Start was donations from Kuwait and Saudi Arabia, from private citizens, to causes in Syria. While some given for humanitarian uses diverted to military causes.
When it broke from Syria it gained other sources. $425 mill in good from bank in Mosul. Then theft from citizens. Next is extortion - otherwise called taxes - from areas colonised. Then black market trade in oil from wells captured. Lastly proceeds of ransoms from kidnapping. Claims the ransom demanded for US journalist was $75 million. US never pays but some Europeans do.
While security analysts spread fear of a caliph are stretching from Spain to Indonesia, the issue comes down to how sustainable that is. All such empires based only on force eventually fail, but it could be messy.
The core strategy has to be to get the Sunni States to identify IS as a threat rather than an ally. The vision of the caliphate needs to be converted as a threat to Saudi Arabia, Kuwait and the other Arab States.