How FBI Traced and Seized $560K in Crypto From Hamas' Network

Shared Gas Wallets Expose a Wider Network

Federal investigators built the seizure cases by connecting blockchain transactions with donation addresses obtained from fundraising websites, encrypted communications, and human sources. The three cryptocurrency seizures occurred in March, June, and October 2025, while the broader $560,000 enforcement operation also included two actions against online infrastructure in 2026.

Rotating donation addresses did not prevent agents from finding connections between apparently separate transactions. According to Chainalysis’ Sept. 3 account of the investigation, numerous addresses linked to Hamas’ military wing, the Al Qassam Brigades, depended on the same gas wallet to pay blockchain transaction fees. A gas wallet supplies the network tokens needed to execute transfers, making repeated funding from the same address a connection point among otherwise separate wallets.

FBI agents used Reactor, blockchain investigations software that analyzes cryptocurrency transactions and visualizes connections between wallets and services, to visualize cryptocurrency entering a donation wallet before moving into an operational wallet. The graph placed individual donors around the collection address and traced the subsequent transfer to infrastructure allegedly controlled by the Al Qassam Brigades. The same gas-wallet connections appeared in affidavits supporting the March, June, and October 2025 seizure actions.