Who's Really Funding Terrorism? Exposing the India–Taliban–TTP–BLA Nexus

Who is behind the bombs, ambushes and suicide attacks? The trail points to a coordinated proxy network. India has rebuilt access inside Taliban-ruled Afghanistan and, according to independent investigations, has used Afghan recruits. The Taliban provide TTP with sanctuary, weapons, money and freedom to operate. Gulf hawala and digital channels help move funds without leaving a clear trail. TTP and BLA then carry out attacks across Khyber Pakhtunkhwa, Balochistan and along CPEC.
This is proxy warfare by division of labour: India provides reach, the Taliban provide territory, Gulf networks move the money, and TTP and BLA deliver the violence. Each actor handles one part of the operation, allowing the entire network to deny responsibility.

THE PROXY CHAIN HOW THE NEXUS OPERATES

THE TALIBAN BUILT TTP'S WAR MACHINE

The Taliban does not merely tolerate TTP. It bankrolls the organization. The UN Monitoring Team's June 2024 report (S/2024/444) identified TTP as the largest terrorist group in Afghanistan with an estimated 6,500 fighters on Afghan soil and confirmed Taliban authorities channel 3.5 million afghanis per month to TTP commander Noor Wali Mehsud. By August 2026, the 38th Monitoring Team report confirmed the Taliban had “continued their support” to TTP, while advanced weapons abandoned after the 2021 withdrawal enabled arms transfers to militant groups.

The Afghan Taliban then relocated around 2,000 TTP fighters and their families deeper into Afghanistan instead of arresting or disarming them. This was not a crackdown—it was protection. By sheltering TTP leaders, tolerating its camps, supplying access to weapons and funding its leadership, the Taliban have made TTP part of their security system.

AFGHANISTAN IS THE SHARED BASE FOR TTP AND BLA

TTP and BLA do not need the same ideology to use the same infrastructure. The 2025 UN Monitoring Team assessment relayed reporting of four shared TTP–BLA camps in southern Afghanistan, with Al-Qaeda providing weapons and ideological training. The August 2026 report added that BLA militants trained alongside TTP under Afghan Taliban instructors and that BLA and ISIL-K used overlapping logistical facilitators.

At the same time, the Combating Terrorism Center at West Point has documented the BLA’s shift toward coordinated assaults, territorial seizures and complex suicide operations. International reports suggests that BLA militants receive training and operational support in Afghanistan from elements linked to the Tehrik-i-Taliban Afghanistan (TTA), including instruction in suicide bombing, explosives and other militant tactics. If substantiated, that pipeline would help explain how methods refined in Afghanistan are now being deployed in Balochistan.

India Is Back in Afghanistan—with the Taliban as Its Gateway

Pakistan’s 2020 dossier described more than political hostility. It named Indian handlers, Afghan meetings, training camps, bank transfers and payments to TTP and Baloch commanders, including a claimed $820,000 transfer to TTP leadership and $60 million for an anti-CPEC militia. India rejected the dossier, but later independent investigations exposed remarkably similar Indian tradecraft.

In 2024, The Guardian reported that RAW-linked operations recruited Afghan gunmen, used Gulf-based cells and paid local killers. A later Washington Post investigation traced six reported killings to siloed teams, Gulf intermediaries and hawala. Those investigations concerned targeted assassinations, but their wider importance is unmistakable: the deniable human and financial machinery described by Pakistan is real. The dossier described the architecture; independent reporting later exposed the method.

This was not the first confirmation from inside the Afghan security apparatus. A former senior NDS official, writing in The Cipher Brief in 2026, revealed that he personally met with “the RAW station chief in Kabul” months before the Republic’s 2021 collapse. Indian intelligence, he confirmed, was not trying to save the Afghan government—it was “preparing contingency plans for the Republic’s fall” while “cultivating contacts in border provinces and maintaining links that could be used against Pakistan.” The admission from an Afghan intelligence insider transforms the dossier’s allegations into confirmed operational reality.

Now add India’s return to Afghanistan. New Delhi upgraded its Kabul mission to an embassy, raised its 2026–27 allocation to ₹150 crore, and announced projects in Paktika, Khost and Paktia—the same southeastern belt repeatedly linked to TTP camps and cross-border movement. Development diplomacy creates contractors, transport, local partners, communications and legitimate access on the ground. In July 2026, former Afghan army chief Sami Sadat publicly alleged that the Taliban redirect Indian funds to TTP and Baloch militants. His statement supplies the missing insider accusation linking access, intermediary and beneficiary.

Sadat went further than a general accusation. He specifically named “Fitna al-Khawarij” and “Fitna al-Hindustan” as organizations receiving Indian financial assistance through the Taliban to execute terrorist attacks within Pakistan—the first time a former Afghan military chief publicly identified the recipient groups by name.

THE DIGITAL MONEY TRAIL

The financial architecture is no longer confined to hawala. The Friday Times reported in August 2026 that TTP now uses cryptocurrency wallets to receive donations from diaspora supporters across the Gulf and Europe, sidestepping the banking-sector scrutiny that has squeezed its traditional funding channels. ISIS-K has maximized cryptocurrency use to circumvent financial restrictions on Afghanistan, utilizing peer-to-peer exchanges and Tether stablecoins on the TRON network to convert digital assets into operational cash. The Congressional Research Service documented “tens of millions of dollars in cryptocurrency donations” flowing to insurgent and jihadi networks between 2020 and 2023. The money trail no longer runs only through hawala couriers. It now runs through blockchain wallets that can be accessed from a phone in Kabul, a café in Gulf, or a project office in Delhi.

CONCLUSION

The evidence points to a clear division of labour. India provides strategic access, covert reach and deniable networks. The Taliban provide TTP with territory, training, weapons, protection and money. Afghanistan serves as the shared operating base where TTP and BLA can train, coordinate and obtain logistical support. Gulf-based hawala networks and cryptocurrency channels move the money and hide its source. TTP and BLA then carry out the attacks.