In a series of internal communications that have now been made public through filings with the United States Department of Justice, the military wing of Hamas – the organization that controls the Gaza Strip and is designated as a terrorist group by the United States, the European Union and several other jurisdictions – issued explicit guidance to its financial backers about how to move money in a way that would evade detection and reduce the risk of asset freezes. The guidance, which reads like a handbook for covert cryptocurrency transactions, specifically warns donors against using Binance, the world’s largest cryptocurrency exchange by volume, and instead points them toward a handful of smaller, less‑scrutinized platforms such as Bybit, OKX, Kast and a payment service known as Redotpay.
The documents, which were part of a broader criminal case involving alleged money‑laundering schemes linked to extremist groups, reveal a sophisticated understanding of the digital‑currency ecosystem. They demonstrate that Hamas’ financial operatives are not only aware of the regulatory pressures facing major exchanges but also possess the technical know‑how to pivot quickly to alternative venues when a particular service becomes a liability. In the memo, the group’s financial officers describe Binance as “high‑risk” because of its recent encounters with law‑enforcement agencies worldwide, including a high‑profile crackdown by the U.S.
Treasury’s Office of Foreign Assets Control (OFAC) that resulted in the freezing of several accounts suspected of supporting sanctioned entities. By contrast, the memo praises Bybit and OKX for their “relative anonymity,” “lower compliance thresholds,” and “faster transaction processing times.” Both exchanges are based in jurisdictions that have historically taken a more permissive stance toward cryptocurrency activity, and they have, until recently, been less aggressive in enforcing the stringent Know‑Your‑Customer (KYC) and Anti‑Money‑Laundering (AML) protocols that larger platforms are required to implement.
The guidance also mentions Kast, a newer exchange that operates primarily in the Middle East and offers a suite of services tailored to users who prefer to remain off the radar of Western regulators. Redotpay, described as a “digital payment gateway,” is highlighted for its ability to convert fiat currency into a variety of stablecoins without triggering the same level of scrutiny that traditional banking channels would attract. The shift away from Binance is not merely a reaction to regulatory pressure; it also reflects a broader strategic calculus within Hamas’ financial network.
Binance, despite its size, has been under intense observation by intelligence agencies because of its role in facilitating cross‑border flows of capital. The exchange’s compliance team has cooperated with multiple investigations, providing transaction data that has helped authorities trace illicit funding streams back to terrorist organizations, narcotics traffickers, and ransomware groups.
By moving operations to smaller platforms, Hamas hopes to exploit the lower visibility and slower response times that characterize these services, thereby buying time to move funds, convert them into usable assets, and ultimately funnel them to support its military and political activities. Experts in counter‑terrorism finance note that the use of cryptocurrency by extremist groups is not a new phenomenon, but the level of detail found in the Hamas documents suggests an evolution in how these actors approach digital money. "What we are seeing is a maturation of the operational playbook," says Dr.
Lina Al‑Hassan, a senior analyst at the Center for Strategic Counter‑Terrorism. "Early on, groups would simply use any exchange that allowed them to buy Bitcoin anonymously. Now, they are conducting risk assessments, comparing compliance regimes, and selecting platforms that give them the best chance of evading detection." The guidance also includes practical instructions for donors on how to create accounts on the recommended exchanges, how to use privacy‑enhancing tools such as VPNs and Tor browsers, and how to employ mixing services to obscure the origin of funds. It advises users to split transactions into smaller amounts to avoid triggering automated AML alerts, and to convert cryptocurrency into stablecoins like USDT or USDC before moving the assets into offshore wallets that are less likely to be flagged by law‑enforcement monitoring tools.
From a policy perspective, the revelations raise several challenges for regulators and law‑enforcement agencies. While major exchanges like Binance are already subject to extensive oversight, the decentralized and fragmented nature of the cryptocurrency market means that smaller platforms can quickly become havens for illicit activity. Some jurisdictions have begun to tighten their own regulatory frameworks, requiring all crypto‑service providers to register with financial authorities, implement robust KYC procedures, and report suspicious transactions.
However, enforcement remains uneven, and many platforms operate in jurisdictions with limited resources or political will to pursue cross‑border investigations. In response to the DOJ filings, both Bybit and OKX issued statements denying any knowledge of terrorist financing and emphasizing their commitment to compliance. Bybit’s spokesperson said the company “continues to cooperate fully with regulators worldwide and has robust internal controls designed to detect and prevent illicit activity.” OKX made a similar pledge, noting that it “regularly audits its systems and works closely with law‑enforcement agencies to ensure the integrity of its platform.” Nevertheless, the documents illustrate that even well‑intentioned exchanges can become unwitting conduits for extremist financing if their compliance mechanisms are insufficiently rigorous.
The case underscores the importance of international cooperation, shared intelligence, and the development of standardized AML standards that apply uniformly across all crypto‑service providers, regardless of size. For donors sympathetic to Hamas, the memo serves as a clear roadmap: avoid the high‑profile, heavily monitored Binance platform and instead route contributions through Bybit, OKX, Kast, or Redotpay, using a combination of privacy tools and transaction‑splitting techniques to stay under the radar.
For governments and watchdogs, the takeaway is that the battle over illicit cryptocurrency use is moving from the largest exchanges to a more dispersed set of actors, requiring a shift in investigative focus and resource allocation. In summary, the newly released DOJ documents reveal a calculated effort by Hamas’ military wing to steer its financial supporters away from Binance and toward smaller, less regulated cryptocurrency exchanges. By providing detailed operational instructions, the group demonstrates a sophisticated grasp of the digital‑currency landscape and a willingness to adapt its tactics in response to regulatory pressure.
The episode highlights the ongoing cat‑and‑mouse game between extremist financiers and authorities, and it signals a need for broader, more coordinated regulatory action to close the gaps that allow such groups to exploit the relative anonymity of the crypto ecosystem.