Don't want to trade it yourself?
Our desk runs DEX portfolios on profit share.
The Federal Bureau of Investigation walked away from a 17-month blockchain investigation with something more consequential than $560,000 in seized cryptocurrency: the identities of thousands of people around the world who tried to funnel money to Hamas through what the group’s operators believed was an untraceable digital network. Seized $560,000 in cryptocurrency and the infrastructure used to solicit it, the Justice Department announced September 1, 2026. That donor intelligence — drawn from the seized communication infrastructure of the Al Qassam Brigades, Hamas’s military wing — will now drive future counterterrorism investigations.
The operation culminated a strategy that combined blockchain analytics with domain seizure: when the FBI took control of AlQassam.ps — the Brigades’ primary website — agents did not merely shut the site down. They captured the domains and servers to intercept cryptocurrency donations still in transit to Hamas-linked wallets in real time. Hamas had spent years insisting that digital currencies would be impossible for Western authorities to trace. The blockchain said otherwise.
How Hamas Thought Wallet Rotation Would Work — and Why It Failed
Hamas began experimenting with cryptocurrency fundraising in or around early 2019, when the Al Qassam Brigades started soliciting donations through Telegram-based rotating wallet solicitation, directing supporters to a rotating pool of wallet addresses and offering step-by-step instructions for making anonymous donations in Arabic. The premise was straightforward: if each donation went to a different address, and each address was used briefly before being discarded, no single wallet would accumulate enough traffic to become a target for law enforcement screening lists. Rotating wallets would, in theory, outrun the static blacklist tools that exchanges and compliance teams relied on.
The premise had a fatal flaw. Every rotating wallet on the Tron blockchain required TRX — Tron’s native token — to pay transaction fees. And according to FBI affidavits, all of Hamas’s rotating donation addresses were funded from the same source: a single TRX “gas wallet” that topped up transaction fees across the entire network. Blockchain analytics firms like Chainalysis and TRM Labs have built clustering heuristics specifically around this pattern: wallets funded by the same gas source are attributable to the same operator, regardless of how many different addresses they use. The Chainalysis Reactor graph filed with the March 2025 seizure warrant showed this directly, identifying the gas funding address that linked the entire rotating network to a single operator. The rotation strategy dispersed the destination addresses. The gas wallet unified them.
All of those rotating addresses, investigators determined, were funneling funds into a single operational Al Qassam Brigades wallet. According to court documents, that wallet received approximately 1.57 million USDT between late October 2024 and March 2025 alone. By November 2025, investigators estimated the network had received over three million dollars in total donations and continued distributing donation instructions through at least February 2026.
Hamas’s primary fundraising vehicle was Tether’s dollar-pegged stablecoin, USDT, running on the Tron blockchain — a pattern consistent across the broader landscape of designated terrorist organizations in 2025. According to TRM Labs’ 2026 Crypto Crime Report, nearly 95 percent of stablecoin inflows to sanctioned entities and jurisdictions in 2025 moved through stablecoins. The group preferred USDT over Bitcoin for the same reasons most illicit actors do: faster settlement, lower fees, and the dollar peg that avoids the price volatility that complicates operational budgeting.
Three Warrants Over 17 Months: The Seizure Timeline
The operation did not end in a single bust. The FBI’s Albuquerque Field Office, coordinating with the Bureau’s Counterterrorism Division, Cyber Division, and New York Field Office, executed three court-authorized seizure warrants over the course of the investigation.
The first, dated March 25, 2025, recovered approximately $201,400 after a confidential U.S.-based source alerted the FBI to a Telegram post soliciting contributions to a Hamas-associated email address. That first seizure netted $201,400 from wallets and accounts linked to a Hamas fundraising network. Investigators wrote to that address and received, hours later, a reply in Arabic containing a fresh USDT wallet address — a transaction that simultaneously confirmed Hamas’s operational security procedures and handed the FBI its first confirmed attribution.
The second warrant, June 25, 2025, and the third, October 10, 2025, followed as the network adapted. After the March seizure became public, operators shifted toward single-use addresses and more complex transaction routes. The network adapted with single-use addresses and cross-chain conversion hops designed purely to obscure origins and destinations. Some cryptocurrency reached accounts opened with Lebanese passports; at least one was registered to a Palestinian national. The adaptation bought time, but not invisibility: behavioral fingerprinting continued to map the flows.
Seizing the Website Was the Breakthrough
Beyond the wallets, the FBI’s capture of AlQassam.ps and its affiliated domains and servers seized by FBI — AlAqsaFlood.org and Host.AlAqsaFlood.org — represented a qualitatively different enforcement capability. The Al Qassam Brigades’ primary website had been hosted on an Iranian provider based in Tehran before migrating to servers operated by companies with data centers inside the United States in spring 2026. That migration, intended to improve reliability, moved the infrastructure into U.S. jurisdictional reach.
U.S. Attorney Jeanine Ferris Pirro for the District of Columbia made her message to the group direct: “Your networks are not secure, your crypto is vulnerable, and we will not stop until your ability to wage war is defeated.” The seizure of those servers gave investigators something that wallet blacklisting alone cannot provide: the ability to intercept donations still in transit, catching cryptocurrency transfers before they completed. For the crypto compliance industry, this represents a model — domain infrastructure seizure as a real-time payment intercept mechanism, not merely a website shutdown.
The operation also generated what officials described as a significant intelligence collection: data on thousands of donor contact records worldwide who had contacted Hamas online to donate or attempt to donate, using both cryptocurrency and traditional payment methods. That data now feeds active and future counterterrorism investigations, the DOJ said.
Broader Context: Hamas’s Crypto Financing Infrastructure
Tuesday’s announcement is the latest chapter in a longer DOJ campaign against Hamas’s digital financing. In July 2025, the Justice Department filed a Buy Cash Money civil forfeiture complaint targeting approximately $2 million in digital currency connected to Buy Cash Money and Money Transfer Company, a Gaza-based business whose owner, Ahmed M.M. Alaqad, had already been sanctioned by the U.S. Treasury. At least one account tied to Buy Cash received at least four million directed toward Hamas operations — making the $2 million forfeiture target a partial recovery from a far larger flow.
Blockchain intelligence firm TRM Labs, which assisted in that earlier case, documented how investigators traced converging wallet flows across wallets that converged on addresses linked to Buy Cash — by tracing behavioral patterns such as inter-wallet transfers, transactional loops, and timing correlations.
What Hamas Got Wrong About Crypto Traceability
Hamas officials publicly boasted that digital currencies would be impossible for Western authorities to trace, and in April 2023 Hamas halted Bitcoin fundraising — citing the ability of government officials to identify and prosecute donors. The group shifted to USDT on Tron, operating on the assumption that the combination of stablecoins, rotating wallets, and encrypted channels had solved the traceability problem.
It had not. The blockchain’s permanent public transaction record — an immutable public ledger that permanently records every transaction — is precisely what makes it useful to investigators rather than protective of illicit actors. Blockchain analytics firms have built increasingly sophisticated clustering tools that operate faster than evasion tactics can adapt: behavioral fingerprinting can survive wallet rotation, cross-chain movement, and converter hops as long as a single shared infrastructure element — a gas wallet, a common deposit address, a timing pattern — links the otherwise dispersed addresses.
The Tether dimension compounds the risk for groups using USDT. As of July 2026, Tether has 9,597 addresses frozen by Tether across Ethereum and Tron, freezing $5.69 billion in stablecoin value. BlockSec’s analysis found that Tether proactively froze 17 Hamas addresses before the public release of the corresponding seizure orders — meaning that even without a final court order, USDT flows can be frozen by the issuer at law enforcement’s informal request. The GENIUS Act, the U.S. stablecoin legislation enacted in 2025, further formalizes these GENIUS Act stablecoin compliance obligations for stablecoin issuers operating in or serving the U.S. market.
Assistant Attorney General for National Security John A. Eisenberg announced the full enforcement action in the department’s statement: “These seizures deprive Hamas of reand finance barbaric attacks like the one on October 7, 2023. We will continue to tighten the vise on Hamas’s capacity for terror by infiltrating its online networks, confiscating its cryptocurrency, and shutting down its websites.”
The case is being prosecuted by Chawla — Assistant U.S. Attorney Tejpal Chawla for the District of Columbia — alongside Trial Attorney Jacques Singer-Emery for the National Security Division’s National Security Cyber Section. Trial Attorney Robert MacDonald of the National Security Division’s Counterterrorism Section and the October 7th Task Force is providing substantial assistance.
Frequently Asked Questions
How does the FBI actually trace cryptocurrency donations that are meant to be anonymous?
Cryptocurrency wallets are pseudonymous, not anonymous — every transaction is recorded permanently on a public blockchain. Blockchain analytics firms like Chainalysis and TRM Labs use blockchain analytics clustering fundamentals and behavioral fingerprinting to link wallets to the same operator. In Hamas’s case, the critical flaw was a shared “gas wallet”: every rotating donation address on Tron required TRX to pay transaction fees, and all of those addresses drew from the same funding source. That gas wallet acted as a fingerprint that linked the supposedly independent addresses to a single operational wallet. No matter how many different donation addresses Hamas published, the underlying infrastructure betrayed them.
Is donating cryptocurrency to Hamas or any other designated terrorist organization a crime, and does it stay on the blockchain?
Yes on both counts. Providing material support to a designated Foreign Terrorist Organization is a federal crime under 18 U.S.C. § 2339B, regardless of the form — cryptocurrency, wire transfer, or cash. And yes, blockchain transactions are immutable: every donation made to Hamas-linked wallets since 2019 is still visible on the public ledger. The FBI’s seizure of Hamas’s recruitment servers also captured communication records identifying thousands of people who tried to donate — through crypto and traditional payment methods — creating a permanent counterterrorism intelligence database. The donor records now in counterterrorism files extend to those who only attempted to donate, not only those who completed a transfer. Attempting to donate is not the same as completing a transfer, but the record of the attempt now exists in federal hands.
Why do terrorist groups use USDT instead of privacy coins like Monero?
Speed, cost, and the dollar peg. USDT on Tron settles in seconds at fractions of a cent per transaction, and its dollar peg means the group’s operational budget does not fluctuate with market volatility the way a Bitcoin or Monero position would. Privacy coins like Monero are genuinely harder to trace — they use ring signatures and stealth addresses that blockchain analytics cannot cluster the way USDT transactions can. But they are also harder to convert to usable fiat currency without attracting attention. According to stablecoin data from TRM Labs in their 2026 Crypto Crime Report, nearly 95 percent of inflows to sanctioned entities in 2025 moved through stablecoins — not because the groups do not know about privacy coins, but because operational convenience and convertibility outweigh the traceability risk in their calculation.
What does seizing a domain like AlQassam.ps actually accomplish beyond shutting down a website?
Seizing a domain is not just taking a website offline — it transfers operational control of that domain’s infrastructure, including any servers processing incoming network requests, to law enforcement. In this case, the FBI used server control to intercept cryptocurrency donations that were still in transit to Hamas-linked addresses at the time of seizure: the seized infrastructure allowed agents to capture funds before they reached their intended destination. It also handed the FBI access to server logs, user contact records, and communication metadata — the source of the thousands of donor identities now in counterterrorism files. A wallet blacklist blocks future transactions. A server seizure captures everything the server saw.
ⓒ 2026 TECHTIMES.com All rights reserved. Do not reproduce without permission.
Source: www.techtimes.com