August 4, 2022 | Homeland Security Today

Profit of Hate: How Domestic Extremists Are Embracing Cryptocurrency

Enticed by the relative anonymity of cryptocurrency and the need to circumvent a denial of service, domestic extremists have been able to raise millions.
August 4, 2022 | Homeland Security Today

Profit of Hate: How Domestic Extremists Are Embracing Cryptocurrency

Enticed by the relative anonymity of cryptocurrency and the need to circumvent a denial of service, domestic extremists have been able to raise millions.

America’s domestic extremists are flocking to cryptocurrency and have raised millions of dollars from crypto donations over the last several years. Neo-Nazis, white supremacists, and other extremist figures are not new to cryptocurrency – indeed, some of these individuals were among its early adopters, and have received cryptocurrency donations since at least 2016. But this milieu has, out of necessity, more rapidly embraced cryptocurrency since the 2017 Unite the Right rally in Charlottesville, which prompted many financial services providers to deplatform certain extremist groups. This has made Bitcoin and other cryptocurrencies an attractive digital alternative for many domestic extremists.

Our research highlights three important ways that domestic extremists use cryptocurrencies. First, they receive donations from supporters for content they produce, such as video streams, podcasts, and message boards. Second, extremist groups take cryptocurrency as payment for merchandise, such as apparel, books, and accessories. In these cases, cryptocurrency payment often exists alongside more traditional payment methods, supplementing rather than supplanting credit cards, debit cards, and other forms of payment. Third, domestic extremists solicit cryptocurrency to support their operations, such as paying for legal defense, purchasing supplies (including VPNs), or providing support to a group or to individuals.

Crypto for Content

Content streams have proven to be a relatively lucrative source of cryptocurrency financing for extremists, aided by the rise of platforms such as the video streaming service DLive, the social networking site Minds, and the video hosting service BitChute. For example, as the January 6, 2021, assault on the Capitol unfolded, some of the rioters took to livestreaming it on DLive, a site popular with extremists due to its minimal moderation. Anthime “Tim” Gionet, better known by the moniker “Baked Alaska,” raked in over $2,000 from his livestream of the riot – which included him breaking into Speaker of the House Nancy Pelosi’s office. Gionet raised this amount using “lemons,” DLive’s virtual currency. DLive allows viewers to buy lemons using cryptocurrencies, including Bitcoin, Bitcoin Cash, Litecoin, Ethereum, and USD Coin. Viewers can send the lemons to streamers as tips, which the streamers can then cash out of their DLive accounts as currency.

Even before the events of January 6, Megan Squire, a computer science professor at Elon University, discovered that several known extremists were earning five to six figures annually from their DLive streams. These included, among others, Nick Fuentes, the host of the America First podcast that spreads the tenets of the white nationalist movement, and Martin Sellner of Generation Identity, an Austrian citizen who “became infamous for corresponding with” Brenton Tarrant, who killed 51 Muslim worshippers in New Zealand in 2019. (Tarrant’s video of the attack and manifesto were posted on the online message board Kiwi Farms, which itself accepts cryptocurrency donations, including Bitcoin, Litecoin, Ethereum, Monero, and Cardano.)

According to Squire, Nick Fuentes, who is also a leader of the white nationalist and antisemitic group Groyper Army, raised roughly $94,000 on DLive between April 2020 and January 2021. Fuentes also received a bitcoin donation that came out to nearly $250,000 in December 2020 from a French donor who was eventually identified as Laurent Bachelier. DLive banned Fuentes from the platform after the Capitol riot.

Other groups within the white supremacist ecosystem that solicit cryptocurrency donations include The Right Stuff (TRS), a neo-Nazi media network founded and run by Michael “Enoch” Peinovich. Peinovich’s claim to fame is creating the antisemitic “(((echo)))” meme, which other antisemitic figures began to use on social media platforms to denote Jewish names. Among the shows that TRS hosts are Fash the Nation and The Daily Shoah, which promote Holocaust denialism and white supremacy. TRS’s website solicits cryptocurrency donations in Bitcoin, Dogecoin, Bitcoin Cash, Monero, and Ethereum.

The Daily Stormer is a neo-Nazi message board and propaganda site run by Andrew Anglin with assistance from webmaster Andrew “weev” Auernheimer. Anglin was an early adopter of cryptocurrency and is known to possess at least 200 Bitcoin wallet addresses. The Daily Stormer’s name is a nod to the Nazi-era propaganda sheet Der Stürmer. The website frequently promotes neo-Nazism, white supremacy, racism, and antisemitism. Though the website publicly claims to reject violence, it posts content implicitly threatening violence against racial and ethnic minorities, including black people and Jews. The Daily Stormer previously accepted donations in Bitcoin, but now only accepts Monero – a privacy coin that claims to be virtually untraceable – due to concerns over Bitcoin’s lack of complete anonymity.

Notably, The Daily Stormer received a donation of 14.88 bitcoins in the aftermath of the Charlottesville “Unite the Right” rally – worth more than $60,000 at the time – to keep the site afloat as web service providers began to cut the site off. The amount of the donation is an explicit reference to popular white supremacist slogans. The 14 is a reference to the late white supremacist David Lane’s “14 Words”: “We must secure the existence of our people and a future for white children.” The 88 stands for Heil Hitler, with H being the eighth letter of the alphabet – thus 88 in this context denotes HH. A forensic analysis of the donation found that the sender possessed $25 million in Bitcoin.

Stormfront, another white supremacist message board, accepts donations in Bitcoin, Ethereum, and Litecoin. Like Anglin, Stormfront creator Don Black was an early adopter of cryptocurrency. Several people who have perpetrated white supremacist violence have posted on Stormfront, with the most notorious being Anders Breivik, whose July 2011 attacks in Norway claimed 77 lives.

Counter-Currents is a media outlet run by Greg Johnson that advocates for the creation of a white ethno-state. The outlet is a prolific publisher of articles, podcasts, and books, and is somewhat distinctive compared to other white nationalist outlets in its employment of an academic-type tone. Counter-Currents accepts donations in over 10 kinds of cryptocurrency, including Bitcoin, Ethereum, Litecoin, and Monero.

White Rabbit Radio is a white nationalist media platform hosted by Timothy Gallagher Murdock, who uses the pseudonym Horus the Avenger. Murdock is an advocate of the great replacement conspiracy theory, which posits that non-white immigration and race mixing are intentionally destroying the white race. The website accepts donations in Bitcoin, Monero, Cardano, Ethereum, Litecoin, and other cryptocurrencies.

Crypto for Commodities

A quick Internet search will reveal an abundance of extremist merchandise available for purchase, often with cryptocurrency. Shirts saying “6MWE” (a Holocaust reference that stands for 6 Million Wasn’t Enough) have been spotted at protests held by the Proud Boys, and an individual wearing a “Camp Auschwitz” sweatshirt was among the mob that assaulted the U.S. Capitol on January 6, 2021. Selling merchandise can help to both sustain a group financially and spread its message to a broader audience.

Merchandise also functions as a membership-identifying and membership-promoting device. As Daniel J. Rogers, co-founder and chief technology officer of the Global Disinformation Index, noted in Congressional testimony, “merchandise also acts like a team jersey for the hate groups, bolstering the narrative itself and helping the groups recruit new members.”

The Rise Above Movement (RAM) exemplifies the potential of white supremacist merchandising. RAM is an independent white supremacist group that combines skinheads’ emphasis on street fighting with slick marketing. RAM operates a merchandise and media arm dubbed Will2Rise (W2R), which sells t-shirts, accessories, stickers, bottoms, and outerwear. W2R advertises what it calls an “ethical supply chain,” proudly stating that all its products are manufactured in Eastern Europe, “so not a single hand touches the production that is not of like mind.” W2R’s merchandise can be purchased with Bitcoin, Cardano, Ethereum, Polkadot, and Litecoin.

Nick Fuentes operates an America First-themed store that accepts cryptocurrency. People wearing America First merchandise were among the mob that stormed the Capitol on January 6, 2021. The store features shirts, flags, hats, and mugs, along with a seasonal collection titled “White Boy Summer,” all of which can be purchased with Litecoin.

Crypto for Costs

Extremist groups and individuals frequently request cryptocurrency donations to pay for various costs. Such requests can be for specific uses, such as legal defense funds, but most solicitations tend not to include earmarks and function instead as donations for general support.

Jason Kessler, the organizer of the Unite the Right rally, sought cryptocurrency donations for his legal defense fund following the rally. Kessler’s website lists Bitcoin as one way to donate to the fund. One campaign for Kessler’s legal defense fund on the crowdfunding site GiveSendGo – which has also hosted fundraisers for people involved in the January 6 riot – lists Bitcoin and Monero as ways to support the fund, though Kessler’s website mentions only Bitcoin. Kessler also solicits Bitcoin donations for his “Investigative Journalism and Commentary,” claiming that “I am committed to covering dissident politics and white civil rights with my unique, take-no-prisoners style. Cancelled on both the left and right, I rely on you to fund my work.”

Douglass Mackey, a white nationalist and internet troll, also received cryptocurrency donations for his legal defense fund. Mackey was arrested in January 2021 on federal charges of disseminating disinformation intended to prevent people from exercising their constitutional right to vote. Mackey is accused of trying to bait thousands of African Americans into casting invalid votes in 2016, using social media to spread false claims that voters could avoid lines at their polling place by texting their choice of presidential candidate to a number he provided. As a result of Mackey’s disinformation campaign, “4,900 unique telephone numbers” sent messages indicating support for Hillary Clinton (whom Mackey opposed) to the number he distributed.

legal defense fund emerged for Mackey soon after his arrest. Data from Megan Squire and Hannah Gais shows that on March 11, 2021, one donor gave $58,662.50 in Bitcoin to the fund, making up most of its balance. The fund’s website also lists wallet addresses for Ethereum, Monero, Dogecoin, and ZCash.

The National Socialist Movement (NSM) bills itself as “America’s Premier White Civil Rights Organization” and advocates for Nazism in the United States. The group claims to disavow violence but has in the past called for the forceful expulsion of all non-whites from the United States. In 2017, an individual affiliated with the group tried to attack black passengers on an Amtrak train. NSM’s website accepts Bitcoin donations.

Atomwaffen Division (AWD), a neo-Nazi accelerationist group with an international membership, solicited Monero donations through a now-defunct website. AWD ostensibly disbanded in March 2020, but elements of AWD rebranded themselves as the National Socialist Order, while other individuals remain active under the AWD name. AWD has hosted paramilitary training camps in several states, featuring weapons training, physical fitness exercises, and hand-to-hand combat training.

Enhancing Privacy

As law enforcement has ramped up its investigations into domestic extremist groups, extremists have sought new ways to obfuscate their identities and make tracing cryptocurrency payments tougher.

Fiat entry and exit points – where fiat money is converted into or out of cryptocurrency – are the most vulnerable points for extremists in their attempts to couch identities. Governments have become more vigilant in applying anti-money laundering (AML) and know-your-customer (KYC) regulations to cryptocurrency exchanges, such as the Financial Action Task Force’s standards for virtual assets.

However, new methods of using and transferring cryptocurrency are eroding this barrier. As merchants begin to accept cryptocurrency as payments, extremists have less need to convert funds into fiat money to procure goods and services.

One such method is usage of privacy coins such as Monero, which incorporates advanced privacy features that are not native to Bitcoin. Monero wallet addresses are designed to be difficult to link to their owners. Monero also groups together multiple transactions to hide the movement of money, in addition to obscuring transaction amounts. One U.S. company, CipherTrace, claims to have developed a method to conduct “enhanced Monero tracing” and future protocols will likely be developed by other companies. But, for now, privacy coins remain harder to link to individuals.

Extremists have also used a tactic called mixing to further mask ownership of transactions and funds. As CoinDesk notes, a mixer is a “service where you could send your bitcoin, pay a small fee, and then receive different bitcoin than the ones that were sent.” Neither the service provider nor the individuals engaging in the transaction of exchanging cryptocurrency know the identities of those involved.

Coinjoining is another protocol that domestic extremists use to obfuscate identity. It functions similarly to mixing. Coinjoining bundles together multiple transactions to add an additional layer of anonymity. Platforms such as Wasabi and Samourai enable coinjoining. As Wasabi notes, coinjoining enables a process wherein multiple users engage in “one large transaction with multiple inputs and multiple outputs… The purpose of a CoinJoin transaction composed by multiple inputs and outputs is to break blockchain surveillance heuristics,” which examine patterns in publicly available blockchain data that may point to the identity of users.

An assessment from Europol, the European Union’s law enforcement agency, describes such mixing protocols as a “top threat” enabling the use of cryptocurrency on the dark web.

Future Extremist Uses of Cryptocurrency

It is important for policymakers to think about future extremist uses of cryptocurrency. There are two particularly important further ways that domestic violent extremists may leverage enhanced privacy features that are increasingly incorporated into certain cryptocurrencies. The first is accessing markets on the dark web to purchase illicit goods and services. The second is employing self-executing “smart contracts” to outsource criminal activities, potentially including attacks.

Many easily accessible marketplaces on the dark web sell drugs, guns, ammunition, fake passports, tools for cybercrime, and stolen personal information. In 2013, a joint FBI and Europol operation shut down Silk Road, a pioneering platform for illicit activities. The platform used Bitcoin as its sole medium of exchange. In 2017, law enforcement shut down AlphaBay, a dark web market that had grown to over 10 times the size of Silk Road.

Dark web markets continue to pop up despite law enforcement’s successes. One can find assassins and hackers for hire, weapons, deadly toxins, kidnappers, mercenaries who will torture a chosen victim, and similar goods and services (though many such services are in fact being offered by scammers). The potential for extremists to use the dark web to procure illicit goods or services and pay with cryptocurrency is clear.

Extremists may also seek to exploit emerging technologies such as smart contracts as they develop. Smart contracts are a protocol developed by Ethereum. As the International Monetary Fund (IMF) notes, a smart contract is “a computerized protocol that executes the terms of a contract.” A smart contract “thus encodes the terms of a traditional contract into a computer program and executes them automatically. With blockchain technology, smart contracts can in principle be self-executing and self-enforcing, without the need for intermediaries. They could encapsulate complex terms and conditions such as those found in many financial derivatives, which are often contingent on external events such as the prices of financial instruments or their volatility.”

Domestic extremist groups could in theory use smart contracts to sponsor terrorist attackers with little direct oversight or planning, thus outsourcing their activities. A smart contract could ensure payment to a given individual, contingent upon news indicating the completion of a certain attack. In essence, extremists could wield smart contracts as “classified ads” for attacks.

While extremists have not yet employed smart contracts, it is a threat worth mentioning – and monitoring.

Countering Violent Extremists’ Use of Cryptocurrency

Domestic extremists have migrated to cryptocurrencies to escape many limitations of traditional currency. Enticed by the relative anonymity of cryptocurrency and the need to circumvent a denial of service by more traditional financial institutions, domestic extremists have been able to raise millions of dollars through cryptocurrency platforms. To mitigate the threat that domestic violent extremists pose, there are steps the U.S. government and private sector can take to target their use of cryptocurrency.

First, the U.S. government should be more aggressive in sanctioning violent white supremacist groups as terrorist entities. Designations are one of the most powerful tools the U.S. government can deploy to reduce violent white supremacists’ fundraising capabilities. The government has designated only one white supremacist group, the Russian Imperial Movement, as a Specially Designated Global Terrorist. Designations can disrupt fundraising activities and give authorities a better understanding of extremists’ financial networks and key backers. Designations would also encourage cryptocurrency companies to disengage from designated entities.

Second, policymakers should consider enacting regulations for cryptocurrencies, including privacy coins, to more firmly bring cryptocurrencies under the regulatory perimeter. Regulations will give the cryptocurrency industry transparent guidelines for how to treat illicit activity. Regulations for privacy coins could include bolstering reporting requirements for cryptocurrency exchanges that work with privacy coins. Policymakers should also consider supporting global standards on virtual assets, such as those from the Financial Action Task Force. Harmonizing global standards and regulations on cryptocurrency across different regulatory regimes would help prevent extremists’ ability to conduct regulatory arbitrage.

Lastly, blockchain analysis firms and nonpartisan watchdog groups should establish public-private partnerships to monitor the use of cryptocurrency by domestic extremists. This collaboration would leverage both actors’ tools to produce actionable intelligence and patch information gaps. The end result of such partnerships would be greater awareness of how extremists use cryptocurrencies.

Going forward, violent extremists will only deepen their embrace of cryptocurrency and find new uses for it. Policymakers and the private sector should seek to get ahead of the threat’s evolution. Timely action will be needed to stop extremists from further profiting from their hate.

Daveed Gartenstein-Ross is the chief executive officer of the private firm Valens Global and leads a project on domestic extremism for the Foundation for Defense of Democracies (FDD). Dr. Gartenstein-Ross serves as a Senior Advisor on Asymmetric Warfare at the Foundation for Defense of Democracies and an Associate Fellow at the International Centre for Counter-Terrorism – The Hague.  Varsha Koduvayur and Samuel Hodgson are analysts at Valens Global. They support the firm’s public sector clients and FDD’s project on domestic extremism.

Issues:

Issues:

Domestic Extremism Sanctions and Illicit Finance

Topics:

Topics:

America First Credit Union Eastern Europe European Union Federal Bureau of Investigation Financial Action Task Force French Hillary Clinton Jewish people Muslims Nazism Norway Specially Designated Global Terrorist The Holocaust United States United States Capitol United States Congress