Summary
-
- The U.S. Justice Department has seized $560,000 in cryptocurrency from Hamas-linked fundraising campaigns and shut down elements of the terrorist group’s digital infrastructure across five related actions.
- Blockchain analytics tools helped investigators trace crypto flowing into Hamas donation addresses and through operational wallets, across bridges, and into exchanges.
- The cases show how blockchain investigations build over time, as on-chain evidence from earlier seizures helped investigators map wider financial networks and identify additional infrastructure.
The U.S. Justice Department announced on Sept. 1 that it has seized more than $560,000 in cryptocurrency tied to Hamas fundraising campaigns. According to the Department, courts authorized the FBI to seize the funds and disrupt websites and communications channels the terrorist group used to solicit donations and engage with its supporters.
The announcement brings together five related actions targeting Hamas’s cryptocurrency fundraising and online infrastructure. Spanning March 2025 to August 2026, the cases reflect how law enforcement has been able to identify and track on-chain activity linked to Hamas.
Public seizures like these offer a window into how crypto financing networks operate and evolve over time. Blockchain analytics played a key role in tracing Hamas’s crypto activity across these cases, according to the FBI affidavits.
Tracing Hamas’ crypto footprint
The investigation began with an initial March 2025 case involving the seizure of approximately $200,000 in stablecoins donated to Hamas. Investigators used blockchain analytics software to trace how Hamas operatives solicited donations from supporters, moved their funds into an operational wallet and passed it onward. We previously covered this case in more detail, including how Chainalysis Reactor supported the investigation.
A recurring gas wallet provided an important initial link in this first case. Investigators identified numerous addresses controlled by Hamas’ military wing, the al-Qassam Brigades, that relied on the same gas wallet to fund transactions. The Chainalysis Reactor graph the FBI used in its affidavit — recreated here to highlight the gas wallet’s links — illustrates how blockchain analytics can uncover the wider networks behind individual transactions.
FBI agents continued to build on this initial investigation throughout 2025. As referenced in a June 2025 affidavit, blockchain analytics enabled investigators to further trace the initial donations as the cryptocurrency moved through a web of new addresses and accounts, revealing how Hamas consolidated and moved funds. Authorities identified new accounts being used by Hamas, including one believed to be linked to a Lebanon-based OTC broker, as well as an account exhibiting patterns consistent with money mule activity.
Piecing together Hamas’ on-chain networks
Hamas adapted its techniques following the DOJ’s initial seizure in early 2025. The group started using bridging services to move crypto from one blockchain to another in an attempt to launder funds, an October 2025 affidavit explains, and moved toward single-use donation wallets. FBI agents followed the trail despite Hamas’ obfuscation attempts and issued a freeze order on certain assets, according to the affidavit.
But other elements of the operation remained the same. Notably, while Hamas cycled crypto addresses used for its donation infrastructure, they continued to make use of gas funding wallets, donation wallets, and consolidation wallets in a similar manner as before. Likewise, they continued to make use of a variety of OTCs and virtual currency exchanges.
The investigation ultimately extended beyond the flow of funds itself. More recently, in July and August 2026, U.S. authorities used the previous network findings to target online infrastructure allegedly used by Hamas to solicit the origin donations and communicate with supporters. According to the Justice Department, the FBI seized domains and servers associated with the al-Qassam Brigades’ main website, enabling investigators to intercept intended cryptocurrency donations and gather information about individuals attempting to contribute funds.
How blockchain analytics enables investigations to build over time
Taken together, these cases show how blockchain investigations can build on earlier findings to reveal wider financial networks and tactics. What began with individual donation addresses ultimately led investigators to additional wallets as well as consolidation infrastructure and alleged financial facilitators connected to Hamas’s broader global financing network.
Addresses and methods may change, but the underlying transaction history remains on-chain, allowing investigators to revisit earlier activity, identify new connections, and continue following the flow of funds as networks evolve.
FAQ
How has Hamas used cryptocurrency for fundraising?
According to U.S. authorities, Hamas and its military wing the al-Qassam Brigades have used cryptocurrency as one method of soliciting and moving funds. Donation addresses have been shared with supporters through websites and online communications channels, with funds subsequently moved through wallets, exchanges, and other crypto services.
What did U.S. authorities seize as part of the Hamas cryptocurrency investigation?
Across the five related actions announced in September 2026, U.S. authorities seized more than $560,000 in cryptocurrency and took control of domains and servers allegedly used by Hamas for fundraising and recruitment. The three cryptocurrency seizure warrants were executed in March, June, and October 2025, while additional actions targeting online infrastructure took place in July and August 2026.
How did the Hamas cryptocurrency investigation evolve between March 2025 and August 2026?
The investigation expanded over time from tracing specific donation addresses to identifying a broader network of wallets, exchanges, consolidation infrastructure, and alleged financial facilitators. Information uncovered in earlier cases helped investigators identify and trace additional activity in subsequent seizures, illustrating how blockchain investigations can build on previous findings as networks evolve.
How can blockchain analytics help trace terrorist financing?
Blockchain analytics can help investigators trace transactions between cryptocurrency addresses and identify connections between wallets, services, and other entities. In the Hamas cases, investigators followed funds from donation addresses through operational and consolidation wallets, cross-chain activity, and exchange accounts, while shared infrastructure helped connect activity that might otherwise have appeared unrelated.
What is Chainalysis Reactor?
Chainalysis Reactor is blockchain investigations software that enables investigators to analyze cryptocurrency transactions and visualize connections between wallets and services. In investigations such as these, blockchain analysis can help turn individual transactions and addresses into a broader picture of how funds move across a network.
This website contains links to third-party sites that are not under the control of Chainalysis, Inc. or its affiliates (collectively “Chainalysis”). Access to such information does not imply association with, endorsement of, approval of, or recommendation by Chainalysis of the site or its operators, and Chainalysis is not responsible for the products, services, or other content hosted therein.
This material is for informational purposes only, and is not intended to provide legal, tax, financial, or investment advice. Recipients should consult their own advisors before making these types of decisions. Chainalysis has no responsibility or liability for any decision made or any other acts or omissions in connection with Recipient’s use of this material.
Chainalysis does not guarantee or warrant the accuracy, completeness, timeliness, suitability or validity of the information in this report and will not be responsible for any claim attributable to errors, omissions, or other inaccuracies of any part of such material.
