Latest How FBI Traced and Seized $560K in Crypto From Hamas’ Network in Cryptocurrency

Blockchain technology FBI agents combined blockchain analytics, human intelligence, and court orders to trace and seize more than $560,000 in cryptocurrency intended for Hamas. The operation followed funds through shared wallets, cross-chain bridges, exchanges, and stablecoin accounts. Key Takeaways Shared gas wallets connected rotating addresses to a wider network. A seizure warrant directed crypto firms to transfer targeted assets. Earlier findings helped agents pursue new wallets and infrastructure. Shared Gas Wallets Expose a Wider Network Federal investigators built the seizure cases by connecting blockchain transactions with donation addresses obtained from fundraising websites, encrypted communications, and human sources.

The three cryptocurrency seizures occurred in March, June, and October 2025, while the broader $560,000 enforcement operation also included two actions against online infrastructure in 2026. Rotating donation addresses did not prevent agents from finding connections between apparently separate transactions. According to Chainalysis’ Sept. 3 account of the investigation, numerous addresses linked to Hamas’ military wing, the Al Qassam Brigades, depended on the same gas wallet to pay blockchain transaction fees.

A gas wallet supplies the network tokens needed to execute transfers, making repeated funding from the same address a connection point among otherwise separate wallets. FBI agents used Reactor, blockchain investigations software that analyzes cryptocurrency transactions and visualizes connections between wallets and services, to visualize cryptocurrency entering a donation wallet before moving into an operational wallet. The graph placed individual donors around the collection address and traced the subsequent transfer to infrastructure allegedly controlled by the Al Qassam Brigades. The same gas-wallet connections appeared in affidavits supporting the March, June, and October 2025 seizure actions. Chainalysis Reactor graph showing cryptocurrency flowing from donors into an Al Qassam Brigades donation wallet and then to an operational wallet. Source: Chainalysis. Tracing Expanded From Addresses to Intermediaries Investigators extended the original transaction trail during the June 2025 case by following funds through newly identified addresses and accounts.

The analysis revealed how cryptocurrency was gathered from donation wallets, moved through operational accounts, and consolidated before reaching outside services. One account was believed to be associated with a Lebanon-based over-the-counter broker, while another displayed activity consistent with a money mule. Hamas changed its transaction methods after the initial seizure, according to Chainalysis. By October 2025, the network was employing single-use donation wallets and bridges, which transfer cryptocurrency from one blockchain to another. Agents continued following the funds across those services, and a third seizure warrant issued Oct. 10, 2025, covered assets identified during the investigation. Changing an address or blockchain altered the route without deleting the earlier transaction record.

The permanent nature of public blockchain activity allowed analysts to revisit prior transfers, compare transaction patterns, and connect later activity with infrastructure found during earlier cases. Address analysis could then be combined with records from exchanges, brokers, communications platforms, and other sources. Recurring Wallet Roles Preserve the Financial Pattern Although individual addresses changed, Chainalysis noted that the network continued assigning similar functions to its wallets.

Donation wallets received contributions, gas wallets funded transaction fees, operational wallets moved the assets, and consolidation addresses gathered cryptocurrency from multiple sources.  » …

About Post Author

Carla Contass

See author's posts