The FBI successfully traced and seized more than $560,000 in cryptocurrency intended for Hamas by combining blockchain analytics, human intelligence, and court-issued seizure warrants. The operation followed funds through shared wallets, cross-chain bridges, exchanges, and stablecoin accounts across three separate seizures in March, June, and October 2025, along with two infrastructure actions in 2026.
Shared Gas Wallets Revealed Network Connections
Federal investigators connected blockchain transactions with donation addresses from fundraising websites, encrypted communications, and human sources to build their cases. Using Chainalysis' Reactor blockchain investigation software, agents visualized how cryptocurrency flowed from individual donors into collection wallets before moving to operational accounts allegedly controlled by the Al Qassam Brigades, Hamas' military wing.
Multiple addresses connected to the Al Qassam Brigades relied on the same gas wallet to pay blockchain transaction fees. Gas wallets supply the network tokens needed to execute transfers, and this repeated funding from the same address became a crucial connection point linking otherwise separate wallets in the network.
Tracing Evolved as Methods Changed
Investigators extended the investigation during the June 2025 case by following funds through newly identified addresses and accounts. The analysis revealed how cryptocurrency moved from donation wallets through operational accounts and consolidation points before reaching outside services, including accounts believed associated with a Lebanon-based over-the-counter broker.
After the initial seizure, Hamas altered its transaction methods. By October 2025, the network employed single-use donation wallets and cross-chain bridges to transfer cryptocurrency between blockchains. Federal agents continued tracking the funds across those services, leading to a third seizure warrant issued on October 10, 2025.
Recurring Wallet Patterns Provided Investigative Leads
Although individual addresses changed, the network maintained consistent wallet functions: donation wallets received contributions, gas wallets funded transaction fees, operational wallets moved assets, and consolidation addresses gathered cryptocurrency from multiple sources. This recurring structure preserved behavioral patterns visible to analysts even as new addresses replaced older ones.
The network's continued interaction with over-the-counter brokers and cryptocurrency exchanges created investigative endpoints where blockchain addresses connected to customer accounts and transaction records, enabling law enforcement coordination with these services.
Court Orders Authorized Asset Control
A June 2025 seizure warrant directed Tether to burn USDT held at specified addresses and reissue an equivalent amount to a law enforcement-controlled wallet. Binance was instructed to transfer balances from three named accounts into FBI-controlled wallets. The March 2025 seizure, involving approximately $200,000, had traced funds from at least 17 rotating addresses into a centralized wallet and onward through exchanges and brokers.
Intelligence from earlier seizures provided new investigative leads for subsequent cases. Findings eventually extended the investigation beyond fund transfers to identify domains and servers allegedly connected to the Al Qassam Brigades' principal website. Seizing that infrastructure in July and August 2026 enabled the FBI to intercept cryptocurrency donations at their point of solicitation.
