On September 1, the US Department of Justice announced the seizure of more than $560K in crypto linked to Hamas fundraising campaigns. According to the department, courts authorised the FBI to seize these funds and to take down the websites and communication channels the terrorist organisation used to solicit donations and interact with its supporters.
Public reports of seizures make it possible to see how crypto funding networks work and change over time. According to the FBI affidavits, blockchain analysis played an important role in tracking Hamas's crypto activity in these cases.
Tracing Hamas's crypto trail
The investigation began with the first case in March 2025, involving the seizure of about $200K in stablecoins donated to Hamas. Investigators used blockchain analysis software to trace how Hamas representatives collected donations from supporters, moved the proceeds to an operational wallet and then moved them on. This case has already been covered in detail, including how analytics tools helped the investigation.
The flow-of-funds graph used by the FBI in the case materials, and recreated here to show this wallet's connections, illustrates how blockchain analysis makes it possible to uncover the broader networks behind individual transactions.
Throughout 2025, FBI agents continued to build on the original investigation. As stated in the June 2025 affidavit, blockchain analysis allowed investigators to keep tracing the original donations as the crypto moved through a network of new addresses and accounts. This made it possible to establish how Hamas consolidated and moved funds. The authorities discovered new accounts used by Hamas, including one thought to be linked to an over-the-counter crypto broker in Lebanon, as well as an account showing signs of activity typical of so-called money mules.
How machine learning helps blockchain investigations, and where it cannot be trusted — in a separate articleHow the structure of Hamas's blockchain networks was reconstructed
After the US Department of Justice's initial seizure in early 2025, Hamas adapted its methods. The organisation began using bridge services to move crypto from one blockchain to another in an attempt to make the origin of the funds harder to trace, the October 2025 affidavit says. It also increasingly used separate wallets intended to receive donations only once. Despite the attempts to conceal the movement of funds, FBI agents kept tracking them and, according to the affidavit, secured the freezing of certain assets.
Various over-the-counter services and crypto exchanges also remained in use.
Ultimately, the investigation went beyond directly following the money. Later, in July and August 2026, the US authorities used the results of the earlier network analysis to target the online infrastructure allegedly used by Hamas to solicit the initial donations and communicate with supporters.
How the Shelbit exchange worked and why it fell under US sanctions — in a separate articleHow blockchain analysis lets investigations build on themselves
Taken together, these cases show how blockchain investigations can build on earlier results and gradually reveal broader financial networks and the methods behind them. What began with individual donation addresses eventually allowed investigators to uncover additional wallets, consolidation infrastructure and suspected financial intermediaries tied to Hamas's wider global funding network.
That lets investigators go back to operations carried out earlier, find new connections and keep tracking the movement of funds as financial networks change and adapt.
