In a recent filing submitted to the United States Department of Justice, investigators uncovered a set of instructions allegedly issued by the military arm of Hamas that detail how the organization seeks to receive financial support from sympathizers abroad. The guidance, which was obtained as part of a broader probe into illicit financing networks, specifically warns donors to avoid sending cryptocurrency directly through the popular exchange Binance. Instead, the document outlines a more convoluted route that involves a series of alternative platforms and wallet services designed to obscure the trail of funds and make detection by authorities more difficult.
The instruction begins by acknowledging the growing popularity of digital assets among charitable and political contributors worldwide. It notes that while many supporters instinctively turn to well‑known exchanges such as Binance for convenience, these platforms have increasingly come under regulatory scrutiny and are equipped with robust compliance tools that can flag suspicious activity. To mitigate the risk of having their contributions seized or their accounts frozen, the Hamas military wing advises donors to employ a chain of services that include Trust Wallet, Bybit, OKX, Kast, and Redotpay. These services are described as "less regulated" and therefore less likely to trigger alerts when large or repeated transfers are made.
According to the DOJ filing, the recommended workflow proceeds as follows: a donor first purchases the desired cryptocurrency—most commonly USDT (Tether) or other stablecoins—on a mainstream exchange. Rather than moving the tokens directly to an address controlled by Hamas, the donor is instructed to transfer the assets into a Trust Wallet, a non‑custodial mobile wallet that gives the user full control over private keys.
From there, the donor is told to route the funds through a series of secondary exchanges such as Bybit and OKX, which are known for offering a wide array of trading pairs and relatively lax KYC (Know Your Customer) procedures. The next step involves using Kast and Redotpay, platforms that specialize in facilitating cross‑border payments and have been flagged in the past for lax anti‑money‑laundering (AML) safeguards.
The final destination for the cryptocurrency is an external wallet on the TRON blockchain. The TRON network is popular among certain crypto communities because of its low transaction fees and fast confirmation times, attributes that make it attractive for moving sizable sums quickly. By funneling the money through multiple intermediaries before landing in a TRON wallet, the Hamas operatives aim to create a layered obfuscation effect, akin to the “mixing” techniques used by money‑laundering networks. Each hop in the chain adds a new set of transaction IDs, timestamps, and wallet addresses, complicating any forensic analysis that law enforcement might attempt.
The DOJ documents also highlight the strategic rationale behind the choice of TRON. Unlike Bitcoin or Ethereum, where transaction histories are widely scrutinized and many blockchain analytics firms have built sophisticated tracking tools, TRON’s ecosystem remains comparatively under‑researched. This relative obscurity offers a modest advantage to actors seeking to hide the ultimate beneficiary of the funds.
Moreover, the use of stablecoins such as USDT on TRON ensures that the value of the transferred assets remains stable against fiat currencies, reducing the risk of price volatility that could otherwise erode the purchasing power of the donation. Beyond the technical steps, the filing includes language that underscores the importance of secrecy and operational security. Donors are reminded to use encrypted communication channels when discussing the transfer, to avoid sharing details on public forums, and to delete any records that could link them to the transaction.
The guidance also mentions the potential legal consequences of being caught, warning that individuals who facilitate the movement of funds to terrorist organizations could face severe penalties, including imprisonment and asset forfeiture. Experts in counter‑terrorism financing note that this level of detailed instruction reflects a sophisticated understanding of both the crypto ecosystem and the regulatory environment. "What we are seeing is a playbook that has been refined over years of experience dealing with financial sanctions," said Dr. Lina Ahmed, a senior analyst at the Center for Strategic Counterterrorism Studies.
"By directing donors away from high‑profile exchanges and toward a mosaic of less‑scrutinized platforms, Hamas is attempting to stay ahead of the curve as governments tighten AML requirements across the board." Law enforcement agencies worldwide have responded by increasing cooperation with cryptocurrency exchanges and wallet providers. Many platforms now employ real‑time monitoring systems that can detect patterns consistent with terrorist financing, such as rapid, high‑value transfers to newly created wallets. In some cases, exchanges have voluntarily frozen accounts that appear to be linked to sanctioned entities, a practice that has been praised by the U.S. Treasury's Office of Foreign Assets Control (OFAC).
Nevertheless, the cat‑and‑mouse game continues. As regulators impose stricter KYC and AML protocols, illicit actors adapt by seeking out newer, less regulated services or by developing custom privacy‑enhancing tools. The emergence of decentralized finance (DeFi) protocols, which operate without a central authority, presents another frontier for potential abuse.
While the Hamas instruction set focuses on more traditional centralized exchanges and wallets, analysts warn that future guidance could shift toward fully decentralized routes that are even harder to trace. The DOJ filing serves as a reminder of the evolving threat landscape posed by the intersection of terrorism and digital finance. By documenting the specific steps recommended by Hamas' military wing, investigators hope to provide a blueprint for other agencies to disrupt similar financing schemes.
The ultimate goal is to cut off the flow of resources that enable extremist groups to plan, recruit, and carry out attacks, thereby enhancing global security. In summary, the recently unsealed documents reveal that Hamas' armed faction is actively steering its supporters away from mainstream crypto exchanges like Binance, favoring a convoluted pathway through Trust Wallet, Bybit, OKX, Kast, and Redotpay before depositing the proceeds into a TRON‑based external wallet.
This strategy is designed to exploit regulatory gaps, reduce the likelihood of detection, and preserve the value of the contributions. As governments and private sector actors continue to bolster their anti‑money‑laundering frameworks, the ongoing adaptation of terrorist financing methods underscores the need for vigilant, collaborative efforts across borders and industries.