Rather than chasing individual donations, US Federal Bureau of Investigation (FBI) agents breached the fundraising mechanism itself. Working through its own informants, the FBI's Albuquerque Field Office traced the servers, domains, and rotating cryptocurrency addresses used to solicit donations for Hamas, allowing the bureau to take control of parts of that infrastructure.

According to an announcement from the US Justice Department (DOJ), the operation resulted in the seizure of nearly $560,000 in cryptocurrency intended for Hamas's military wing, the Al Qassam Brigades.

The case demonstrates that public blockchains can be turned against those funding illegal activity. The same transparency that allows donors to locate an address also enables investigators to track transactions, reconstruct the flow of funds, and determine where the money went. This is not the first time US authorities have targeted this fundraising apparatus: in 2019, the DOJ announced seizures of websites and cryptocurrency wallets linked to the Al Qassam Brigades' online fundraising campaign, illustrating that law enforcement has pursued this infrastructure-based approach for years.

How agents got inside the donation pipeline

According to the DOJ, the fundraising scheme used an encrypted group chat to direct supporters to a website and provide rotating crypto addresses. Rotating addresses can complicate tracing, but it did not stop investigators.

The FBI relied on several human sources to map the operation from the inside. Investigators then executed a series of cryptocurrency seizures under warrants granted on March 25, June 25, and October 10, 2025. Separate warrants issued in 2026 named domains and servers used to collect donations for Hamas and to operate the main website AlQassam.ps.

An unsealed seizure affidavit shows how far the takeover went. The affidavit identifies a server at IP address 45.134.141.68 belonging to DataCamp Limited and directs the service provider to block the server and point it toward law-enforcement-designated name servers. The seizure was approved by Magistrate Judge Matthew J. Sharbaugh.

Once investigators controlled the infrastructure, they could intercept incoming donations rather than waiting for the money to move before attempting recovery.

What the takeover exposed about donors

The funds raised were only part of what investigators learned. By taking possession of the fundraising mechanism, the FBI also obtained personal data on individuals who communicated with Hamas about donations, according to the Justice Department.

A review of the court documents by Decrypt identified Bitcoin, Ethereum, Wrapped Ethereum, Tether, and Tron used across 18 addresses controlled by Tether and three Binance accounts.

Tether plays a significant role because of its ability to freeze addresses. The June 2025 seizure warrant ordered Tether to burn USDT at designated addresses and reissue an equivalent amount to a law-enforcement-controlled account.

The case fits a broader trend. The FATF has warned about the use of stablecoins in illegal activities, while Chainalysis reports that stablecoins accounted for 84% of illicit crypto transactions in 2025.

"Your networks are not secure, your crypto is vulnerable, and we will not stop until your ability to wage war is defeated," said US Attorney Jeanine Ferris Pirro.

Brett Leatherman, Assistant Director of the FBI's Cyber Division, said the agency "will continue to use its authorities to intercept illicit funds and prevent terrorist organizations from exploiting digital networks."

Why the ledger keeps beating the fundraiser

There had already been a previous seizure tied to the same funding system. In March 2025, US authorities confiscated roughly $201,400 in USDT, of which $89,900 was held in crypto accounts and $111,500 in various other accounts. The fundraising addresses had transferred more than $1.5 million in total since October 2024, an event covered by Cryptopolitan at the time.

Subsequent reporting by the authorities shows the fundraising network did not stop operating. According to an August 2026 affidavit, blockchain analysis indicated the money flowing through the fundraising network reached roughly $3 million by November 2025. FBI human sources were still receiving donation instructions as recently as February 2026.

That distinction matters: the $201,400 seized in March is included in the $560,000 confiscated in total under the three 2025 warrants, while the $3 million figure refers solely to money received by the broader network that has not been seized.

Elliptic argues that cryptocurrency's traceability makes it a poor fundraising tool for terrorist organizations, but cautions against treating every transaction in a related wallet as funds actually raised by a terrorist group.

What infrastructure provider was identified in the warrant?

The FBI's Albuquerque office continues its investigation with support from its Counterterrorism and Cyber units, the Justice Department's National Security Division, and prosecutors from the District of Columbia.

The donor information gathered from the seized infrastructure may prove to be the most significant find. Future enforcement efforts could shift from targeting wallets and servers to pursuing individuals attempting to finance terrorists.

The warrant identified DataCamp Limited, headquartered at 9 Coldbath Square, London, United Kingdom, as the electronic service infrastructure provider controlling the server at IP address 45.134.141.68. The FBI affidavit states that DataCamp leases and controls the server, which was used to support the AlQassam.ps cryptocurrency fundraising operation.

The warrant did not accuse DataCamp itself of participating in Hamas's fundraising. It directed the company to assist in executing the seizure by redirecting the domain to FBI-controlled name servers and preventing further modification or transfer of the server.

A key data point: the FBI's Aug. 5, 2026 WHOIS lookup placed the server's IP address in São Paulo, Brazil, while identifying DataCamp Limited as its owner and provider.