Cryptocurrency Fraud Used to Finance Terrorism, Kosovo Prosecution Claims

The Kosovo Special Prosecution has charged Spartak Dërmaku, Arian Alijaj, and Blerim Krasniqi with using cryptocurrency and fraud to fund terrorism. According to prosecution files reported by KALLXO.com, the suspects used fake identities and Telegram channels to solicit funds from German audiences and laundered money through the Prishtina-based Tresor Exchange.

How are stablecoins like USDT being used to fund terrorism?

Terrorist financing is shifting toward stablecoins, specifically USDT, because they offer the speed of crypto without the price volatility of Bitcoin. In the Kosovo case, Blerim Krasniqi allegedly used a Binance account under the fake name Boris Nikolovski to move 310 USDT to a mediary account to “lose the trail,” according to the prosecution.

This pattern reflects a broader trend where illicit actors use “chain hopping” or mediary accounts to break the audit trail. By using USDT, which maintains a 1:1 peg with the U.S. dollar, these groups can move precise amounts of value across borders instantly without worrying about a market crash.

Did you know? USDT (Tether) is often preferred by criminal networks over Bitcoin because its stability makes it a more reliable “currency” for paying operatives or purchasing weapons.

Why is Telegram the preferred hub for illicit fundraising?

Encrypted messaging apps provide a layer of anonymity that traditional social media lacks. The Kosovo prosecution identified two specific Telegram groups, Fatasbiqul Khayrat and GebtAus, which allegedly targeted German-speaking audiences to collect funds for terrorist acts.

These groups act as digital “donation boxes.” By sharing crypto wallet addresses directly in a chat, recruiters can bypass the banking system’s Anti-Money Laundering (AML) triggers. The prosecution alleges Spartak Dërmaku sent multiple transfers—including 800 USDT and 972 USDT—to accounts shared within these groups.

The risk of “Micro-Funding”

The Kosovo case highlights a contrast in funding scales. While the group allegedly used falsified documents to transfer over 152,000 USDT to a single account, they also engaged in smaller, frequent transfers. This “micro-funding” strategy makes it harder for automated surveillance systems to flag transactions as suspicious.

What role do “Synthetic Identities” play in crypto-fraud?

The use of “Boris Nikolovski”—a fictional character from North Macedonia—shows the growing reliance on synthetic identities to bypass Know Your Customer (KYC) protocols. According to the Kosovo Special Prosecution, this fake identity allowed the suspects to open accounts on platforms like Binance and move funds without revealing their true identities.

This trend is becoming a systemic vulnerability for exchanges. When criminals combine stolen data with fake personas, they create “mule accounts” that can move millions before the exchange detects the fraud. The prosecution claims Dërmaku and Alijaj used these schemes to acquire luxury cars and other assets across Switzerland, Kosovo, and North Macedonia.

Pro Tip: To avoid becoming a victim of these schemes, never send cryptocurrency to “charities” or “causes” promoted solely through Telegram or WhatsApp without verifying the organization through an official government registry or the Financial Action Task Force (FATF).

How do local crypto-exchanges facilitate money laundering?

The case against Tresor Exchange in Prishtina illustrates how local, less-regulated exchanges can be used to “off-ramp” digital assets into cash. The prosecution alleges the suspects generated substantial turnover through the business, converting crypto into cash to hide the origin of the funds.

This “hybrid” laundering model—combining digital assets with a physical business—is a recurring trend. It allows criminals to move money through the blockchain and then inject it into the legal economy as “business revenue,” making the funds appear legitimate to tax authorities.

Comparison: Digital vs. Physical Laundering

The prosecution’s file shows a two-pronged approach:

Digital: Using mediary accounts and fake personas (Boris Nikolovski) to obfuscate the source.
Physical: Using a registered business (Tresor Exchange) to convert assets into luxury cars and cash.

Comparison: Digital vs. Physical Laundering

FAQ: Cryptocurrency and Terrorist Financing

Can cryptocurrency be tracked if fake names are used?

Yes. While names like “Boris Nikolovski” hide the person, the blockchain records every transaction. Law enforcement uses blockchain analytics to trace the flow of funds from the mediary account to the final destination.

Why do these groups target German speakers?

The prosecution alleges that the groups Fatasbiqul Khayrat and GebtAus specifically targeted German audiences, likely due to the higher availability of disposable income and the existence of diaspora communities that can be exploited through social engineering.

What is USDT and why is it used in these crimes?

USDT is a stablecoin pegged to the U.S. Dollar. It’s used because it provides the anonymity and speed of cryptocurrency without the risk of the value dropping during the transfer process.

What are your thoughts on the regulation of local crypto-exchanges? Should they be held liable for the funds their clients move? Let us know in the comments below or subscribe to our newsletter for more updates on financial crime.