The FBI said it traced and seized more than $560,000 in cryptocurrency that investigators linked to Hamas, using a mix of blockchain analysis, human intelligence and court-authorized actions. According to the account described in the source material, agents followed funds across rotating wallets, bridges, exchanges and stablecoin accounts before moving to freeze or transfer the assets.
The investigation shows how law enforcement tried to map a changing donation and payments system rather than rely on a single wallet. Officials said the trail connected donor funds to Hamas-linked collection and operational addresses, even as the network shifted tactics over time.
How investigators mapped the flow of funds
Agents reportedly used blockchain investigation software called Reactor to visualize the movement of cryptocurrency from donors to a Hamas donation wallet and then onward to an operational wallet. Shared gas wallets played a central role in the analysis, because they helped connect changing addresses to a broader network and allowed investigators to treat transactions that looked separate as part of the same structure.
From there, the FBI expanded its work beyond the first set of addresses. Investigators traced funds through additional wallets and accounts identified during the inquiry, following how assets were collected, transferred between operational accounts, consolidated and then sent to outside services. The source material says this process helped reveal a wider network rather than a single chain of transactions.
Patterns that persisted as tactics changed
According to the report, investigators found recurring wallet functions across the network. Donation wallets received contributions, gas wallets paid transaction fees, operational wallets moved assets and consolidation addresses gathered funds from different sources. Those repeated roles gave analysts behavioral markers that remained useful even when new wallet addresses appeared.
The article says Hamas had altered its methods by October 2025, including the use of single-use donation wallets and blockchain bridges to move assets between chains. Even so, investigators were able to revisit older on-chain activity and compare patterns over time, relying on the permanent record of public blockchain transactions to connect later activity to earlier infrastructure.
Links to brokers, exchanges and account holders
The inquiry also extended to intermediaries where digital asset activity met identifiable services. Some of the accounts examined appeared to be connected to a Lebanon-based over-the-counter broker, while others showed characteristics that investigators associated with money mules.
The network also touched exchanges and other service endpoints, which gave law enforcement places where wallet activity could be connected to customer accounts and available balances. That appears to have been an important bridge between blockchain intelligence and asset seizure.
Court orders turned tracing into seizures
Legal orders were described as a key part of the operation. A warrant issued in June 2025 directed Tether to burn USDT held at specified addresses and reissue the equivalent amount to an FBI-controlled wallet. Binance was also instructed to transfer balances from named accounts into wallets controlled by the bureau.
Earlier actions helped build the later case. The source says seizures beginning in March 2025, involving roughly $200,000 across at least 17 rotating addresses, helped investigators identify routes that were used in subsequent enforcement steps.
What came next in the investigation
The findings did not stop with wallet tracing alone. According to the source material, Chainalysis analysis helped extend the investigation to domain and server infrastructure linked to the Al Qassam Brigades, which investigators targeted in July and August 2026.
Taken together, the account presents the seizure as the product of repeated tracing, pattern matching and legal intervention across several stages. The confirmed next step described in the source was the move from crypto flows to related online infrastructure, suggesting that investigators treated the wallet network as part of a broader operational system.
Source: news.bitcoin.com