Europe Wants to Crack Down on Bitcoin Despite Little Evidence that ISIS Uses It

The European Union is considering cracking down on the semi-anonymous digital currency Bitcoin after the deadly Islamic State-affiliated attacks in Paris were followed by reports that the terror group was using it.

According to a draft document obtained by Reuters, EU ministers will meet on Friday and recommend strengthened controls on virtual currencies and other non-banking methods of funding, like precious metals, in an effort to stamp out terror financing.

The announcement came after German state-run news outlet Deutsche Welle (DW) reported in September that a Bitcoin address, allegedly linked to ISIS supporters, contained $3 million in Bitcoin. The story prompted dozens of headlines about ISIS being funded with Bitcoin.

But there's just one problem with DW's report and the EU's drafted proposal: at best, the claims that ISIS holds at least $3 million, or any substantial amount, in Bitcoin are unverifiable. At worst, they're false.

Lewis Sanders IV, the DW reporter who broke the story, wrote that "thousands of dollars worth of bitcoin has been sent to accounts" allegedly connected to ISIS, and that one of those accounts contained $3 million USD. However, the significance of that connection may be overblown.

Sanders started with a Bitcoin address allegedly belonging to ISIS, provided to him by the Anonymous splinter group Ghost Security Group (GSG). Sanders claims he then traced the "chain of transactions" from that address to another Bitcoin account, which contained the millions.

"It is unclear who the account's owner is," Sanders admits, but he suggests it belongs to someone affiliated with ISIS.

Sanders did not disclose the Bitcoin address allegedly containing the $3 million in funds, nor the address of the original account. When I contacted GSG over email to ask for the address that led to the $3 million wallet, I was told that GSG no longer has it due to a server failure in October. Instead, the group sent me a blurred screenshot of a dark web site that advertised the address.

That site appears to be nearly identical to that of an alleged ISIS-connected site discovered by my colleague Joseph Cox back in June. As Cox noted at the time, the site "simply claimed to be funneling the cash to the terrorist group," but could easily be a fake.

The Bitcoin address listed on the site in Cox's report has managed to collect a grand total of zero bitcoins in the last five months.

Cox's find:

Ghost Security Group's find:

The Bitcoin address in the screenshot sent to me by GSG appears to be different than the one in Cox's, and this is due to the site's operators periodically switching up the address they use, the GSG rep said.

Because the screenshot is blurred, it's impossible to verify how much is actually in the wallet that led Sanders to the other wallet allegedly containing $3 million (GSG claims the address contained five bitcoins, or roughly $1,600, at the time of writing). The the dark web site's URL has also changed, the GSG rep told me.

This is the problem with making claims that ISIS is using Bitcoin to fund its operations: due to the nature of cryptocurrencies and the dark web, it's sometimes nearly impossible to verify who owns what. In other words, a one-to-one relationship in terms of ownership does not always exist on the blockchain—it's possible that the wallet owners covered their tracks using a "tumbler," for example, which attempts to obscure the source of transactions—and it's unclear whether Sanders took this into account when tracing the Bitcoin transactions through the blockchain to the wallet allegedly holding $3 million in Bitcoin.

"I personally can't confirm the 3 million [sic] amount and am going by [DW's] statement alone," the GSG representative wrote me.

Sanders did not respond to my request for comment over Twitter (I couldn't find his email) and DW did not respond to my request for comment via email to their German editorial desk.

This is hardly the first time that public fear has been stoked about ISIS using Bitcoin to fund itself. While numerous sites alleging to be sending Bitcoin to the terrorist group have been discovered, only one was found in the past to have collected any funds at all: just under $1,200. What there has been instead is a lot of talk about ISIS allegedly using Bitcoin, from ISIS acolytes and EU analysts alike, but with little to show.

Even if ISIS was using Bitcoin, would that be as dangerous as some apparently think it would be? The so-called ISIS affiliates promoting Bitcoin as a method of funding appear to overestimate how beneficial Bitcoin's supposed anonymity would be to their cause. A 17-year-old US teenager named Ali Amin, who was sentenced to prison for supporting ISIS by encouraging people to donate Bitcoin to the group, described the cryptocurrency as being "untrackable [sic] by kafir [meaning 'infidel' or non-muslim] governments"—but this is hardly true.

Watch more from Motherboard: Life Inside a Chinese Bitcoin Mine

Although tracking Bitcoin through the blockchain can be difficult if a tumbler is in use, when the transactions are direct and the amounts are large, it's trivial; The US government convicted Ross Ulbricht for running the dark web drug market Silk Road in part by tracing one-to-one Bitcoin transactions, and there are other ways to find out who is sending money, too. The easiest method is simply to subpoena the Bitcoin exchanges where the coins were initially purchased to find out who was behind the transactions.

Even if the trail is well-covered, somewhere, someone likely has the key piece of information that will lead to the culprit. This is by design. Although Bitcoin is used illicitly, it's meant to be a transparent system, and is used by legitimate businesses as well. Even banks are getting on board with the blockchain, the technology that underpins Bitcoin.

All in all, it appears that the claims that ISIS is using Bitcoin to fund its operations in any substantial way—remember that ISIS reportedly has finances numbering in the hundreds of millions thanks to oil money and taxation—are unverifiable, possibly untrue, and likely exaggerated. Still, the EU appears primed to crack down on virtual currencies, and it will be interesting to see if DW's proof justifies the action or not.