Media outlets find crypto wallet of ISIS Tajikistan wing used to transfer payment for terrorist attack in Moscow Oblast

Journalists of the Russian opposition publication Vazhnye Istorii (Important Stories) have found a cryptocurrency wallet belonging to the Tajik wing of the ISIS terrorist group Wilayat Khorasan via Telegram. Immediately after the attack in Moscow Oblast, $2,525 was withdrawn from it. Those detained as suspects in the attack said that they managed to receive the same amount on their cards. 

Source: Vazhnye Istorii 

Details: Vazhnye Istorii discovered a whole network of Telegram chats. A number of facts point to their affiliation with the Tajik wing of the ISIS terrorist group Wilayat Khorasan. 

In the chats, Islamic State supporters communicate with each other in illiterate Tajik, as noted by a native speaker, using a mixture of slang that is incomprehensible to a native speaker. ISIS adherents use Tajik with a mixture of Russian, Farsi and Arabic. In these communities, they listen to online sermons from people who associate themselves with Wilayat Khorasan. 

After his detention on 23 March, Fariduni, a defendant in the Crocus terrorist attack case, said that he had been listening to sermons on Telegram, after which an unknown person contacted him, proposed that Fariduni commit mass murder and paid him 250,000 roubles out of the promised 500,000. 

In early March, a participant in a similar chat room, which is likely to be used for recruiting militants, posted a link to collect cryptocurrency to help the "families of prisoners" (i.e. ISIS terrorists in custody). He later deleted his Telegram account. The channel itself is broadcast in Russian and Tajik, and Russian-language Islamist propaganda is also being published there. 

The USDT wallet was created on 14 March at 10:24 Moscow time. The first tranche of $550 was received immediately after creation, and subsequent tranches of $325, $550 (twice) and $1,100, respectively (for a total of $2,525), were received and withdrawn on the day of the attack, 22 March, between 07:20 and 18:55 UTC (10 to 21:55 Moscow time). These sums were withdrawn to the wallet TU4vEruvZwLLkSfV9bNw12EJTPvNr7Pvaa, which is officially declared as a wallet provided by ByBit, one of the few crypto exchanges still operating in Russia. 

The official version of the Investigative Committee indicated that the militants left the Crocus concert hall at 20:11. Traffic camera data also shows that the suspects were detained at around 00:00. This means that the funds were withdrawn during this period. On the same day, the wallet's activity stopped. 

Vazhnye Istorii notes that interrogations of the detainees did not mention any connection with Ukraine. Given that the transactions of the Wilayat Khorasan militants were carried out through the ByBit exchange, even the receipt of funds from Ukraine to the accounts of the accused cannot be considered evidence of Ukraine's involvement. 

At the same time, the journalists noted that Russian security agencies probably have the technical and operational capabilities to identify the person and the wallet from which the funds were transferred. 

Background: 

• On 28 March, Russia's Investigative Committee (IC) said it received "evidence" that the attackers on the Crocus City Hall concert hall were linked to "Ukrainian nationalists".
• On 26 March, after Kremlin leader Vladimir Putin accused "those fighting against Russia at the hands of the Kyiv regime" of being responsible for the shooting at the Crocus City Hall, Nikolai Patrushev, Secretary of the Security Council of the Russian Federation, stated that Ukraine and not ISIS was behind the terrorist attack on 22 March.
• Defence Intelligence of Ukraine has stated that Russia was aware of the impending terrorist operation near Moscow but allowed it to take place due to the "struggle between towers of influence," or a lack of understanding of the scope of the attack.
• Alexander Lukashenko, the self-proclaimed President of Belarus, stated that the terrorists who managed to flee after the attack on the Russian Crocus City Hall intended to enter Belarus but "turned around" due to the security measures implemented and went to the Ukrainian-Russian border instead.
• As of Wednesday, 28 March, the Russian Emergencies Ministry published a list of the dead, which included 143 names.

Support UP or become our patron!