Shared gas wallets opened the investigation
Investigators connected apparently unrelated crypto addresses to Hamas’ military wing by watching how wallets paid transaction fees. The U.S. FBI built the cases from traces left on public blockchain ledgers, donation addresses obtained from fundraising sites, encrypted messages, and human sources. Three seizures happened in March, June, and October 2025. Later, in 2026, the operation also included two actions against websites and servers.
According to Chainalysis’s Sept. 3 account of the investigation, multiple addresses tied to Al Qassam Brigades used the same gas wallet to cover transaction fees. Gas wallets hold network tokens needed to send crypto. When the same wallet repeatedly pays fees for different addresses, that creates a link. FBI analysts used Reactor, a blockchain tracing tool, to map donations flowing into a collection wallet and then moving to operational wallets. That shared gas wallet pattern appeared in the affidavits for all three seizures.
Tracing followed funds through new routes
The investigation did not stop after the first case. In June 2025, agents followed funds through newly discovered accounts. Some assets went through services consistent with an over-the-counter broker based in Lebanon; others matched activity of a money mule. Hamas reportedly adjusted its methods after the first seizure. By October 2025, the network was using single-use donation wallets and bridges that transfer assets between blockchains. Agents still followed the funds and obtained another warrant on Oct. 10.
One detail stands out: changing an address or chain does not erase earlier transactions. Public ledgers stay permanent. That allowed analysts to compare old records and tie later wallets to known infrastructure. Blockchain data could then be matched with exchange records, broker accounts, and communications platforms.
Recurring wallet patterns kept the operation visible
Hamas appeared to swap out addresses but kept the same wallet roles. Donation wallets received contributions, gas wallets paid fees, operational wallets moved money, and consolidation addresses gathered funds. Those repeated roles gave investigators behavioral patterns even when addresses changed. Related work under Operation Lighthouse also turned address data into leads.
The network kept using over-the-counter brokers and exchanges. Those services became endpoints where an address could be connected to a customer account or stored assets. In a separate terror financing case, Tether froze and reissued roughly $1.6 million in USDT after authorities identified wallets.
Court orders converted intelligence into seizures
Blockchain tracing could show where money went, but it could not by itself take control of it. The FBI needed court warrants. In June 2025, a warrant directed Tether to burn USDT at specified addresses and reissue the amount to an FBI-controlled wallet. Binance also received instructions to move balances from three accounts to FBI wallets.
The March 2025 seizure of about $200,000 followed funds from 17 rotating addresses into one central wallet and then through exchanges and brokers. That trail gave agents new starting points for June and October. Eventually the accumulated links expanded beyond transfers. Earlier findings helped identify domains and servers tied to Al Qassam Brigades’ main site. Seizing that infrastructure in July and August 2026 let FBI intercept donations at the moment they were solicited.
