Federal Investigators Use Blockchain Analysis to Seize Cryptocurrency Linked to Al Qassam Brigades

Federal investigators have traced and seized cryptocurrency funds connected to Hamas’ military wing, the Al Qassam Brigades, by analyzing blockchain transaction patterns that revealed a shared infrastructure across rotating donation addresses. The enforcement operation, which totaled approximately $560,000 in seizures, unfolded across three cryptocurrency actions in March, June, and October 2025, followed by two infrastructure seizures in July and August 2026.

Shared Gas Wallets Reveal Hidden Network Connections

According to a September 3 analysis by Chainalysis, investigators uncovered the network by identifying a critical vulnerability: numerous addresses linked to the Al Qassam Brigades relied on the same gas wallet to pay blockchain transaction fees. A gas wallet supplies the native network tokens required to execute transfers, and repeated funding from a single address created a persistent connection point among otherwise separate wallets.

FBI agents used Chainalysis Reactor, blockchain investigations software that visualizes cryptocurrency flows and wallet relationships, to map how funds moved from individual donors into a collection address and then into an operational wallet allegedly controlled by the Al Qassam Brigades. The same gas-wallet connections appeared in affidavits supporting the March, June, and October 2025 seizure actions.

Investigation Expands From Addresses to Intermediaries

During the June 2025 case, investigators extended the transaction trail by following funds through newly identified addresses and accounts. The analysis revealed how cryptocurrency was gathered from donation wallets, moved through operational accounts, and consolidated before reaching outside services. One account was believed to be associated with a Lebanon-based over-the-counter broker, while another displayed activity consistent with a money mule.

Hamas altered its transaction methods after the initial seizure, Chainalysis reported. By October 2025, the network employed single-use donation wallets and blockchain bridges — services that transfer cryptocurrency from one blockchain to another. Agents continued tracing funds across those services, and a third seizure warrant issued October 10, 2025, covered assets identified during the ongoing investigation.

Changing an address or blockchain altered the route without deleting the earlier transaction record. The permanent nature of public blockchain activity allowed analysts to revisit prior transfers, compare transaction patterns, and connect later activity with infrastructure uncovered during earlier cases. Address analysis was then combined with records from exchanges, brokers, communications platforms, and other sources.

Recurring Wallet Roles Preserve Financial Patterns

Although individual addresses changed, Chainalysis noted that the network continued assigning similar functions to its wallets. Donation wallets received contributions, gas wallets funded transaction fees, operational wallets moved the assets, and consolidation addresses gathered cryptocurrency from multiple sources. This recurring structure provided investigators with behavioral patterns that remained visible as new addresses replaced older ones. Comparable analysis during the Operation Lighthouse intelligence sprint converted blockchain addresses and service data into investigative leads.

The network also continued interacting with over-the-counter brokers and cryptocurrency exchanges. Those services created investigative endpoints where blockchain addresses could be connected with customer accounts, transaction records, or assets held by a custodian. In a separate terrorism-financing case, Tether froze and reissued approximately $1.6 million in USDT after authorities identified the associated wallets. The tracing process identified the route and location of the cryptocurrency, but court authorization was required before agents could take control of it.

Court Orders Convert Blockchain Intelligence Into Seizures

Blockchain tracing identified where the funds traveled, while court-issued seizure warrants provided the legal authority to take control of accessible assets. A June 2025 warrant published with the Justice Department’s September 1 disclosure directed Tether to burn USDT held at specified addresses and reissue an equivalent amount to a law enforcement-controlled wallet. Binance was instructed to transfer balances from three named accounts into FBI-controlled wallets.

The first action had already established how donation addresses fed a wider collection system. The March 2025 seizure involving approximately $200,000 followed funds from at least 17 rotating addresses into a centralized wallet and onward through exchanges and brokers. Intelligence developed from that trail supplied new starting points for the June and October investigations.

Chainalysis detailed how the accumulated wallet relationships eventually extended the investigation beyond fund transfers. Findings from the earlier cases helped agents identify domains and servers allegedly connected to the Al Qassam Brigades’ principal website. Seizing that infrastructure in July and August 2026 enabled the FBI to intercept cryptocurrency donations at their point of solicitation.