughout time. As a result, blockchain-mapped

data provide a unique setting for the analysis of transfers and participants’

interactions.7

2Our study focuses on Bitcoin, as it is the most liquid and used public blockchain-based

cryptocurrency. Bitcoin recently surpassed 1 trillion dollars in total market capitalization, has

more than 18 million units in circulation, and over half a billion transactions since its incep-

tion in 2009 (see Nakamoto [2008] for a detailed description of the Bitcoin protocol).

3We use the term “vicinity” as a measure of chronological closeness (i.e., the days surround-

ing the date of the event).

4This method may be applied to other illicit activities, such as laundering funds for tax

evasion, f‌inancing political unrest, and large-scale purchases of goods (e.g., weapons) on black

markets.

5Wallet owners are anonymous (although their activity/fund transfers are public), except

for some wallet owners who reveal their identity willingly or by accident. For instance, we focus

on users that are business entities in the chain. These users willingly provide wallet addresses

to their clients.

6By co-spending, we mean that two or more addresses share the same input in one trans-

action, which suggests that they belong to the same user. See subsection 3.1 for more details.

Moreover, the computer science literature develops ref‌ined techniques that allow parties to

identify users’ IP addresses in some cases (e.g., Kang et al. [2020]). Because users’ identities

may be revealed through these techniques, Bitcoin is considered pseudo-anonymous.

7Unlike in public blockchain systems, in traditional banking fund transfers are opaque

to outsiders, including to a large extent, regulators. Additionally, even regulators generally