Key Highlights
- Uttar Pradesh ATS arrested 19-year-old BDS student Haarish Ali from Moradabad for allegedly operating an ISIS-linked online module with cross-border crypto connections.
- Investigators allege the accused engaged in cryptocurrency transactions with handlers in Pakistan, Afghanistan, and Turkey, using encrypted apps like Session and Discord.
- The arrest follows India’s recent PRAHAAR counter-terror strategy and comes amid growing global concern over ISIS affiliates using stablecoins and privacy coins for fundraising.
India’s law enforcement agencies have once again flagged the intersection of cryptocurrency and terror financing after the Uttar Pradesh Anti-Terrorism Squad (ATS) arrested a 19-year-old dental student for allegedly operating a digital module linked to the Islamic State of Iraq and Syria (ISIS).
The accused, identified as Haarish Ali, is a second-year Bachelor of Dental Surgery (BDS) student and a resident of Saharanpur district. He was picked up from Moradabad on Sunday during an ongoing probe into ISIS-linked online networks operating within India.
According to a statement from the ATS, the student was not only pursuing his medical studies in Moradabad but was also actively working as part of an ISIS-linked online network, coordinating with handlers based in Pakistan and several other countries.
What makes this case particularly relevant for the crypto space is the reported involvement of cryptocurrency transactions in the module’s cross-border operations, adding yet another data point to the growing body of evidence that digital assets are being exploited by terror networks operating out of South Asia.
Encrypted apps, VPNs, and crypto: How the module operated
According to investigators, the UP ATS had been receiving intelligence inputs suggesting that certain individuals across multiple Indian states were working as active members of an ISIS-linked module. A case was registered in January 2026 at the ATS Police Station in Lucknow under Sections 148, 152, and 61(2) of the Bharatiya Nyaya Sanhita as well as Sections 18, 18-B, and 38 of the Unlawful Activities (Prevention) Act.
Officials said Ali allegedly created multiple ISIS-backed groups on social media platforms, including Instagram, and on encrypted messaging apps such as Session and Discord. He reportedly used VPNs to mask his identity while running these groups, through which he circulated propaganda content sourced from ISIS media outlets, including the organization’s magazine Dabiq and its news outlet Al-Naba.
The ATS further alleged that Ali had set up his own propaganda outfit, titled ‘Al-Ittihad Media Foundation,’ to expand ISIS’s ideological reach within India. Through these groups, he is accused of attempting to recruit like-minded individuals and inciting people to carry out attacks.
But the part that puts this case squarely in crypto territory is the alleged use of digital asset transactions for cross-border coordination. As per a report from the Times of India, the student was engaged in cryptocurrency dealings with contacts in Pakistan, Afghanistan, and Turkey, three countries that have repeatedly appeared in global terror financing investigations involving digital assets.
Why the crypto angle matters
The involvement of cryptocurrency in this case is not an isolated red flag. It fits into a well-documented pattern of ISIS affiliates leveraging digital assets for fundraising and operational financing, particularly through the ISKP (Islamic State Khorasan Province) network that operates across Afghanistan and Pakistan.
Blockchain analytics firm TRM Labs has tracked hundreds of transactions linked to ISKP, ranging from $100 to $15,000 per transfer, predominantly using Tether (USDT) on the Tron network. In one case alone, a pro-ISIS fundraising campaign in Tajikistan raised approximately $2 million in USDT during 2022. Turkey, in particular, has emerged as a key transit point where cryptocurrency is converted to cash before being smuggled into conflict zones.
Just last December, Mohammed Azharuddin Chhipa, a Virginia-based individual, was convicted in the U.S. for sending over $185,000 in cryptocurrency to ISIS through intermediaries in Turkey. He used platforms like Coinbase and Binance to convert cash into crypto before routing the funds abroad. The case exposed how regulated exchanges can inadvertently become part of the pipeline when proper screening fails.
India’s evolving crackdown on crypto-linked terror financing
The arrest comes at a time when India’s security apparatus is actively sharpening its focus on the crypto-terror financing nexus. In February 2026, the Ministry of Home Affairs released its PRAHAAR counter-terrorism strategy, which specifically highlighted the growing use of crypto wallets and blockchain by terror networks.
The strategy cited a 2023 NIA investigation where funds linked to an ISIS-inspired module were traced through a WazirX account before being routed to Binance wallets connected to Pakistani contacts.
A dedicated darknet and cryptocurrency task force has since been set up under the Multi-Agency Centre. The Financial Intelligence Unit (FIU-IND) has also been directing exchanges to tighten monitoring of transactions originating from sensitive border regions, with a particular focus on private wallets and peer-to-peer transfers that bypass centralized oversight.
Earlier in January 2026, Indian agencies also flagged a ‘crypto hawala’ network funneling foreign funds into Jammu and Kashmir through unregulated wallets and VPN-masked identities, a modus operandi that mirrors what investigators are now alleging in the Haarish Ali case.
The bigger picture for crypto regulation
Cases like this put added pressure on India’s already complex crypto regulatory debate. While the government has taken steps to bring VDA service providers under AML/CFT compliance through PMLA registration, the grey market of unregistered wallets, P2P platforms, and offshore exchanges remains a blind spot.
India’s CBDT recently amended income tax rules to formally classify crypto assets under the FATCA/CRS reporting framework, and the country is gearing up to plug into the OECD’s Crypto-Asset Reporting Framework (CARF) by April 2027. The FATF, too, has been warning member nations that offshore and unregistered crypto firms are creating loopholes that criminals and terror financiers exploit with ease.
That said, it is worth noting that blockchain transactions inherently leave trails. Industry experts, including those at Chainalysis, have previously pointed out that while terrorist groups do use crypto for fundraising, these transactions represent a relatively small fraction of overall illicit activity on-chain. The challenge is not that crypto is untraceable; it is that identifying the individuals behind layered, cross-border transfers requires significant forensic capability and international cooperation.
For now, the UP ATS says it is continuing to interrogate Haarish Ali and is searching for other individuals who may be connected to the network. The accused’s residence in Saharanpur was reportedly found locked at the time of enquiries.
Also Read: India Ramps Up Crypto Crackdown Ahead Of Assam Elections
