Ziyadh Hoorzook, accused of donating money to a listed terror group, is granted bail

Hoorzook (35) was arrested on 3 January and faces a charge of contravening the Protection of Constitutional Democracy Against Terrorist and Related Activities Act.

He was arrested after the Financial Intelligence Centre and the Hawks received information about a suspicious transaction allegedly linked to terror financing.

He is accused of donating R11,500 through the South African cryptocurrency exchange Luno to al-Sadaqah — which the Hawks allege is a known terrorist fundraising entity posing as a charity — on 30 November 2017.

National Prosecuting Authority spokesperson Sivenathi Gunya told Daily Maverick: “We respect the decision of the court and welcome the judgment.”

This is despite the State opposing bail because of the seriousness of the charges Hoorzook is facing.

Read more: Recipient of ‘charitable’ donation from SA man was terror financing front, US document alleges

Hoorzook’s attorney Yousha Tayob told Salaamedia that in another case where a person had made a R75 donation to al-Sadaqah, it was established that it was an innocent donation and the donor was unaware that it was for a terrorist organisation.

“So why do they seek to prosecute this matter?” asked Tayob.

Tayob previously represented twins Brandon-Lee Thulsie and Tony-Lee Thulsie on charges relating to planning acts of terror. In February 2022, the Gauteng Division of the High Court sentenced the two to 11 and eight years of imprisonment, respectively. They were released on parole in August 2022  as the time they had spent in jail awaiting trial was regarded as time served.

Who is Ziyadh Hoorzook?

Hoorzook (35) was born in Pietermaritzburg and has a Bachelor of Commerce degree from Unisa. He started working in banking before moving to a diamond mine in Lichtenburg, where he worked from 2013 to 2019. It was during this period that the Hawks allege he became involved in terror financing activities.

Since 2020, he has been an independent contractor and consultant for Choice Aluminium, earning an estimated R40,000 per month. He is also the director of Logistique Investments, a company he has managed since 2017, and previously held positions in other ventures, including Windscreens in Motion and MCKLift Forklift.

In 2017, he was embroiled in a legal battle with a former business partner over a disputed diamond mining joint venture, which ended up in the North West Division of the High Court.

Hoorzook’s family ties include his wife of 10 years and his elderly parents. The case against him has drawn national attention, with experts suggesting its outcome may set a legal precedent for future terror financing cases in South Africa.

Read more: From Bitcoin to bail: Terror funding accused’s court appearance highlights South Africa’s growing risks

Cryptocurrency payment

Key to the State’s case against Hoorzook is that he is alleged to have made a payment to al-Sadaqah with bitcoin on 30 November 2017. While bitcoin transactions are recorded on a public ledger, tracing them to real-world identities can be complex due to techniques used to obscure transaction trails. These complexities have posed unique challenges for law enforcement.

Cryptocurrency expert Wiehann Olivier, a partner and head of fintech, digital assets and private equity at Forvis Mazars, said: “Blockchain transactions are immutable and transparent, but criminals exploit its pseudo-anonymous nature by using mixers and swapping cryptocurrencies to obscure audit trails. Mixers combine funds to make tracing difficult, while swapping between cryptocurrencies — especially privacy coins — further complicates detection.

“While centralised exchanges with KYC (Know Your Customer) requirements are harder to exploit, decentralised exchanges and mixers lack these controls, presenting ongoing challenges.”

Who was behind the transaction?

Tracing Hoorzook’s alleged transaction required forensic blockchain analysis, conducted with the consultation and verification of a cryptocurrency expert specialising in anti-money laundering. The key challenge was not just identifying the transaction but establishing whether the sender could be definitively identified as Hoorzook.

Central to the State’s case is the Hawks’ allegation that Hoorzook’s donation took place through Luno on 30 November 2017, to the value of R11,500 — to which we identified a corresponding amount deposited from a bitcoin wallet that appears to be an exchange used to process many transactions.

Further investigation reveals that the exchange wallet has been cleared repeatedly over the last few years — which is not uncommon practice for exchanges. Blockchain analysis indicates that the payment to al-Sadaqah was processed via a wallet linked to Luno, suggesting that a Luno account holder made the transaction. This aligns with the Hawks’ allegations.

Daily Maverick sent a detailed, specific list of questions regarding Luno’s KYC policies, compliance with law enforcement, and specific transactions to Christo de Wit, Luno’s country manager.

He responded via email: “Luno has been registered with the Financial Intelligence Centre (FIC) since 2016. This means that Luno is required to and does comply with anti-money laundering legislation in South Africa. This includes submitting reports to the FIC concerning suspicious and unusual activities or transactions on its platform.

“Luno is prohibited by law from sharing details of any reports submitted, but we can confirm that where such reports lead to law enforcement or other investigations, we provide the necessary support and assistance to relevant authorities.”

No further details were forthcoming from Luno — but Daily Maverick has been reliably informed by industry insiders that Luno has implemented monitoring and anti-money-laundering measures capable of identifying suspicious transactions that occurred before it implemented KYC practices.

While Luno states that it has been registered with the Financial Intelligence Centre since 2016, its KYC requirements at the time of the transaction remain unclear. Industry insiders indicate that earlier policies may not have required full identity verification, meaning transactions could have been conducted with relative anonymity before stricter KYC enforcement in later years.

One notable observation is that the Luno-linked transaction was bundled with another payment traced to Bittrex, a US-based cryptocurrency exchange. While this may be coincidental — since exchanges often process multiple withdrawals in batches — the timing and linkage warrant further scrutiny. If a connection exists between the two transactions, it could indicate a shared financial network. At the time of writing, Bittrex had not responded to our queries.

Following the trail offline

Hoorzook was allegedly living in Linbro Park, Johannesburg, at the time of the transaction and listed a Johannesburg address in his bail application. However, no official records link this residence to his business interests.

The address Hoorzook gave in his bail application is a property ancillary to a mosque in Linbro Park, Johannesburg. (Picture: Yeshiel Panchia)

A visit to the address revealed it to be closely linked to a mosque, with both appearing to be located on the same property. Daily Maverick spoke with the mosque’s director, Yahya Amod, who said that Hoorzook had lived at the residence for some time and that he had met him at the mosque.

Amod described the allegations against Hoorzook as “unsatisfactory and untrue”, adding that Hoorzook was “a quiet person, helpful and community-focused”. DM