Instead of attempting to pursue the money, agents of the US Federal Bureau of Investigation (FBI) broke into the fundraising mechanism itself. Via their own informants, the bureau’s Albuquerque Field Office tracked down the servers, domains, and rotating crypto addresses through which donations were solicited for Hamas, thus being able to take control of parts of that mechanism.
According to the announcement from the US Justice Department (DOJ), the operation resulted in the seizure of nearly $560,000 in cryptocurrency that was meant to go to the military wing of Hamas, the Al Qassam Brigades.
This case shows that public blockchains can also be used against those who are trying to fund illegal activities. The same transparency that makes it possible for donors to find an address enables investigators to track transactions, recreate the flow of funds, and determine where the money has gone.
How agents got inside the donation pipeline
According to the DOJ, the fundraising scheme used an encrypted group chat to direct supporters to a website and provide rotating crypto addresses. Changing addresses may complicate tracing, but it did not stop investigators.
The FBI received assistance from several human resources in mapping the operation from inside. The investigators then carried out a number of cryptocurrency seizures through warrants granted on March 25, June 25, and October 10, 2025. Separate warrants issued in 2026 named domains and servers used to make donations to Hamas and manage the main website AlQassam.ps.
The contents of an unsealed seizure affidavit show how far the takeover went. The affidavit identifies a server at IP address 45.134.141.68 belonging to DataCamp Limited and requires the information provider to block the server and connect it to law-enforcement-designated name servers. The seizure has been approved by Magistrate Judge Matthew J. Sharbaugh.
Once investigators were able to take control of the infrastructure, they could intercept incoming donations rather than waiting until the money moved to try to recover it.
What the takeover exposed about donors
The funds raised was only part of what investigators found out. By taking possession of the fundraising mechanism, the FBI could also get the personal data of people who managed to communicate with Hamas regarding donations, says the Justice Department.
A review of the court documents made by Decrypt mentions Bitcoin, Ethereum, Wrapped Ethereum, Tether, and Tron used in 18 addresses controlled by Tether and in three accounts at Binance.
Tether has a significant role because it can block certain addresses. The seizure warrant issued in June 2025 ordered Tether to burn USDT from certain addresses and issue a similar amount of money to an account controlled by law enforcement agencies.
It fits into a general trend. FATF is warning about the use of stablecoins in illegal activities, while Chainalysis states that stablecoins made up 84% of illegal crypto transactions in 2025.
“Your networks are not secure, your crypto is vulnerable, and we will not stop until your ability to wage war is defeated,” U.S. Attorney Jeanine Ferris Pirro said.
According to Brett Leatherman, the Assistant Director of the FBI’s Cyber Division, the agency “will continue to use its authorities to intercept illicit funds and prevent terrorist organizations from exploiting digital networks.”
Why the ledger keeps beating the fundraiser
There had already been a previous seizure linked to the same funding system. In March 2025, authorities in the U.S. confiscated about $201,400 in USDT, out of which $89,900 was in crypto accounts and $111,500 in different other accounts. The fundraising addresses transferred a total sum of over $1.5 million since October 2024. The event was covered by Cryptopolitan at the time.
The next reports of the authorities prove that the fundraising network did not cease to function. According to the affidavit from August 2026, the blockchain analysis showed that the money from the fundraising network reached an amount of about $3 million by November 2025. The FBI human sources still received the instructions to make donations in February 2026.
That distinction is essential because it indicates that the value of $201,400 seized in March is included in the sum of $560,000, which was confiscated in total under the three warrants of the year 2025, while the figure of $3 million is solely about the money received by the broader network and not seized yet.
Elliptic argues that the traceability of cryptocurrency makes it a bad means of fundraising for terrorist organizations, but urges not to consider every transaction in a related wallet as a sum actually raised by any terrorist organization.
What infrastructure provider was identified in the warrant?
The FBI’s branch in Albuquerque still moves on with its investigation with the help from both its Counterterrorism and Cyber units, as well as the Justice Department’s National Security Division and prosecutors from the District of Columbia.
The donor information collected from the seized infrastructure may become the most important find. The following campaign may change direction from targeting wallets and servers to individuals trying to finance terrorists.
The warrant identified DataCamp Limited, headquartered at 9 Coldbath Square, London, United Kingdom, as the electronic service infrastructure provider controlling the server at IP address 45.134.141.68. The FBI affidavit says DataCamp leases and controls the server, which was used to support the AlQassam.ps cryptocurrency fundraising operation.
The warrant did not accuse DataCamp itself of participating in Hamas’ fundraising. It directed the company to help execute the seizure by redirecting the domain to FBI-controlled name servers and preventing further modification or transfer of the server.
Key data point: The FBI’s Aug. 5, 2026 WHOIS lookup placed the server’s IP address in São Paulo, Brazil, while identifying DataCamp Limited as its owner/provider.
Be the first to comment