In Wake of Attack on Israel, Understanding How Hamas Uses Crypto

On Saturday October 7, 2023, the Gaza-based terrorist group Hamas launched a wide scale attack on Israel, launching thousands of rockets and, according to reports, killing more than 700 Israelis. While the use of cryptocurrency for fundraising and other terrorist financing activity remains relatively low compared to traditional fiat currency, there will be an increased focus on cutting off Hamas’ ability to raise and move funds in the coming days and weeks.

Fundraising efforts since the October 7 attacks

In previous rounds of violence involving Hamas, there was an uptick in fundraising activity. For example, in May 2021, following a major outbreak of violence in Gaza, addresses controlled by Hamas received over $400,000.

TRM has identified a number of fundraising efforts since the war began. For example, Gaza-based group GazaNow, which is actively supporting Hamas, is soliciting donations using a cryptocurrency address. The address, which was first active in August 2021, has received nearly $800,000 in total and less than $5000 since Saturday’s attacks. 

On October 9th, GazaNow announced that they were suspending their public fundraising efforts, directing supporters to reach out through personal messaging. An admin of the campaign would then provide a link to a fundraising campaign on Instagram. Within minutes that campaign was suspended as well. Another fundraising campaign called “Tofan al-Aqsa” – the name of the Hamas operation – is also soliciting donations through its Twitter account. As of the time of writing, the campaign has failed to raise significant funds.

‍

‍

In addition, on October 10, the cyber branch of the Israel Police’s Lahav 433 announced the seizure of cryptocurrency accounts belonging to Hamas. According to the Israeli Police, Hamas had been using accounts to raise money on social media since Saturday’s attacks. Lahav 433 is working with the Defense Ministry, Shin Bet, and other intelligence agencies in the effort to shut down cryptocurrency channels that terrorist groups are using. According to reports, cryptocurrency exchange Binance cooperated with Israel in locating and shutting down the accounts.

Hamas: The first terrorist organization to use cryptocurrency

Since at least early 2019, the Izz-Al Din-Al Qassam Brigades, Hamas' military arm, has attempted to use cryptocurrencies as an alternative fundraising method to support its military operations. Hamas initially tested cryptocurrency fundraising by soliciting Bitcoin donations on its Telegram channel before shifting to direct fundraising on its website, alqassam.net. 

In August 2020, the United States Department of Justice (DOJ) announced the global disruption of three terror financing campaigns including the seizure of cryptocurrency accounts associated with al-Qassam Brigades.

‍

According to the DOJ release, the “three terror finance campaigns all relied on sophisticated cyber-tools, including the solicitation of cryptocurrency donations from around the world.” In the first case, the al-Qassam Brigades posted a call on its social media page for bitcoin donations to fund its campaign of terror, then moved the request to its official websites. Working together, IRS-CI, HSI, and FBI agents tracked and seized 150 cryptocurrency accounts that laundered funds to and from the al-Qassam Brigades’ accounts. With judicial authorization, law enforcement seized the infrastructure of the al-Qassam Brigades websites and subsequently covertly operated alqassam.net.  During that covert operation, funds from persons seeking to provide material support to the terrorist organization were routed to wallets controlled by U.S. law enforcement.

U.S. and Israeli authorities target Hamas’ use of cryptocurrency

Over the last few years, Israel’s National Bureau for Counter Terror Financing (NBCTF) has repeatedly targeted Hamas’ use of cryptocurrency, seizing dozens of cryptocurrency addresses with tens of millions of dollars in volume, controlled by entities affiliated with Hamas. These include Gaza-based businesses such as Dubai Co. For Exchange, al-Muhtadon, al-Mutahadun For Exchange and al-Wefaq Co for Exchange. The overwhelming majority of the funds seized have been Tether on the Tron network. 

In July 2021, the NBCTF released a copy of an administrative seizure for Bitcoin, Dogecoin, TRON, and other cryptocurrency addresses controlled by agents of Hamas. The NBCF seizure revealed the growing sophistication of terrorist financing campaigns, which are now using multiple chains and currencies to evade sanctions and detection by law enforcement. A senior Hamas official reported to the Wall Street Journal in 2021 that its fundraising strategies continue to evolve as more restrictions are being placed on it. This evolution will likely involve a continued shift to multi-asset donations and increasingly sophisticated laundering methods.‍

According to TRM, following seizures by the Israeli government, Hamas and other Gaza-based militant groups stopped publicly publishing their cryptocurrency donation addresses and instead turned to payment processors, typically embedding them in their websites’ fundraising pages. 

In April 27, 2023, al-Qassam Brigades announced that it would stop receiving donations in Bitcoin “out of concern about the safety of donors and to spare them any harm,” adding that it had seen an “intensification of hostile efforts against anyone who tries to support the resistance through this currency.”

The Hamas, Hezbollah, and Iran connection

Israeli authorities have also seized addresses belonging to other groups supporting the attack on Israel. In July 2023, the NBCTF announced a seizure order of dozens of addresses linked to the group Palestinian Islamic Jihad (PIJ) who announced that they are participating in the ongoing attacks including through the holding of hostages.  A week earlier, the NCBTF seized millions of dollars worth of cryptocurrency belonging to the Lebanese terrorist group Hezbollah and Iran’s Islamic Revolutionary Guard Corps’ (IRGC) Quds Force. 

A total of 40 addresses were on NBCTF’s seizure list, all of which were USDT on the TRON network. This represents Israel’s largest terrorism related cryptocurrency seizure and the first that targets Hezbollah and its primary backer, the IRGC. According to Israeli authorities, the key address was controlled by Tawfiq Muhammad al-Law, a Syria-based hawala operator who worked with key Hezbollah and IRGC financiers. TRM identified on-chain links between the seized addresses and entities and exchanges located in Iran, Syria, Iraq and the Gaza strip, all of which have ties to the IRGC and Hezbollah.

Looking Ahead

As the digital world rapidly evolves, so too do the methods employed by groups like Hamas to finance their operations. The Israeli National Bureau of Counterterrorism Finance's recent seizures show both just how sophisticated these fundraising campaigns have become and law enforcement’s ability to track, trace and seize funds. TRM will continue to support its partners in Israel and across the world in stopping the use of cryptocurrencies to fund acts of terrorism.