The attacks of 11 September 2001 did not only change counterterrorism. They also changed what investigators expect to learn from the movement of money — and turned financial data into a core component of modern intelligence.

On 11 September 2001, world politics changed. So did the way we look at money. The attacks on the World Trade Center and the Pentagon were the product of years of planning, yet financially the operation was comparatively modest. The 9/11 Commission estimated the total cost at roughly USD 400,000 to 500,000, of which around USD 300,000 passed through bank accounts the hijackers held in the United States and some USD 130,000 arrived via international wire transfers. What stands out is not the size of the sum but the way it moved. Those involved used bank accounts, international transfers, cash, traveller’s cheques, debit cards and credit cards. In the assessment of the 9/11 Commission they were not skilled at concealing their financial footprint — quite the opposite. They left behind links to one another and to their supporters. And still, before the attacks, none of these transactions stood out in any decisive way.

The blind spot in the financial system

The anti-money-laundering controls in place before 9/11 had been built with very different threats in mind: large laundering operations, drug proceeds, large-scale financial crime. The hijackers, by contrast, moved comparatively small amounts through largely ordinary channels. Existing systems simply were not designed to read such everyday transactions as preparation for a terrorist attack. The money movements were never invisible. Their meaning was. That is one of the most important lessons of the attacks. A single transfer can look entirely unremarkable, and the same is true of a bank account or a cash deposit. But once that information is connected to people, contacts, travel, companies and further transactions, a network can emerge. After 9/11 the question was therefore no longer only where terrorists were located, but how money reached them — and which structures became visible in the process.

After 9/11, “follow the money” went international

The response came within weeks. On 29 and 30 October 2001 the Financial Action Task Force (FATF) convened an extraordinary plenary in Washington. The organisation, which until then had focused mainly on developing international anti-money-laundering standards, explicitly extended its mandate to terrorist financing. The special recommendations adopted at that meeting covered, among other things, the criminalisation of terrorist financing, the freezing of terrorist assets, the reporting of suspicious transactions, international cooperation, and tighter controls on wire transfers and alternative remittance systems. Measures against cross-border cash couriers followed later. With that, the role of the financial system shifted. Banks and payment providers were no longer merely conduits through which money moved; the data generated along the way could increasingly reveal how people and organisations were connected.

When financial data became intelligence

Nowhere is this shift clearer than in the United States’ Terrorist Finance Tracking Program. After the attacks, the US Treasury began analysing data from SWIFT, the international financial messaging service, in the context of specific terrorism investigations. According to Treasury, this involves targeted searches based on existing leads about particular individuals or organisations — not an open-ended trawl through every transaction. The real value of such data lies in more than tracing a payment from A to B. Financial information can surface the missing links in an investigation. Who is sending money to whom? Which individuals keep reappearing in the same structures? Which companies or intermediaries sit between sender and recipient? And which apparently unrelated leads converge on a single point? “Follow the money” thus became, increasingly, a form of network analysis. The transaction is not always the object of the investigation. It can be the starting point.

Today there are far more ways to move money

Twenty-five years on, that analysis has grown considerably more complex. Bank accounts and conventional international transfers have not disappeared: the FATF still points out that terrorist actors continue to use the regulated financial system, including bank accounts, wire transfers and prepaid cards. At the same time, digital platforms have opened up new options. Social media, messaging apps, crowdfunding, digital payment services and virtual assets can be combined to raise funds or pass them on — and that combination is one of the most significant changes since 2001. A fundraising drive can now begin with a social media post, lead to a crowdfunding page, be processed through a payment service and finally be converted into virtual assets. The FATF also describes cases in which cryptocurrencies are combined with anonymising services such as mixers, which break traceability on the blockchain by pooling the digital assets of many different users. The use of digital assets is no longer a theoretical scenario: in 2025 the FATF reported, for example, that ISIL-K — the Afghan-Pakistani branch of the so-called Islamic State — had made increasing use of virtual assets during 2024, both for internal transfers and for collecting donations internationally. At the same time, the organisation stresses that terrorist financing models remain highly varied and that traditional financial channels still play an important role. Cryptocurrencies have not simply replaced classic terrorist financing. They have widened the range of options available.

The blockchain creates new opportunities — and new traces

At first glance, cryptocurrency looks like the ideal instrument for moving money outside the conventional banking system. That impression is too simple. Many cryptocurrencies run on public blockchains, where transactions are stored permanently and can in principle be viewed by anyone. The visible wallet addresses carry no name and are therefore pseudonymous — but link them to other information and new investigative leads can open up. The US Treasury has explicitly noted that public blockchain data can support the tracing of illicit financial flows. Which is precisely why illicit actors work to undermine that transparency, using mixers, chain-hopping between different blockchains, cross-chain bridges or frequent changes of wallet address. Such techniques can make analysis considerably harder. They do not automatically erase the underlying data trail. Modern blockchain intelligence therefore looks beyond individual wallets: transaction graphs can show how assets move across addresses, services and blockchains, and when that picture is combined with corporate data, open sources, sanctions lists and knowledge about the individuals involved, pseudonymous transactions can resolve into real-world relationships. On an entirely different technological plane, one of the central lessons of 9/11 repeats itself: information can be present long before its significance is apparent.

What this means for intelligence

Terrorist financing illustrates particularly well why individual data points are rarely enough. A payment need not be suspicious in itself. A wallet address may have no known owner. A company may look perfectly ordinary on paper. A donation campaign or an international money transfer may be entirely legitimate. What matters is context. For intelligence analysis, that means bringing together information from different layers: financial transactions, blockchain data, corporate structures, beneficial owners, sanctions information, digital activity, open sources and the connections between the people involved. Only then can a movement of money become a structure. The trajectory since 2001 also reflects a fundamental change in investigative work. Back then, the attackers left numerous financial traces in the regulated financial system, yet the decisive connections were only reconstructed after the attacks. Today there is far more data and there are far better analytical tools — but the financing routes are also more varied, faster and more international. The central question has barely changed. It is not only about where money comes from or where it goes. What matters is which people, companies, wallets and networks become visible when you follow its trail.