In a recent filing submitted to the United States Department of Justice, prosecutors disclosed internal communications from the military wing of Hamas that outline a detailed strategy for moving digital assets while attempting to evade detection by financial regulators and law‑enforcement agencies. The documents reveal that the organization explicitly warned its financial backers not to employ the popular cryptocurrency exchange Binance as a conduit for their contributions. Instead, the group advised donors to use a collection of alternative services—including Trust Wallet, Bybit, OKX, Kast, and Redotpay—to transfer funds to a designated external wallet on the TRON blockchain.
The guidance appears to be part of a broader operational playbook designed to obscure the origin and destination of funds that are believed to support Hamas’ militant activities. By steering contributors away from Binance, a platform that is subject to extensive compliance checks and reporting obligations under U.S. and international anti‑money‑laundering (AML) frameworks, the group aims to reduce the likelihood that its financial flows will be flagged by automated monitoring systems or manual investigations. Trust Wallet, Bybit, OKX, Kast, and Redotpay each have distinct features that may make them attractive for illicit actors.
Trust Wallet, for example, is a non‑custodial mobile wallet that gives users full control over private keys, meaning that the service provider does not retain any direct oversight of transactions. Bybit and OKX operate as cryptocurrency exchanges that, while regulated in certain jurisdictions, have historically faced scrutiny over the robustness of their KYC (Know Your Customer) and AML procedures. Kast and Redotpay are lesser‑known platforms that specialize in facilitating cross‑border crypto payments with minimal friction, often catering to users seeking privacy.
The choice of the TRON network as the final destination for the funds is also noteworthy. TRON, a blockchain that emphasizes high throughput and low transaction fees, has become increasingly popular among groups looking to move large volumes of digital currency quickly and inexpensively. Moreover, the network’s architecture supports the creation of custom tokens and smart contracts, which can be leveraged to further obfuscate the trail of money through layered transactions, mixing services, or automated distribution mechanisms.
According to the DOJ filing, the instructions were disseminated through encrypted messaging channels used by Hamas operatives. The communication explicitly outlined step‑by‑step procedures: donors were first to acquire cryptocurrency—most commonly US‑dollar‑pegged stablecoins such as USDT or USDC—on a platform of their choosing, then transfer those assets to a Trust Wallet or a similar non‑custodial wallet. From there, the funds would be sent to an intermediary exchange like Bybit or OKX, where they could be swapped into TRON‑based tokens and finally moved to a pre‑identified external TRON wallet controlled by the organization.
Prosecutors argue that this multi‑hop approach is designed to create a “chain of custody” that is difficult for investigators to unwind. Each hop introduces a new set of transaction records, often across different jurisdictions with varying levels of regulatory oversight. By the time the funds reach the final TRON address, the original source—whether a private individual, a charitable front, or a state sponsor—may be effectively concealed. The filing also highlights the strategic rationale behind avoiding Binance.
As one of the world’s largest cryptocurrency exchanges, Binance maintains a comprehensive compliance program that includes transaction monitoring, suspicious activity reporting, and cooperation with law‑enforcement requests. The organization’s internal memo warned that using Binance could increase the risk of a “red flag” being raised, potentially leading to account freezes, asset seizures, or the exposure of donor identities. In response to the DOJ’s revelations, Binance has publicly reiterated its commitment to combating illicit finance. The exchange’s spokesperson emphasized that the platform continuously upgrades its AML controls, works closely with regulators, and encourages users to adhere to legal standards when transacting.
Nonetheless, the documents suggest that even well‑regulated exchanges may be bypassed by determined actors who are willing to navigate a more fragmented ecosystem of wallets and lesser‑known exchanges. The broader implications of these findings extend beyond Hamas. They illustrate how non‑state actors are adapting to the evolving cryptocurrency landscape, exploiting technical nuances and regulatory gaps to sustain their operations. As digital assets become more mainstream, the challenge for policymakers and financial crime units is to develop tools that can trace complex transaction pathways without stifling legitimate innovation.
Experts in counter‑terrorism financing note that the use of crypto is not new for groups like Hamas, but the sophistication demonstrated in the DOJ documents marks a significant escalation. By integrating multiple platforms and leveraging the speed and anonymity of blockchain technology, the organization can potentially raise and move funds at a scale and speed that outpaces traditional monitoring mechanisms. In summary, the Department of Justice’s filing sheds light on a calculated effort by Hamas’ military wing to sidestep a major cryptocurrency exchange—Binance—in favor of a network of wallets and exchanges that collectively reduce exposure to regulatory scrutiny.
The instruction to route funds through Trust Wallet, Bybit, OKX, Kast, and Redotpay before landing in an external TRON wallet underscores a deliberate strategy to mask financial flows, complicate investigative efforts, and ensure that resources continue to reach operational cells. This case underscores the urgent need for coordinated international responses, enhanced blockchain analytics capabilities, and robust regulatory frameworks that can keep pace with the rapid evolution of digital finance.