For business
KYT office
Compliance solution to monitor risks, detect sanctions and ensure AML rules.
KYT office
Compliance solution to monitor risks, detect sanctions and ensure AML rules.
AML certification
How industry players can get up-to-date knowledge and professional certification.
AML certification
How industry players can get up-to-date knowledge and professional certification.
Comprehensive transaction analytics that helps to build graphs and trace funds.
Graph
Travel rule
(soon)
For personal use
Telegram bot
Bot for checking crypto for risks, providing AML reports.
Telegram bot
Bot for checking crypto for risks, providing AML reports.
Crypto recovery
Services are focused on tracking
and recovering crypto assets.
and recovering crypto assets.
Сrypto recovery
Services are focused on tracking
and recovery crypto assets.
and recovery crypto assets.
Docs and reports
All types of documents related
to cryptocurrency.
to cryptocurrency.
Docs and reports
All types of documents related
to cryptocurrency.
to cryptocurrency.
Portfolio tracker
Information about all assets and risk assessment in one place.
Portfolio tracker
Information about all assets and risk assessment in one place.
AML checks
Сhecking wallets and transactions
for illicit funds.
for illicit funds.
AML checks
Сhecking wallets and transactions
for illicit funds.
for illicit funds.
AML-сертификация
Актуальные знания в области AML/KYT от ведущих экспертов отрасли.
AML-сертификация
Актуальные знания в области AML/KYT от ведущих экспертов отрасли.
Graph
Визуализация перемещения активов
и связей между кошельками.
и связей между кошельками.
Graph
Визуализация перемещения активов
и связей между кошельками.
и связей между кошельками.
KYT Office
Мониторинг транзакций и кошельков для вашего отдела комплаенса.
KYT Office
Мониторинг транзакций и кошельков для вашего отдела комплаенса.
Для себя
Для Бизнеса
Travel rule
(Cкоро)
Телеграм-бот
Бот для проверки кошельков и транзакций с выдачей отчётов.
Телеграм-бот
Бот для проверки кошельков и транзакций с выдачей отчётов.
Возврат средств
Услуги по отслеживанию и возврату украденных криптоактивов.
Возврат средств
Услуги по отслеживанию и возврату украденных криптоактивов.
AML-проверки
Проверка кошельков и транзакций на наличие "грязной" криптовалюты.
AML-проверки
Проверка кошельков и транзакций на наличие "грязной" криптовалюты.
Портфолио трекер
Информация о всех активах и оценка рисков в одном месте.
Портфолио трекер
Информация о всех активах и оценка рисков в одном месте.
Отчёты
Все типы документов связанные
с криптовалютой.
с криптовалютой.
Отчёты
Все типы документов связанные
с криптовалютой.
с криптовалютой.
From $10 transfers to settlement hubs handling millions, blockchain analysis reveals how the terrorist organization Hamas collects and distributes cryptocurrency donations.
On February 12, 2025, a cryptocurrency address that the FBI says was used to collect donations for Hamas’s military wing, Al-Qassam, received 14 TRX. TRX is the native token of the TRON network; in this case, it supplied the transaction fees — the blockchain equivalent of fuel. Just 63 seconds later, the same address sent 4,018.76 USDT, a dollar-pegged stablecoin, to another wallet. What looked like a routine transfer gave BitOK analysts their first lead. Following it, they uncovered a network of dozens of addresses across three blockchains and reconstructed the infrastructure used to collect and distribute funds for Hamas. Here is how it works.
Key Findings
Key Findings
- The analysis covers transfers on TRON, Ethereum and BNB Smart Chain (BSC), primarily involving USDT.
- Of 69 addresses examined, 14 acted as collection points, each receiving payments from 20 to 55 distinct senders.
- One large settlement hub received 2.9 million USDT from multiple sources, indicating that it was part of a broader settlement infrastructure rather than a standalone donation wallet.
- The analysis identified a possible link to an over-the-counter exchange in Gaza.
- Tether froze five addresses in a related branch of the network in April and May 2026. At the time of review, they still held a combined 5.6 million USDT.
- The network remains active, with the latest observed transfers recorded on September 4 and 6, 2026.
This diagram brings together several transaction sequences verified during the investigation.
Table of content:
- The Two Addresses That Started the Investigation
- Timeline
- Hundreds of Small Payments Feed the Network
- Bridging Funds to BSC
- How Eight Wallets Pooled Their Funds
- Major Settlement Hubs and a Possible Gaza Exchange Link
- The Five Wallets Frozen by Tether
- The Network Remains Active
- Four Recurring Patterns Across the Network
- What the Investigation Shows
The Two Addresses That Started the Investigation
The Two Addresses That Started the Investigation
The investigation began with two addresses listed in an FBI affidavit dated June 25, 2025—a sworn written statement submitted to a court as evidence. According to the FBI, one address, TSWL3euRjZWXiFJgzuV9tYAGiwShtPWkZK, had been provided for donations to Al-Qassam. The second, TA3aQxRwocYytqZBKqMPHPZT6pYvwGjLg1, is identified in the same documents as an operational wallet for the group.
At first glance, the addresses appeared to have little in common beyond receiving USDT. But BitOK analysts found a stronger connection: a single sender, TMMF2wEzg3ywHSWrAezttfdWpuBt1Az5TV, supplied both addresses with TRX. On February 12, 2025, the donation address received 14 TRX and, just 63 seconds later, sent 4,018.763491 USDT to the operational wallet.
This sequence—TRX to cover the fee, followed by a USDT transfer—was no coincidence. It was a recurring part of the operators’ workflow, and it helped the analysts identify additional addresses.
Tracing similar TRX transfers led to another sender, TUfDHCVAH368rTn1SvkJu8D4LvuNr4VCiB. This address funded transaction fees for five addresses later cited in FBI documents, as well as several intermediaries involved in a fund-consolidation sequence discussed below.
The investigation thus moved beyond the two published addresses to identify recurring roles: who receives funds, who pays transaction fees, and who consolidates incoming payments before moving them to another network.
At first glance, the addresses appeared to have little in common beyond receiving USDT. But BitOK analysts found a stronger connection: a single sender, TMMF2wEzg3ywHSWrAezttfdWpuBt1Az5TV, supplied both addresses with TRX. On February 12, 2025, the donation address received 14 TRX and, just 63 seconds later, sent 4,018.763491 USDT to the operational wallet.
This sequence—TRX to cover the fee, followed by a USDT transfer—was no coincidence. It was a recurring part of the operators’ workflow, and it helped the analysts identify additional addresses.
Tracing similar TRX transfers led to another sender, TUfDHCVAH368rTn1SvkJu8D4LvuNr4VCiB. This address funded transaction fees for five addresses later cited in FBI documents, as well as several intermediaries involved in a fund-consolidation sequence discussed below.
The investigation thus moved beyond the two published addresses to identify recurring roles: who receives funds, who pays transaction fees, and who consolidates incoming payments before moving them to another network.
Timeline
Timeline
Period | Activity |
February 2025 | A TRX top-up preceded a USDT transfer between addresses identified in official records. |
July 2025 | Ten intermediaries consolidated 2,981.23 USDT. The funds then moved through Ethereum to BSC. |
April–May 2026 | Tether froze five financially connected addresses in a separate branch of the network. |
June 2026 | An address labeled Afaq sent 95,000 USDT to a major settlement hub. |
July 2026 | Eight BSC addresses pooled funds before a reverse swap, which paid out 122,449.59 USDT on TRON. |
August–September 2026 | Funds continued to arrive on BSC through HOT Bridge, while separate settlement activity continued through intermediaries on TRON. |
This timeline does not trace a single sum moving across blockchains for a year and a half. It covers several distinct episodes that followed similar operational patterns.
Hundreds of Small Payments Feed the Network
Hundreds of Small Payments Feed the Network
The evidence suggests that collection did not revolve around a single public wallet receiving a steady stream of donations. Instead, funds entered through numerous addresses in small payments, some passing through a short chain of intermediaries. Several verified transaction paths include inflows from exchange wallets. Labels for exchange services also appear on the transaction graph. They help identify the channels through which funds moved, but not the individuals who sent them.
Of the 69 addresses examined, 14 had between 20 and 55 significant senders. These 14 addresses with collection-like activity received 488 transfers totaling 268,518.22 USDT; 420 of those transfers were no larger than 1,000 USDT. The count included incoming transfers of at least 10 USDT. Another 39 addresses had only one significant sender. The addresses therefore played different roles: some gathered funds from many sources, while others simply passed them on.
One revealing example is TXUiAJhWE9tuaUw7CN2H95dhs3CM73sDWE. Ten intermediaries each sent it a single USDT payment. Every intermediary had received TRX to cover the fee just 15–63 seconds beforehand—the same recurring pattern. After collecting 2,981.233617 USDT, TXUi sent the entire amount to Bridgers, a service that swaps assets across cryptocurrencies or networks, effectively bridging blockchains. No public fundraising appeals were found for these addresses, so their use for donations remains a hypothesis rather than an established fact. The consolidation process itself, however, appears coordinated.
Of the 69 addresses examined, 14 had between 20 and 55 significant senders. These 14 addresses with collection-like activity received 488 transfers totaling 268,518.22 USDT; 420 of those transfers were no larger than 1,000 USDT. The count included incoming transfers of at least 10 USDT. Another 39 addresses had only one significant sender. The addresses therefore played different roles: some gathered funds from many sources, while others simply passed them on.
One revealing example is TXUiAJhWE9tuaUw7CN2H95dhs3CM73sDWE. Ten intermediaries each sent it a single USDT payment. Every intermediary had received TRX to cover the fee just 15–63 seconds beforehand—the same recurring pattern. After collecting 2,981.233617 USDT, TXUi sent the entire amount to Bridgers, a service that swaps assets across cryptocurrencies or networks, effectively bridging blockchains. No public fundraising appeals were found for these addresses, so their use for donations remains a hypothesis rather than an established fact. The consolidation process itself, however, appears coordinated.
Bridging Funds to BSC
Bridging Funds to BSC
In the TXUi episode, the funds did not stay on TRON. The recipient on the next network, 0xadb511a2992ba3fc39a42d576e63bd9db8f1812d, first received 1.106942 ETH on Ethereum, then initiated a swap and received 2,993.110491 USDT on BSC, or BNB Smart Chain. Other cases examined confirmed direct transfers from TRON to BSC without an intermediate step on Ethereum.
A separate 2026 sample contained 64 Bridgers payouts on BSC totaling 396,801.64 USDT. For 54 of those payouts, worth 357,670.04 USDT, analysts matched the exact originating swap requests from 50 TRON addresses, establishing where the funds had come from. After crossing the bridge, funds again passed through intermediaries, converged on recurring hubs, and split among service addresses, likely exchange deposits and reverse swaps. One possible explanation is that some addresses facilitate over-the-counter (OTC) settlement: direct exchanges of cryptocurrency for cash outside a public exchange. This remains one interpretation, not a confirmed role for every recipient.
The change of network also matters at the token level. The USDT used on BSC is Binance-Peg USDT, rather than the same token used on TRON. It is issued by Binance and backed one-to-one by USDT held in reserve. Moving between networks complicates an investigation because records from different blockchains must be matched. It does not make the funds invisible or guarantee protection from a freeze.
Three BSC hub addresses recur particularly often in the graph:
A separate 2026 sample contained 64 Bridgers payouts on BSC totaling 396,801.64 USDT. For 54 of those payouts, worth 357,670.04 USDT, analysts matched the exact originating swap requests from 50 TRON addresses, establishing where the funds had come from. After crossing the bridge, funds again passed through intermediaries, converged on recurring hubs, and split among service addresses, likely exchange deposits and reverse swaps. One possible explanation is that some addresses facilitate over-the-counter (OTC) settlement: direct exchanges of cryptocurrency for cash outside a public exchange. This remains one interpretation, not a confirmed role for every recipient.
The change of network also matters at the token level. The USDT used on BSC is Binance-Peg USDT, rather than the same token used on TRON. It is issued by Binance and backed one-to-one by USDT held in reserve. Moving between networks complicates an investigation because records from different blockchains must be matched. It does not make the funds invisible or guarantee protection from a freeze.
Three BSC hub addresses recur particularly often in the graph:
- 0xdbe8b8df665dd2c43542823c4a5d286804e42d62
- 0xf4b4c31ba7e376df505644e0eb1e6dbca6e124eb
- 0xe732ae59f1929b9c568b6809fb47d1cd39591015 (referred to below as E7).
These addresses participate in a wider transfer network; they are not an established set of wallets belonging to a single owner.
How Eight Wallets Pooled Their Funds
How Eight Wallets Pooled Their Funds
On July 20, 2026, eight BSC addresses sent funds to a single address, 0xf13aa13d424b660a8764bf80e3c7271ecc61921c. That address then sent 122,696.47917 USDT to Bridgers. The swap request specified both the TRON recipient and the final payout amount: 122,449.586211 USDT.
The address TWhjBHXPrmBd42Ybth4Kw9aS3RRWKnAQGM received that amount 34 minutes and 58 seconds later. Crucially, before the swap request was submitted, three wallets from the original TRON branch had already sent the recipient a combined 84.946792 TRX to cover future transaction fees. The recipient had been prepared in advance, pointing to coordinated activity rather than a chance connection.
Next, 120,780 USDT went to TYRbtJsqfgCvyRLeykLjnqeSjtoHiXeCE7, while the remaining 1,669.586211 USDT went to a second recipient. This particular payout had entered a much larger settlement network.
The address TWhjBHXPrmBd42Ybth4Kw9aS3RRWKnAQGM received that amount 34 minutes and 58 seconds later. Crucially, before the swap request was submitted, three wallets from the original TRON branch had already sent the recipient a combined 84.946792 TRX to cover future transaction fees. The recipient had been prepared in advance, pointing to coordinated activity rather than a chance connection.
Next, 120,780 USDT went to TYRbtJsqfgCvyRLeykLjnqeSjtoHiXeCE7, while the remaining 1,669.586211 USDT went to a second recipient. This particular payout had entered a much larger settlement network.
Major Settlement Hubs and a Possible Gaza Exchange Link
Major Settlement Hubs and a Possible Gaza Exchange Link
TYRbt is neither an endpoint nor a standalone donation wallet. Across the transaction history examined, it received 2,910,574 USDT. The bridge payout described above accounted for only about 4.15% of that total. The rest came from other senders, indicating that the address serves as a hub within a much broader settlement infrastructure.
The two largest recipients of funds from TYRbt—TDnkmNiwdgU1CzuZoFLpw3TaYJm6FbxhFg and TNdRJJSzvNjvtSeTBUBXrZJWtfxKCKx9VA—received a combined 2,598,903 USDT. Another hub, TBPRSb5Y9fvSGELvtD4U8FWtKcE2FYiJ7N, sent the first of those addresses 5,904,832 USDT across 32 transfers and the second 1,453,525 USDT across nine transfers. The repeated payments point to ongoing settlement relationships. These amounts should not be added together as though they represented separate, one-off funding contributions.
This part of the analysis revealed a possible link to an OTC exchange in Gaza. The address TPXosjuaM5myTcykZBxr5kdmo71epzSFy5 is labeled Afaq International Exchange / Gaza OTC. It sent 60,000 USDT on June 13 and 35,000 USDT on June 17 directly to TMxjKARz35a7hECvLF52dNTtbt8795c38Y, an address that regularly forwards funds to TNdRJ.
The two largest recipients of funds from TYRbt—TDnkmNiwdgU1CzuZoFLpw3TaYJm6FbxhFg and TNdRJJSzvNjvtSeTBUBXrZJWtfxKCKx9VA—received a combined 2,598,903 USDT. Another hub, TBPRSb5Y9fvSGELvtD4U8FWtKcE2FYiJ7N, sent the first of those addresses 5,904,832 USDT across 32 transfers and the second 1,453,525 USDT across nine transfers. The repeated payments point to ongoing settlement relationships. These amounts should not be added together as though they represented separate, one-off funding contributions.
This part of the analysis revealed a possible link to an OTC exchange in Gaza. The address TPXosjuaM5myTcykZBxr5kdmo71epzSFy5 is labeled Afaq International Exchange / Gaza OTC. It sent 60,000 USDT on June 13 and 35,000 USDT on June 17 directly to TMxjKARz35a7hECvLF52dNTtbt8795c38Y, an address that regularly forwards funds to TNdRJ.
This second BitOK graph shows incoming routes from services and intermediaries at the lower left, Bridgers near the center, and major settlement hubs such as TYRbt, TDnkm and TNdRJ on the right. At the upper left are links to several previously frozen addresses, discussed in the next section.
The Five Wallets Frozen by Tether
The Five Wallets Frozen by Tether
In an adjacent branch of the same settlement infrastructure, analysts identified five connected addresses that Tether, the issuer of USDT, froze in April and May 2026. Tether can do this through its smart contract code, effectively disabling the tokens at a particular address so that the holder cannot use them. As of the September 6 review, the five addresses still held a combined 5,615,874.51 USDT:
Address | Date frozen | USDT balance |
TH8PJ6jXCcd7pWkkxXz1YNW6ekGrvRaaK9 | Apr 14, 2026 | 116,900.00 |
TDysnVPxhbLPYtZ3Z5G9dDqPz3VwUjvE2M | May 5, 2026 | 36,947.70 |
TRrsnQn88B1cxxNQFdcQRMFbaDybKw1MiP | May 5, 2026 | 8,506.55 |
TUpYaDubGgDoY1n9oWc2dKpi8Q6b1os39u | May 6, 2026 | 2,453,520.26 |
TEgjDKCESf7kp11ezVyh36DN9MGBX6eXBw | May 5, 2026 | 3,000,000.00 |
The five addresses share more than similar freeze dates. One sender, TBe54YQzzLRPJdiM4wTdB2wZT1TF89Jhet, sent 3 million USDT to TEgj and also transferred funds to TRrs, which in turn sent funds to TDys. The freeze of TEgj is confirmed by a Tether smart contract event.
There is also a direct connection to the OTC-linked activity described above. The address TDbWRay1cC41EUAgUjg3LJAgpAUiznjjLE received 150,000 USDT from TH8 before that address was frozen, as well as 81,800 USDT from the same Afaq-labeled address. Its downstream counterparties overlap with routes to the major settlement hubs discussed earlier. These are verifiable financial connections, but they do not establish that all the addresses share a common pool of funds.
Balance checks revealed a critical detail. Between certain transfers, TDbWRay’s balance fell to just 1.50 USDT, showing that funds passed through rather than accumulated there. Another intermediary showed a similar pattern, with its balance dropping close to zero. As a result, the nine paths examined do not establish that tens or hundreds of thousands of dollars flowed continuously from the frozen branch into the main settlement cluster. Shared intermediaries connect different parts of the graph, but substantial, continuous funding along these particular routes was not established.
A separate balance nevertheless remained accessible outside the freeze. The unfrozen address TX6SUMqbC6XixspULVDRMS2dtynAVX7ibh received 61,100 USDT directly from TUpYa and sent back only 100 USDT. Reconstruction of its full transaction history indicated that 61,000–61,100 USDT from those inflows remained in its balance. At the time of review, the address held 71,128.75 USDT in total.
This branch of the investigation therefore identified financial connections around previously frozen wallets, along with a separate unfrozen balance nearby. A freeze alone, however, establishes neither who owns the addresses, why they were restricted, nor whether the funds belong to Hamas.
There is also a direct connection to the OTC-linked activity described above. The address TDbWRay1cC41EUAgUjg3LJAgpAUiznjjLE received 150,000 USDT from TH8 before that address was frozen, as well as 81,800 USDT from the same Afaq-labeled address. Its downstream counterparties overlap with routes to the major settlement hubs discussed earlier. These are verifiable financial connections, but they do not establish that all the addresses share a common pool of funds.
Balance checks revealed a critical detail. Between certain transfers, TDbWRay’s balance fell to just 1.50 USDT, showing that funds passed through rather than accumulated there. Another intermediary showed a similar pattern, with its balance dropping close to zero. As a result, the nine paths examined do not establish that tens or hundreds of thousands of dollars flowed continuously from the frozen branch into the main settlement cluster. Shared intermediaries connect different parts of the graph, but substantial, continuous funding along these particular routes was not established.
A separate balance nevertheless remained accessible outside the freeze. The unfrozen address TX6SUMqbC6XixspULVDRMS2dtynAVX7ibh received 61,100 USDT directly from TUpYa and sent back only 100 USDT. Reconstruction of its full transaction history indicated that 61,000–61,100 USDT from those inflows remained in its balance. At the time of review, the address held 71,128.75 USDT in total.
This branch of the investigation therefore identified financial connections around previously frozen wallets, along with a separate unfrozen balance nearby. A freeze alone, however, establishes neither who owns the addresses, why they were restricted, nor whether the funds belong to Hamas.
The Network Remains Active
The Network Remains Active
Activity continued in late summer and early September 2026. After receiving payouts through HOT Bridge, another cross-chain service similar to Bridgers, four intermediaries sent approximately 7,714.75 USDT to the recurring E7 hub on BSC. This was a separate branch, not additional Bridgers payouts. One of the verified transfers in this sequence took place on September 4.
On September 6, TNdRJ sent 8,982 USDT to TFwpsGU2YQAdRTx4w7tjTSUifGTSqiPLv6. Transfers of 8,928 USDT, 8,888 USDT and 18,930 USDT followed through two further intermediaries. The entire sequence took nine minutes and nine seconds. These intermediaries had interacted before, directly supplying one another with TRX for fees ahead of USDT transfers—the same pattern identified at the start of the investigation.
The larger final transfer—18,930 USDT, compared with 8,982 USDT at the start—reflects funds from multiple sources held in the recipients’ balances. It does not mean the original sum grew. Reconstructing the full transaction histories around the specific events showed that the estimated portion of the final outgoing transfer attributable to the first incoming payment was between 3,462.79 and 8,888 USDT, not the full 18,930 USDT. This confirms that the settlement branch remains active, while avoiding the attribution of unrelated inflows to it.
On September 6, TNdRJ sent 8,982 USDT to TFwpsGU2YQAdRTx4w7tjTSUifGTSqiPLv6. Transfers of 8,928 USDT, 8,888 USDT and 18,930 USDT followed through two further intermediaries. The entire sequence took nine minutes and nine seconds. These intermediaries had interacted before, directly supplying one another with TRX for fees ahead of USDT transfers—the same pattern identified at the start of the investigation.
The larger final transfer—18,930 USDT, compared with 8,982 USDT at the start—reflects funds from multiple sources held in the recipients’ balances. It does not mean the original sum grew. Reconstructing the full transaction histories around the specific events showed that the estimated portion of the final outgoing transfer attributable to the first incoming payment was between 3,462.79 and 8,888 USDT, not the full 18,930 USDT. This confirms that the settlement branch remains active, while avoiding the attribution of unrelated inflows to it.
Four Recurring Patterns Across the Network
Four Recurring Patterns Across the Network
- Many small inflows become one consolidated outflow. Some addresses collect dozens of payments, while intermediaries pass USDT onward with almost nothing left in their balances.
- Fee funding precedes the transfer. Both in the TXUi consolidation sequence and on the return route through BSC, recipients receive TRX to cover transaction fees before the USDT arrives. This makes advance preparation visible on-chain.
- The same roles reappear across networks. After funds cross into BSC through Bridgers, the same functions emerge again: intermediaries, collection addresses and distribution hubs. Some funds move to service counterparties; others return through the bridge to TRON.
- Large addresses handle funds from multiple sources. Repeated payments and commingled balances look more like a settlement infrastructure serving multiple clients than a simple wallet holding a single pool of money.
What the Investigation Shows
What the Investigation Shows
The investigation’s central finding is a reconstruction of the recurring process used to move Hamas-linked funds: small incoming payments, consolidation, a transfer to another network, further consolidation there, and eventual entry into a much larger settlement infrastructure.
The reconstructed transactions support the hypothesis that a donation infrastructure operates around the initial addresses identified in the FBI case. At its downstream end are large USDT hubs, connections to an address labeled Gaza OTC, and a separate set of financial relationships around wallets already frozen by Tether.
Addresses and networks change, but the sequence of operations persists. By tracing both the funds and the TRX top-ups used to pay fees, analysts brought seemingly unrelated episodes into a coherent picture.
The reconstructed transactions support the hypothesis that a donation infrastructure operates around the initial addresses identified in the FBI case. At its downstream end are large USDT hubs, connections to an address labeled Gaza OTC, and a separate set of financial relationships around wallets already frozen by Tether.
Addresses and networks change, but the sequence of operations persists. By tracing both the funds and the TRX top-ups used to pay fees, analysts brought seemingly unrelated episodes into a coherent picture.
