# DOJ/FBI Seize $560,000 in Hamas-Linked Cryptocurrency Fundraising Network

> The U.S. Justice Department and FBI, using Chainalysis blockchain analytics, seized more than $560,000 in cryptocurrency raised by Hamas and its military wing, the al-Qassam Brigades, across five court-authorized actions from March 2025 to August 2026, and took over the group's donation infrastructure including its main website, AlQassam.ps.

- **Published:** 2026-09-03T00:00:00Z
- **Last reviewed:** 2026-09-03T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2309
- **ID:** TL-2026-2309
- **Severity:** MEDIUM
- **Category:** THREAT_INTEL
- **Status:** MITIGATED
- **Actor:** Hamas
- **Detections:** 9 · **IOCs:** 21 (full data via the Threadlinqs MCP server — Purple tier)

## Description

On September 1, 2026, the Justice Department announced it had confiscated over $560,000 in cryptocurrency destined for Hamas and the Izz ad-Din al-Qassam Brigades, culminating a counter-terror-financing investigation led by the FBI's Albuquerque Field Office (with support from the FBI Counterterrorism Division, Cyber Division, and New York Field Office). Al-Qassam Brigades operatives used an encrypted Telegram group chat to direct supporters to a fundraising website and a rotating set of cryptocurrency donation addresses; human sources also identified a Telegram message directing supporters to contact an al-Qassam Brigades email address for donation instructions. Investigators, supported by Chainalysis blockchain analytics, traced funds moving from donation wallets through consolidation wallets and shared gas-funding wallets, across blockchain bridges (including Tron-to-Binance Smart Chain conversions with no apparent economic purpose other than concealing fund origin), and out through virtual currency exchange accounts (Binance, and reportedly Trust Wallet and Bybit) and at least one Lebanon-based over-the-counter (OTC) broker exhibiting money-mule-like transaction patterns.

Three federal seizure/freeze warrants were executed on March 25, 2025 (an initial ~$201,400 seizure from addresses that had received over $1.5 million in donations since October 2024), June 25, 2025, and October 10, 2025, proceeding under 18 U.S.C. § 981(a)(1)(G) (terrorism-related civil forfeiture) and 18 U.S.C. § 2339B (material support to a designated Foreign Terrorist Organization), which allowed asset seizure without a prior criminal prosecution of the foreign operatives involved. Court filings identified Bitcoin, Ethereum, Wrapped Ethereum, Tether (USDT), and Tron across 18 Tether-controlled addresses and three Binance accounts tied to the financing of a designated Foreign Terrorist Organization; reporting also indicates some exchange accounts in the fund-movement chain were registered using the identities of Palestinians living in Turkey and using Lebanese passports, consistent with KYC-evasion via fraudulent or mule identities. After the initial seizure, al-Qassam Brigades operators adapted by abandoning recurring gas wallets in favor of single-use, disposable donation addresses to frustrate tracing.

On July 29, 2026 and August 18, 2026, the FBI executed two further actions that seized the domains and servers al-Qassam Brigades controlled — including its primary website AlQassam.ps and the related AlAqsaFlood.org / Host.AlAqsaFlood.org infrastructure — allowing the Bureau to intercept in-progress donations and obtain contact information and online communication records for thousands of individuals who had reached out to Hamas-linked platforms seeking to donate. Reporting indicates this fundraising infrastructure was originally hosted on servers in Iran before being migrated to servers operated by companies with U.S.-based data centers. The al-Qassam Brigades' crypto-fundraising apparatus dates back at least to January 2019, when the group first solicited Bitcoin donations via social media posts before moving to a dedicated fundraising site (alqassam.net) offering donors a link (fund.alqassam.net) that displayed a QR code and wallet address to scan or copy; after prior takedowns the group adapted by embedding third-party payment processors directly into its fundraising web pages.

The operation is part of a broader, ongoing DOJ campaign against Hamas's crypto-enabled financing: in July 2025 the Department unsealed a related civil forfeiture complaint against approximately $2 million in digital currency tied to BuyCash Money Transfer and Exchange Company, a Gaza-based virtual-asset business operating since 2014 and owned by Ahmed M.M. Alaqad, which OFAC designated on October 18, 2023 under Executive Order 13224 for providing material support to Hamas (and, per the same designation, to al-Qa'ida- and ISIS-affiliated actors). TRM Labs' review of that case traced funds across nearly 150 wallets linked to BuyCash, including rapid inter-wallet transfers establishing operational links between addresses before liquidation through identified exchange accounts. Separately, Israeli police froze Hamas-linked Binance accounts in 2023, and Binance froze roughly 14% of over 1,500 wallets flagged by Israeli authorities in 2024.

Financial tracing indicates the fundraising network's donation addresses received approximately 1.57 million USDT between late October 2024 and March 2025, and Chainalysis/DOJ court filings estimate the network had received over $3 million in total cryptocurrency by November 2025 — meaning the ~$560,000 in FBI seizures represents only a fraction of funds actually raised, with the remainder presumed laundered out through the OTC/exchange off-ramp chain before interdiction. The fundraising infrastructure's hosting relied on an Iran-based provider in Tehran until spring 2026, when it was migrated to servers operated by companies with U.S.-based data centers — a jurisdictional shift that brought the infrastructure within reach of U.S. court orders and enabled the July-August 2026 seizure actions. This is not al-Qassam Brigades' first crypto-fundraising network to be dismantled: in August 2020, the DOJ announced what was then described as the largest-ever seizure of cryptoassets belonging to terrorist organizations, targeting parallel al-Qassam Brigades and Syria-based al-Qaeda-affiliated fundraising operations; Elliptic had first reported on the al-Qassam Brigades' Bitcoin solicitation campaign in April 2019, and later research tied a Syria-based exchange operating via Telegram from Idlib, BitcoinTransfer, and a Turkish national, Mehmet Akti, to laundering al-Qassam donations through a major Asia-based exchange — establishing a recidivist pattern across at least three enforcement cycles (2019-2020, 2023 BuyCash designation, and the 2025-2026 actions detailed here). Officials framed the actions as a continuing disruption campaign rather than a one-time strike. Assistant Attorney General John A. Eisenberg said the seizures 'deprive Hamas of resources it relies on to recruit and radicalize individuals online' and that the Department will 'continue to tighten the vise on Hamas's capacity for terror by infiltrating its online networks, confiscating its cryptocurrency, and shutting down its websites.' U.S. Attorney Jeanine Ferris Pirro (D.C.) said, 'Your networks are not secure, your crypto is vulnerable, and we will not stop until your ability to wage war is defeated.' FBI Cyber Division Assistant Director Brett Leatherman noted the Bureau 'will continue to use its authorities to intercept illicit funds and prevent terrorist organizations from exploiting digital networks.'

## MITRE ATT&CK

- T1583.001 Domains
- T1583.003 Virtual Private Server
- T1583.006 Web Services
- T1585 Establish Accounts
- T1585.001 Social Media Accounts
- T1585.002 Email Accounts
- T1102.002 Bidirectional Communication
- T1589.002 Email Addresses
- T1583.004 Server
- T1573 Encrypted Channel

## Sources

- [FBI Seizes Hamas Crypto Fundraising Network](https://www.chainalysis.com/blog/fbi-seizes-hamas-crypto-fundraising-network/)
- [Justice Department Continues to Disrupt Hamas Terrorist Financing Schemes Through Seizures](https://www.justice.gov/opa/pr/justice-department-continues-disrupt-hamas-terrorist-financing-schemes-through-seizures)
- [DOJ Targets Hamas-Linked BuyCash Exchange in $2 Million Civil Forfeiture for Terrorist Financing](https://www.trmlabs.com/resources/blog/doj-targets-hamas-linked-buycash-exchange-in-2-million-civil-forfeiture-for-terrorist-financing)
- [In Wake of Attack on Israel, Understanding How Hamas Uses Crypto to Fund Its Operations](https://www.trmlabs.com/resources/blog/in-wake-of-attack-on-israel-understanding-how-hamas-uses-crypto)
- [The US Takedown of Crypto-Linked Terrorist Financing](https://www.elliptic.co/blog/the-us-takedown-of-crypto-linked-terrorist-financing)
- [FBI cracks Hamas crypto network, seizes $560,000 and exposes thousands of donors](https://www.ynetnews.com/tech-and-digital/article/hyciz00rumg)
- [DOJ Seizes $560K in Hamas Crypto Cash, Unmasks Thousands of Donors](https://hoodline.com/2026/09/doj-seizes-560k-in-hamas-crypto-cash-unmasks-thousands-of-donors/)
- [FBI Seizes $560K in Crypto Bound for Hamas, Takes Over Fundraising Sites](https://decrypt.co/377230/fbi-seizes-560k-crypto-hamas)
- [DOJ says Hamas crypto seizures reached $560,000 as FBI took over fundraising sites](https://www.coindesk.com/business/2026/09/02/doj-says-hamas-crypto-seizures-reached-usd560-000-as-fbi-took-over-fundraising-sites)
- [FBI, Justice Dep't seize $560,000 in Hamas cryptocurrency, takes over fundraising sites](https://www.jpost.com/international/article-907281)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2309