- Courts authorised the FBI to seize more than $560,000 in cryptocurrency linked to Hamas fundraising operations and to dismantle parts of the group's digital presence across five connected enforcement actions.
- Investigators relied on blockchain tracing software to follow cryptocurrency from donation addresses into operational accounts, through bridge protocols and into exchange platforms.
- The enforcement actions demonstrate how on-chain evidence gathered in early seizures enabled agents to map broader financing networks and uncover additional infrastructure as the investigation progressed.
Five enforcement actions targeting Hamas crypto operations
On Sept. 1, 2026, the U.S. Justice Department disclosed that it had taken control of cryptocurrency and online infrastructure tied to Hamas fundraising schemes. The disclosure consolidates five separate enforcement actions executed between March 2025 and August 2026, each targeting different elements of the same financing network.
Court filings show that agents traced digital assets flowing through wallets controlled by Hamas and its military wing, the al-Qassam Brigades, and disrupted websites and communication channels the organisation used to request funds and maintain contact with donors. The affidavits describe how blockchain analysis allowed investigators to reconstruct transaction flows and identify the services Hamas used to move and convert cryptocurrency.
Mapping initial crypto flows
The first seizure, executed in March 2025, recovered approximately $200,000 in stablecoins donated to Hamas. Agents used blockchain tracing tools to document how Hamas operatives requested contributions from backers, transferred the proceeds to an operational address and moved them forward. The affidavit filed in that case details the role of a gas wallet—a funding address used to pay transaction fees—that appeared across multiple addresses controlled by the al-Qassam Brigades.
That gas wallet became a key link. Investigators identified numerous addresses that drew on the same gas funding source to execute transactions. Visualisation software allowed agents to map the connections between individual transactions and the wider network of addresses relying on shared infrastructure. The affidavit includes a Reactor graph illustrating those connections and showing how a single piece of shared infrastructure can reveal operational relationships that would otherwise remain hidden.
By June 2025, agents had expanded the investigation to trace how Hamas consolidated and redistributed the initial donations. The affidavit filed that month describes how cryptocurrency moved through a series of new addresses and accounts. Investigators identified an account they believe was linked to a Lebanon-based OTC broker, as well as another account displaying activity consistent with money mule patterns.
Adapting tactics and continuing the trace
Following the March 2025 seizure, Hamas changed its operational methods. An October 2025 affidavit explains that the group began using bridge protocols to transfer cryptocurrency between blockchains in an effort to obscure the trail. Hamas also shifted toward single-use donation wallets rather than reusing the same addresses. Despite those changes, agents continued to follow the funds. The affidavit describes a freeze order issued on certain assets as part of that effort.
Other aspects of the operation remained consistent. Hamas continued to rely on gas wallets, donation addresses and consolidation accounts in a similar configuration. The group also continued to use a range of OTC desks and exchange platforms to convert and move funds. Those recurring patterns allowed investigators to maintain visibility even as individual addresses cycled.
In July and August 2026, the investigation extended beyond tracing funds. Authorities used the network intelligence gathered in earlier actions to target the online infrastructure Hamas allegedly used to solicit donations and communicate with supporters. The Justice Department states that the FBI seized domains and servers associated with the al-Qassam Brigades' main website, enabling agents to intercept donation attempts and collect information about individuals trying to send funds.
Building investigations from on-chain evidence
The five cases illustrate how blockchain investigations can expand from initial findings to expose broader networks. What began with tracing individual donation addresses led investigators to additional wallets, consolidation infrastructure and alleged financial facilitators connected to Hamas's wider financing operation.
Addresses and methods may shift, but the transaction history remains recorded on-chain. That permanence allows investigators to revisit earlier activity, identify new connections and continue tracing the flow of funds as networks adapt. In the Hamas cases, information uncovered in the March 2025 seizure informed the June and October 2025 actions, and network intelligence gathered across all three cryptocurrency seizures supported the July and August 2026 infrastructure takedowns.
The affidavits describe how agents used Chainalysis Reactor—blockchain investigations software that enables analysis of cryptocurrency transactions and visualisation of connections between wallets and services—to support the investigation. In these cases, blockchain analysis turned individual transactions and addresses into a broader picture of how funds moved across the network.
Across the three cryptocurrency seizure warrants executed in March, June and October 2025, U.S. authorities recovered more than $560,000 in cryptocurrency. The additional actions in July and August 2026 took control of domains and servers allegedly used by Hamas for fundraising and recruitment. The investigation evolved from tracing specific donation addresses to identifying a network of wallets, exchanges, consolidation infrastructure and alleged financial facilitators.
According to U.S. authorities, Hamas and the al-Qassam Brigades used cryptocurrency as one method of soliciting and moving funds. Donation addresses were shared with supporters through websites and online communications channels, with funds subsequently moved through wallets, exchanges and other cryptocurrency services. Investigators followed funds from donation addresses through operational and consolidation wallets, cross-chain activity and exchange accounts, while shared infrastructure helped connect activity that might otherwise have appeared unrelated.
Source: www.chainalysis.com