The operation also enabled investigators to intercept additional donations and collect information on thousands of people around the world who contacted Hamas to donate or attempted to do so through cryptocurrency or traditional payment methods.
Gallery
FBI infiltrates Hamas fundraising network, seizes $560,000 in crypto and exposes thousands of donors
(Photo: Shutterstock)
According to the Justice Department, the infrastructure was controlled by Hamas on behalf of its military wing, the Al Qassam Brigades, and was used to solicit money globally, move funds outside the formal financial system and recruit supporters.
“These seizures deprive Hamas of resources it relies on to recruit and radicalize individuals online and finance barbaric attacks like the one on October 7, 2023,” said Assistant Attorney General for National Security John A. Eisenberg. “We will continue to tighten the vise on Hamas’s capacity for terror by infiltrating its online networks, confiscating its cryptocurrency, and shutting down its websites.”
The $560,000 figure does not represent a single new seizure. The Justice Department said it reflects a series of five court-authorized actions carried out in Washington: three cryptocurrency seizure warrants executed in March, June and October 2025, and two orders targeting online infrastructure in July and August 2026.
The first seizure, involving approximately $201,400, was announced publicly in March 2025. Newly released court documents now reveal the broader scope of an investigation that continued after Hamas operators apparently realized some of their wallets had been frozen and changed tactics.
Hamas’ rotating crypto network
According to FBI affidavits, the investigation began after human sources identified a Telegram message directing supporters to contact an Al Qassam Brigades email address for donation instructions.
In February 2025, those sources wrote to the address and received a response in Arabic several hours later containing a new wallet address for transferring USDT, a stablecoin designed to track the value of the U.S. dollar, over the Tron blockchain.
The instructions allegedly told donors not to disclose to currency exchangers who was ultimately receiving the money, to use fictitious recipient details and to avoid sending funds directly from Binance accounts.
Donors were instead advised to use services including Trust Wallet and Bybit. The Al Qassam Brigades also told supporters that wallet addresses would be changed regularly and were intended for one-time use.
But the effort to create disposable donation routes left a trail.
Cyber investigators found that many of the wallets received the TRX cryptocurrency needed to pay transaction fees from the same source, effectively creating what investigators could identify as a shared “gas” wallet.
Funds from the individual addresses also flowed into what the FBI identified as the same operational Al Qassam Brigades wallet.
According to one affidavit, that wallet received approximately 1.57 million USDT between late October 2024 and March 2025.
In a later document, the FBI estimated that the network had received more than $3 million in donations by November 2025 and continued distributing donation instructions through at least February 2026.
Court filings describe a months-long cat-and-mouse game.
After the first seizure became public in March 2025, network operators shifted toward single-use addresses and more complicated transaction routes.
Investigators said money was moved between the Tron and Binance Smart Chain networks and back again through conversion services in transactions that appeared to have no economic purpose other than concealing the source and destination of the funds.
Some of the cryptocurrency eventually reached accounts opened with Lebanese passports, while one was registered to a Palestinian national. Accounts seized in the first operation were also registered in the names of Palestinians living in Turkey and elsewhere.
Servers brought within US reach
The principal internet target was AlQassam.ps, the military wing’s main website, along with AlAqsaFlood.org and Host.AlAqsaFlood.org, domains supporting its email and fundraising operations.
According to the affidavits, the infrastructure relied until spring 2026 on an Iranian provider based in Tehran.
Iran is also part of it
(Photo: Rouhollah Vahdati/ISNA/WANA (West Asia News Agency)/AFP)
It later moved to servers operated by companies with data centers in the United States.
That shift brought the infrastructure within reach of U.S. court orders.
The providers were ordered to lock the servers, transfer control to the FBI and redirect visitors to government-controlled servers displaying seizure notices.
The FBI said gaining control of the infrastructure enabled it to intercept cryptocurrency donations intended for Hamas.
Using related investigative methods, agents also obtained information on thousands of individuals who contacted Hamas online in an effort to donate or attempted to donate through cryptocurrency and traditional financial channels.
The Justice Department said that information will be used in future counterterrorism investigations.
The FBI’s Albuquerque Field Office is leading the investigation in coordination with the bureau’s Counterterrorism Division, Cyber Division and New York Field Office. The Justice Department’s October 7th Task Force is also assisting.
“A message to Hamas: We will stop your fundraising for terror,” said U.S. Attorney Jeanine Ferris Pirro for the District of Columbia. “Your networks are not secure, your crypto is vulnerable, and we will not stop until your ability to wage war is defeated.”
FBI Cyber Division Assistant Director Brett Leatherman said Hamas had relied on cryptocurrency and online platforms “to solicit funds from donors around the world and move that money outside the formal financial system.”
“The FBI seized online infrastructure and $560,000 in cryptocurrency, capturing donations intended for the organization,” Leatherman said. “The FBI will continue to use its authorities to intercept illicit funds and prevent terrorist organizations from exploiting digital networks to finance their operations.”
A fundraising method dating back years
Hamas publicly appealed for Bitcoin donations as early as 2019 and at the time suggested such transactions could not be traced.
U.S. authorities demonstrated otherwise.
In 2020, the government seized approximately 150 cryptocurrency accounts linked to the Al Qassam Brigades and covertly took control of one of its fundraising websites, meaning donations sent by supporters were instead routed to wallets controlled by U.S. authorities.
In April 2023, Hamas announced that it would stop accepting Bitcoin because of concerns about donor security.
The new investigation shows that digital fundraising resumed less than two years later, this time relying heavily on USDT, rotating wallet addresses and more complex transaction routes.
In July 2025, the United States also launched a separate forfeiture action involving roughly $2 million in cryptocurrency allegedly linked to Gaza-based exchange BuyCash, which U.S. authorities said had provided financial services to Hamas and other terrorist organizations.