Key Takeaways
- Shared gas wallets connected rotating addresses to a wider network.
- A seizure warrant directed crypto firms to transfer targeted assets.
- Earlier findings helped agents pursue new wallets and infrastructure.
Shared Gas Wallets Expose a Wider Network
Federal investigators built the seizure cases by connecting blockchain transactions with donation addresses obtained from fundraising websites, encrypted communications, and human sources. The three cryptocurrency seizures occurred in March, June, and October 2025, while the broader $560,000 enforcement operation also included two actions against online infrastructure in 2026.
Rotating donation addresses did not prevent agents from finding connections between apparently separate transactions. According to Chainalysis’ Sept. 3 account of the investigation, numerous addresses linked to Hamas’ military wing, the Al Qassam Brigades, depended on the same gas wallet to pay blockchain transaction fees. A gas wallet supplies the network tokens needed to execute transfers, making repeated funding from the same address a connection point among otherwise separate wallets.
FBI agents used Reactor, blockchain investigations software that analyzes cryptocurrency transactions and visualizes connections between wallets and services, to visualize cryptocurrency entering a donation wallet before moving into an operational wallet. The graph placed individual donors around the collection address and traced the subsequent transfer to infrastructure allegedly controlled by the Al Qassam Brigades. The same gas-wallet connections appeared in affidavits supporting the March, June, and October 2025 seizure actions.
Tracing Expanded From Addresses to Intermediaries
Investigators extended the original transaction trail during the June 2025 case by following funds through newly identified addresses and accounts. The analysis revealed how cryptocurrency was gathered from donation wallets, moved through operational accounts, and consolidated before reaching outside services. One account was believed to be associated with a Lebanon-based over-the-counter broker, while another displayed activity consistent with a money mule.
Hamas changed its transaction methods after the initial seizure, according to Chainalysis. By October 2025, the network was employing single-use donation wallets and bridges, which transfer cryptocurrency from one blockchain to another. Agents continued following the funds across those services, and a third seizure warrant issued Oct. 10, 2025, covered assets identified during the investigation.
Changing an address or blockchain altered the route without deleting the earlier transaction record. The permanent nature of public blockchain activity allowed analysts to revisit prior transfers, compare transaction patterns, and connect later activity with infrastructure found during earlier cases. Address analysis could then be combined with records from exchanges, brokers, communications platforms, and other sources.
Recurring Wallet Roles Preserve the Financial Pattern
Although individual addresses changed, Chainalysis noted that the network continued assigning similar functions to its wallets. Donation wallets received contributions, gas wallets funded transaction fees, operational wallets moved the assets, and consolidation addresses gathered cryptocurrency from multiple sources. The recurring structure provided investigators with behavioral patterns that remained visible as new addresses replaced older ones. Comparable analysis during the Operation Lighthouse intelligence sprint converted blockchain addresses and service data into investigative leads.
The network also continued interacting with over-the-counter brokers and cryptocurrency exchanges. Those services created investigative endpoints where blockchain addresses could be connected with customer accounts, transaction records, or assets held by a custodian. In a separate terrorism-financing case, Tether froze and reissued approximately $1.6 million in USDT after authorities identified the associated wallets. The tracing process identified the route and location of the cryptocurrency, but court authorization was required before agents could take control of it.
Court Orders Convert Blockchain Intelligence Into Seizures
Blockchain tracing identified where the funds traveled, while court-issued seizure warrants provided the authority needed to take control of accessible assets. A June 2025 warrant published with the Justice Department’s Sept. 1 disclosure directed Tether to burn USDT held at specified addresses and reissue an equivalent amount to a law enforcement-controlled wallet. Binance was instructed to transfer balances from three named accounts into FBI-controlled wallets.
The first action had already established how donation addresses fed a wider collection system. The March 2025 seizure involving approximately $200,000 followed funds from at least 17 rotating addresses into a centralized wallet and onward through exchanges and brokers. Intelligence developed from that trail supplied new starting points for the June and October investigations.
Chainalysis detailed how the accumulated wallet relationships eventually extended the investigation beyond fund transfers. Findings from the earlier cases helped agents identify domains and servers allegedly connected to the Al Qassam Brigades’ principal website. Seizing that infrastructure in July and August 2026 enabled the FBI to intercept cryptocurrency donations at their point of solicitation.
