How FBI Traced and Seized $560K in Crypto From Hamas’ Network

Shared Gas Wallets Expose a Wider Network

Federal investigators built the seizure cases by connecting blockchain transactions with donation addresses obtained from fundraising websites, encrypted communications, and quality sources. The 3 cryptocurrency seizures occurred successful March, June, and October 2025, portion the broader $560,000 enforcement operation besides included 2 actions against online infrastructure successful 2026.

Rotating donation addresses did not forestall agents from uncovering connections betwixt seemingly abstracted transactions. According to Chainalysis’ Sept. 3 relationship of the investigation, galore addresses linked to Hamas’ subject wing, the Al Qassam Brigades, depended connected the aforesaid state wallet to wage blockchain transaction fees. A state wallet supplies the web tokens needed to execute transfers, making repeated backing from the aforesaid code a transportation constituent among different abstracted wallets.

FBI agents utilized Reactor, blockchain investigations bundle that analyzes cryptocurrency transactions and visualizes connections betwixt wallets and services, to visualize cryptocurrency entering a donation wallet earlier moving into an operational wallet. The graph placed idiosyncratic donors astir the postulation code and traced the consequent transportation to infrastructure allegedly controlled by the Al Qassam Brigades. The aforesaid gas-wallet connections appeared successful affidavits supporting the March, June, and October 2025 seizure actions.

Chainalysis Reactor graph showing cryptocurrency flowing from donors into an Al Qassam Brigades donation wallet and past to an operational wallet. Source: Chainalysis.

Tracing Expanded From Addresses to Intermediaries

Investigators extended the archetypal transaction way during the June 2025 lawsuit by pursuing funds done recently identified addresses and accounts. The investigation revealed however cryptocurrency was gathered from donation wallets, moved done operational accounts, and consolidated earlier reaching extracurricular services. One relationship was believed to beryllium associated with a Lebanon-based over-the-counter broker, portion different displayed enactment accordant with a wealth mule.

Hamas changed its transaction methods aft the archetypal seizure, according to Chainalysis. By October 2025, the web was employing single-use donation wallets and bridges, which transportation cryptocurrency from 1 blockchain to another. Agents continued pursuing the funds crossed those services, and a 3rd seizure warrant issued Oct. 10, 2025, covered assets identified during the investigation.

Changing an code oregon blockchain altered the way without deleting the earlier transaction record. The permanent quality of nationalist blockchain activity allowed analysts to revisit anterior transfers, comparison transaction patterns, and link aboriginal enactment with infrastructure recovered during earlier cases. Address investigation could past beryllium combined with records from exchanges, brokers, communications platforms, and different sources.

Recurring Wallet Roles Preserve the Financial Pattern

Although idiosyncratic addresses changed, Chainalysis noted that the web continued assigning akin functions to its wallets. Donation wallets received contributions, state wallets funded transaction fees, operational wallets moved the assets, and consolidation addresses gathered cryptocurrency from aggregate sources. The recurring operation provided investigators with behavioral patterns that remained disposable arsenic caller addresses replaced older ones. Comparable investigation during the Operation Lighthouse quality sprint converted blockchain addresses and work information into investigative leads.

The web besides continued interacting with over-the-counter brokers and cryptocurrency exchanges. Those services created investigative endpoints wherever blockchain addresses could beryllium connected with lawsuit accounts, transaction records, oregon assets held by a custodian. In a abstracted terrorism-financing case, Tether froze and reissued astir $1.6 cardinal successful USDT aft authorities identified the associated wallets. The tracing process identified the way and determination of the cryptocurrency, but tribunal authorization was required earlier agents could instrumentality power of it.

Court Orders Convert Blockchain Intelligence Into Seizures

Blockchain tracing identified wherever the funds traveled, portion court-issued seizure warrants provided the authorization needed to instrumentality power of accessible assets. A June 2025 warrant published with the Justice Department’s Sept. 1 disclosure directed Tether to pain USDT held astatine specified addresses and reissue an equivalent magnitude to a instrumentality enforcement-controlled wallet. Binance was instructed to transportation balances from 3 named accounts into FBI-controlled wallets.

The archetypal enactment had already established however donation addresses fed a wider postulation system. The March 2025 seizure involving astir $200,000 followed funds from astatine slightest 17 rotating addresses into a centralized wallet and onward done exchanges and brokers. Intelligence developed from that way supplied caller starting points for the June and October investigations.

Chainalysis elaborate however the accumulated wallet relationships yet extended the probe beyond money transfers. Findings from the earlier cases helped agents place domains and servers allegedly connected to the Al Qassam Brigades’ main website. Seizing that infrastructure successful July and August 2026 enabled the FBI to intercept cryptocurrency donations astatine their constituent of solicitation.