Cryptocurrency20.01.2025

We traced the R11,500 Bitcoin transaction that got a South African man arrested

An R11,500 Bitcoin transaction that has landed a South African man in jail on terrorism financing charges would be worth over R149,000 today.

MyBroadband located the cryptocurrency transaction on the Bitcoin blockchain that Ziyadh Hoorzook sent to an organization called al-Sadaqah in 2017 and was arrested for seven years later.

Hoorzook (35) sent the money from his Luno wallet on 30 November 2017 and was arrested more than seven years later on 3 January 2025.

Police said a years-long investigation by the Crimes Against the State team of the Hawks Serious Organised Crime Investigation established that Hoorzook had broken South Africa’s counter-terrorist financing laws.

Specifically, he is accused of contravening the Protection of Constitutional Democracy Against Terrorist and Related Activities Act (POCDATARA).

Hoorzook denies any wrongdoing, saying that he innocently donated money to what he believed to be a charitable cause at the time.

He said there were several drives to support the people of Syria at the time as they were subjected to human rights violations.

In an affidavit read by Hoorzook’s attorney during his bail hearing, he said he vaguely recalled an Islamic figure indicating that al-Sadaqah was the most appropriate organization to donate to because it directly dispersed aid amid the conflict.

Hoorzook said al-Sadaqah was only flagged as a potential terrorist funding organization long after he had sent the Bitcoin.

According to the blockchain data, the transaction occurred at 16:01 on 30 November 2017 and involved 0.07574079 BTC.

We were able to find the transaction thanks to the work of digital investigator Benjamin Strick in 2018, when he was a freelance open source intelligence (OSINT) analyst. He is currently the Director of Investigations at the Centre for Information Resilience.

Strick documented the Bitcoin wallet al-Sadaqah used for donations and highlighted several noteworthy transactions with deposits into the wallet’s address.

The image below, which Strick took from al-Sadaqah’s social media channels in 2018, shows the Bitcoin address it used.

It should be noted that the image could be very different from the alleged charity campaign Hoorzook saw in 2017.

Al-Sadaqah only began accepting crypto donations in Monero, Dash, and Verge in early 2018.

Former Director of Analysis for the Center on Sanctions and Illicit Finance (CSIF), Yaya Fanusie, told the U.S. House Committee on Finances in September 2018 that al-Sadaqah changed tactics earlier that year.

Fanusie explained that al-Sadqah’s initial donation drive failed to attract a substantial amount, after which it began accepting donations in other cryptocurrencies.

Based on Fanusie’s report, Hoorzook’s donation in November 2017 was the single largest amount al-Sadaqah received before it changed its approach.

Among the transactions of interest Strick highlighted in 2018 was the one which, many years later, turned out to be Hoorzook’s donation.

The source address of Hoorzook’s donation (ending in 5oC) raised flags because it had been linked to a child kidnapping case in South Africa.

Specifically, funds were sent from this address in May 2018 to the Bitcoin wallet the kidnappers had demanded the ransom for the child be paid into.

However, it emerged that the two incidents were probably not linked as the 5oC address was identified years later as belonging to South African cryptocurrency exchange and wallet provider Luno.

Therefore, two different Luno customers may have sent money to entirely unrelated criminal groups from their accounts, and the transactions were simply executed through the same “hot wallet”.

A “hot wallet” is a cryptocurrency wallet that is permanently connected to the Internet, as opposed to “cold storage”.

Crypto asset service providers use cold storage and hot wallets to limit their exposure in the event of a breach or attack.

In addition to the details of Hoorzook’s transaction, the blockchain data shows that 0.00090748 BTC worth around R1,800 remains in the al-Sadaqah wallet.

Screenshot showing Bitcoin block containing transactions from one of Luno’s wallets to various addresses, including one used by al-Sadaqah.

Hoorzook appeared in the Lichtenburg Magistrates Court on Monday, 6 January 2025, after being arrested the Friday before.

His bail hearing was set for 10 January and has been extended three times, with hearings happening on 13 and 15 January. The court is expected to rule on his bail this Wednesday, 22 January.

In an affidavit read by his lawyer, Hoorzook told the court that he intended to plead not guilty and that the case against him had been exaggerated.

“The state has misaligned me to a narrative which is factually untrue,” he said.

However, the Hawks investigating officer, Warrant Officer John Sithole, said the state’s case was watertight. He warned that if Hoorzook is granted bail, he could attempt to evade trial.

Sithole told the court that he discovered a substantial volume of evidence suggesting that Hoorzook knew his funds would aid a terrorist organization to commit further terror-related activities in Syria.

He said the Hawks found videos, images, and articles containing extremist material that promoted violence on the accused’s electronic devices, as well as speeches by former al-Qaeda leader Osama bin Laden.

Sithole testified that material found by their forensic laboratory on Hoorzook’s devices included three al-Sadaqah advertisements that showed he had knowledge of the group’s activities.

He said the adverts clearly show that al-Sadaqah is not a charity organization and that Hoorzook knew the funds would be used for terror activities.

The state prosecutor also said that one of al-Sadaqah’s postings on the Telegram messaging service asked people to donate anonymously with cryptocurrency to support “the mujahideen in Syria with weapons, financial aid, and other projects assisting the jihad”.

They said that al-Sadaqah has been linked to financing al-Qaeda and later the Islamic State in Syria.

Show comments

Latest news

More news

Trending news

Sign up to the MyBroadband newsletter