Picture the job ad. Easy money. Paid in crypto. You will never meet the boss, and you do not need to know who he is. Criminal networks are recruiting young people online for cheap, deniable one-off jobs.
Recently, five men were arrested in white vans near RAF Fairford, an English air base used by the U.S. military. Police found gasoline but no explosives. The men were released on bail, and one official reportedly described them as unwitting. Whatever the full story turns out to be, analysts already have a name for the model behind it: gig economy hybrid warfare.
The model is simple. A state outsources sabotage to cutouts: small-time criminals and sometimes teenagers, hired anonymously online and paid per task in crypto. Russia pioneered it, and Iran has followed.
The appeal comes down to two things, deniability and price. A 2024 RUSI analysis put the going rate at a few hundred dollars for arson or worse, and $53 per person for spraying hate graffiti around Paris. As RUSI dryly observed, the benefits "generally accrue to the employer."
The model is also spreading. Since February, roughly 20 small-scale arson and bombing attacks on Jewish and American targets in Europe and North America have followed this pattern, according to The New York Times.
State actors did not invent this model; they borrowed it. Europol calls it violence-as-a-service, and in April 2025 it launched a dedicated taskforce, OTF GRIMM, to fight it.
The numbers are hard to ignore:
The apps are the same, the labor pool is the same, and the payment rails are the same, whether the client is a gang boss or a foreign intelligence service. That convergence is the real story. The end goals for each criminal organization is different, but the tools are the same.
A $53 crypto payment to a 17-year-old looks like nothing, and on its own it nearly is.
Classic AML thinking suggests following dirty proceeds through placement, layering and integration back into the clean economy. Gig crime runs the other way. The money does not proceed to being laundered. It is earmarked to be spent on wages, materials and travel.
So stop chasing the single transaction and look at the whole business behind it. Who funds the operation? That is Revenue Generation. How does the network keep running, recruiting new hands, paying recruiters and replacing burned agents? That is Sustainment. These are the two stages the traditional 3-stage cycle leaves out. Section 2’s 5-stage HTF™ lifecycle puts them back in. Every criminal enterprise has suppliers, a workforce and a payroll, and payroll leaves a trail. The traditional AML model covers three stages: Placement, Layering, and Integration. HTF™ extends it with the two stages the industry has always ignored — Revenue Generation, where criminal proceeds originate, and Operational Sustainment, where threat actors reinvest to fund ongoing activity.
In HTF™ terms, gig recruits sit at the tactical level of a criminal organization: expendable hands that carry out the act and are kept deliberately unaware of the operational and strategic levels above them. That separation is the point, and it is not new. Wildlife trafficking networks have long paid poachers through small mobile-money transfers such as M-Pesa, and similar "antwork" payment chains have funded terrorism. THE LEARNING CENTER instructor Rob Bacon points to Yemeni terrorist networks paying rhino poachers in Kenya via M-Pesa. Small payments go to many hands, while the decision-makers stay out of view.
Criminal networks are recruiting young people online for cheap, deniable one-off jobs. The handlers stay hidden, but the money leaves a trace: recruits get paid, buy the tools of the job, and pass a cut up the chain. For financial institutions, that trail is often the earliest view of the operation. Here are four signals worth hunting.
None of these signals alone justifies a SAR/STR. Taken together and across accounts, they map out a business. The first person to notice is often not an analyst but a front-line employee who sees a young customer's behavior change overnight.
Europol is clear that this is not about catching children out. Recruiters lure them with memes, gamified "missions" and the promise of fast cash, and many never meet the people directing them.
Spotting the pattern early can protect a young person. A timely referral might stop a teenager before the next "job." The real targets are the recruiters, the handlers and whoever is paying them.
Crime-as-a-gig is cheap, deniable and borderless, so it will not stay in Europe. The teams that get ahead of it will stop asking whether a transaction is suspicious and start asking what business that transaction serves.
That question is at the heart of the HTF™ Series in THE HUB, where we teach the 5-stage lifecycle and the Criminal Business Model.
