What began as a relatively simple trail — cryptocurrency sent to a Hamas-linked donation address — ultimately grew into a wide-ranging investigation spanning wallets, exchanges, blockchain bridges, financial intermediaries, and the online infrastructure used to solicit donations.

Between March 2025 and August 2026, U.S. authorities seized more than $560,000 in cryptocurrency linked to Hamas fundraising campaigns and disrupted parts of the group's digital fundraising infrastructure, according to the U.S. Justice Department and blockchain analytics firm Chainalysis. The case offers a detailed example of how blockchain investigations can evolve over time, with information from one seizure helping investigators identify previously unknown parts of a financial network. It is the latest chapter in a longer enforcement effort: Hamas' military wing, the al-Qassam Brigades, has publicly solicited cryptocurrency donations since at least 2019, when U.S. authorities unsealed charges against the group's crypto fundraising operators, and the U.S. Treasury has since sanctioned individuals and wallets tied to those campaigns.

First Seizure and the 'Gas Wallet' Discovery

The investigation's first major seizure, in March 2025, involved about $200,000 in stablecoins that had been donated to Hamas. Investigators traced the funds from a donation address to an operational wallet and then followed their movement through the network.

One of the key discoveries was a recurring "gas wallet" used to pay transaction fees for numerous addresses linked by investigators to Hamas' military wing, the al-Qassam Brigades. That connection helped investigators move beyond individual wallet addresses and begin mapping a broader network of related cryptocurrency accounts. The technique is a standard one in blockchain investigations: even when funds themselves are dispersed, the small operational payments needed to move them can reveal which addresses belong to the same operator.

As authorities followed the original funds through additional wallets and accounts, investigators identified accounts believed to be connected to an over-the-counter cryptocurrency broker in Lebanon, as well as another account showing patterns consistent with money-mule activity.

Shifting Tactics

The investigation also demonstrated how cryptocurrency fundraising networks can change their tactics after being identified. By late 2025, Hamas had begun using blockchain bridges to move assets between networks and had shifted toward single-use donation wallets, according to an FBI affidavit cited by Chainalysis. The changes were designed to make the movement of funds harder to follow. Bridges in particular have become a common focus of enforcement attention because they can obscure the link between funds on one blockchain and their destination on another.

Still, investigators were able to identify recurring infrastructure. Gas wallets, donation wallets, and consolidation wallets continued to appear, while funds also moved through cryptocurrency exchanges and over-the-counter services — giving investigators another way to connect seemingly unrelated transactions. When funds pass through regulated exchanges, investigators can also use legal process such as subpoenas and seizure warrants to obtain account records that blockchains alone do not contain.

From Tracking Money to Disrupting Infrastructure

The investigation eventually moved beyond following the money. In July and August 2026, U.S. authorities targeted websites, domains, and servers allegedly used by Hamas to solicit cryptocurrency donations and communicate with supporters. The FBI seized domains and servers associated with the al-Qassam Brigades' main website, according to the Justice Department. Investigators were also able to intercept intended cryptocurrency donations and gather information about people attempting to contribute funds.

What had started as an investigation into individual cryptocurrency transactions had therefore expanded into an effort to disrupt the infrastructure supporting the entire fundraising operation.

Building the Bigger Picture

The most significant feature of the investigation was not the size of the seizure, but how the case developed. Earlier blockchain evidence became a starting point for subsequent inquiries. Addresses that initially appeared isolated could be connected through transaction histories, shared funding infrastructure, and the services used to move the assets.

Even when wallet addresses and techniques changed, the historical transaction record remained available. This allowed investigators to return to earlier activity, identify new connections, and build a progressively larger picture of the network.

The case illustrates a fundamental characteristic of public blockchains: transactions may be pseudonymous, but they are not invisible. For investigators, the permanent record can turn a single cryptocurrency transfer into the first piece of a much larger financial map.

Source: BitcoinKE