U.S. investigators used blockchain tracing, intelligence from human sources, and court-authorized seizures to track more than $560,000 in cryptocurrency allegedly intended for Hamas. The investigation followed funds through multiple wallets, blockchain bridges, exchanges, brokers, and stablecoin accounts, showing how investigators can connect changing crypto addresses to a broader financial network.
Shared Gas Wallets Helped Investigators Connect Addresses
The FBI’s investigation combined blockchain transaction data with cryptocurrency addresses collected from fundraising websites, encrypted communications, and information provided by human sources.
Three major cryptocurrency seizures took place in March, June and October 2025. The broader investigation also resulted in actions targeting online infrastructure allegedly associated with the fundraising operation during 2026.
According to Chainalysis, investigators discovered that multiple wallets associated with Hamas’ military wing, the Al Qassam Brigades, were funded by the same wallet used to pay blockchain transaction fees.
This type of wallet, commonly called a gas wallet, provides the cryptocurrency needed to process transactions on a blockchain. When otherwise unrelated addresses repeatedly receive transaction fees from the same source, that activity can provide investigators with an additional link between them.
FBI investigators reportedly used blockchain-analysis software to map the movement of funds between donation addresses, operational wallets and cryptocurrency services.
The resulting transaction graphs helped investigators identify relationships between individual contributors, collection wallets and addresses allegedly associated with the wider fundraising infrastructure.
Similar wallet connections were cited in affidavits supporting the seizure actions conducted during 2025.
Investigators Followed the Money Through Brokers and Bridges
The investigation expanded as agents identified additional wallets and accounts during the June 2025 operation.
Rather than moving directly from donors to a final destination, the cryptocurrency reportedly passed through multiple stages. Funds were collected in donation wallets, transferred into operational addresses and eventually consolidated before reaching external cryptocurrency services.
Investigators identified accounts that appeared to be connected to an over-the-counter cryptocurrency broker in Lebanon, while another account reportedly showed characteristics associated with a potential money mule.
The network also changed its methods following the initial seizure.
By October 2025, investigators reportedly observed the use of single-use donation addresses and blockchain bridges. Bridges allow digital assets to move between different blockchain networks, potentially making transaction trails more complicated to follow.
However, changing wallets or moving assets between blockchains does not automatically erase the underlying transaction history.
Public blockchains maintain permanent transaction records, allowing investigators to examine earlier transfers and compare them with later activity. Analysts can then combine blockchain information with records from exchanges, brokers, communications platforms and other sources to establish links between addresses and real-world entities.
Changing Wallets Did Not Eliminate the Network’s Patterns
One of the most important elements of the investigation was reportedly the repeated use of different wallet types for similar purposes.
According to the analysis, donation addresses were used to collect funds, separate wallets provided transaction fees, operational addresses moved the assets, and consolidation wallets brought funds together from multiple sources.
Even when individual addresses were replaced, these recurring roles created patterns that investigators could use to identify new activity.
This illustrates a key characteristic of blockchain investigations: an address can change, but transaction behavior can remain recognizable.
Similar investigative techniques have been used in other cryptocurrency cases, where analysts combine blockchain data with information from exchanges and service providers to turn transaction activity into investigative leads.
Cryptocurrency exchanges and over-the-counter brokers can be particularly valuable because they may provide a connection between blockchain addresses and customer information.
In another terrorism-financing investigation, authorities identified wallets associated with illicit activity and worked with Tether to freeze and reissue approximately $1.6 million in USDT.
Blockchain analysis can reveal where cryptocurrency has moved, but investigators still generally need the appropriate legal authority before taking control of identified assets.
Court Orders Turn Transaction Intelligence Into Asset Seizures
Blockchain analysis was only one part of the FBI’s operation.
Once investigators identified potentially connected assets, court-issued seizure warrants provided the legal authority needed to take control of funds held at cooperating cryptocurrency services.
A June 2025 warrant included in the Justice Department’s later disclosure instructed Tether to destroy USDT held at specified addresses and issue an equivalent amount to a wallet controlled by law enforcement.
The warrant also directed Binance to transfer cryptocurrency held in three identified accounts into FBI-controlled wallets.
The process demonstrates the relationship between blockchain intelligence and traditional law enforcement.
Blockchain analysis can help investigators determine where funds are located and how they moved, while court orders provide the legal mechanism for securing those assets.
Earlier Seizure Helped Expand the Investigation
The March 2025 operation provided an important foundation for the subsequent cases.
That seizure involved approximately $200,000 in cryptocurrency and focused on at least 17 addresses that investigators associated with a rotating donation system.
According to the investigation, funds from those addresses were consolidated and subsequently moved through cryptocurrency exchanges and brokers.
The transaction history generated during the first investigation reportedly provided investigators with new addresses and other leads that contributed to the June and October operations.
In other words, the investigation developed progressively rather than relying on a single wallet or transaction.
Each seizure produced additional information that could be used to identify new addresses, intermediaries and infrastructure.
Online Infrastructure Became Another Investigative Lead
The investigation eventually moved beyond cryptocurrency transactions themselves.
By combining information gathered from earlier cases with blockchain relationships, investigators reportedly identified domains and servers allegedly connected to websites used by the Al Qassam Brigades.
The FBI subsequently seized portions of that infrastructure during operations in July and August 2026.
Taking control of the websites and associated servers provided investigators with another opportunity to disrupt fundraising activity at its source.
It also demonstrated how blockchain investigations can extend into the broader digital infrastructure surrounding cryptocurrency fundraising.
The Bigger Picture for Crypto Investigations
The case illustrates how cryptocurrency’s transparent transaction history can work both for and against users attempting to conceal financial activity.
Rotating wallets, stablecoins, blockchain bridges and intermediary services can make investigations more complicated, but they do not necessarily make transactions invisible.
Investigators can combine onchain data, wallet behavior, exchange records, communications, human intelligence and court-authorized actions to reconstruct financial networks that may initially appear fragmented.
For law enforcement, the ability to connect seemingly unrelated addresses can provide a powerful investigative tool.
For cryptocurrency businesses, the case also reinforces the importance of transaction monitoring, compliance systems and cooperation with lawful investigations.
Ultimately, the FBI’s actions show that tracing cryptocurrency is not simply about following a single wallet from point A to point B. The more complex investigation involves identifying recurring patterns, finding the intermediaries that connect the network, and combining blockchain evidence with information from the traditional financial and digital worlds.
