In a series of recently unsealed documents filed by the United States Department of Justice, investigators disclosed a striking piece of operational guidance issued by the military wing of Hamas. The group, which is designated as a terrorist organization by the United States and many other nations, has apparently been providing its financial backers with explicit instructions on how to move digital assets in a way that minimizes the risk of detection by law‑enforcement agencies and financial regulators. The guidance, which appears in a filing related to an ongoing criminal case, specifically warns donors against using the popular cryptocurrency exchange Binance as a conduit for their contributions.
Instead, the Hamas military wing recommends a set of alternative platforms—Trust Wallet, Bybit, OKX, Kast, and Redotpay—as the preferred channels for moving funds. The ultimate destination for the money, according to the documents, is an external wallet on the TRON blockchain, a network known for its high transaction speed and relatively low fees. Why would a terrorist organization take the time to issue such detailed instructions?
The answer lies in the evolving landscape of illicit finance. Over the past decade, cryptocurrency has emerged as a double‑edged sword for groups that need to fund clandestine activities.
On one hand, digital currencies provide a degree of pseudonymity, allowing supporters to send money across borders without the need for traditional banking infrastructure. On the other hand, the same transparency that underpins blockchain technology also offers investigators powerful tools for tracing the flow of funds, especially when transactions pass through regulated exchanges that are obligated to collect Know‑Your‑Customer (KYC) information and report suspicious activity. Binance, the world’s largest crypto exchange by volume, operates under a regulatory framework that includes stringent KYC and anti‑money‑laundering (AML) procedures in many jurisdictions.
By directing donors away from Binance, Hamas is attempting to sidestep those compliance safeguards. Trust Wallet, for example, is a non‑custodial mobile wallet that allows users to store private keys on their own devices, meaning the wallet provider does not retain any personal data about the user. Bybit and OKX are also exchanges that, while regulated in certain regions, have historically been perceived as having more permissive onboarding processes for users from high‑risk jurisdictions.
Kast and Redotpay, though less well known, appear to function as payment gateways that can facilitate the conversion of fiat currency into crypto without the same level of scrutiny. The choice of the TRON blockchain as the final destination is also noteworthy. TRON’s network architecture supports fast, low‑cost transactions, which makes it attractive for moving relatively large sums quickly. Moreover, TRON’s ecosystem includes a variety of decentralized applications (dApps) and token standards that can be leveraged for further obfuscation, such as swapping one token for another or using smart contracts to split funds across multiple addresses.
From a law‑enforcement perspective, the DOJ’s disclosure of these instructions provides a valuable glimpse into the operational security measures employed by Hamas. It confirms that the group is not only aware of the regulatory pressures facing major exchanges but is also actively seeking to exploit the more permissive corners of the crypto market.
This intelligence can inform future investigative strategies, such as focusing on the alternative platforms mentioned in the guidance, monitoring large inflows to TRON wallets linked to known Hamas addresses, and collaborating with international partners to tighten AML controls on less‑scrutinized services. The broader implications for the cryptocurrency industry are significant.
While the majority of users engage in legitimate activities—trading, investing, or using crypto for everyday payments—the technology’s open nature inevitably attracts malicious actors. Regulators worldwide have been grappling with how to balance innovation with security, and incidents like this underscore the urgency of developing robust, globally coordinated AML frameworks. Exchanges and wallet providers may need to adopt more rigorous identity verification processes, even for services that have traditionally operated with minimal user data collection.
For donors who are sympathetic to Hamas, the DOJ’s findings serve as a warning that their contributions are likely being monitored and could lead to criminal liability. The United States has a long history of prosecuting individuals who provide material support to designated terrorist organizations, and the use of cryptocurrency does not shield them from those statutes. In recent years, several high‑profile cases have resulted in convictions for transferring digital assets to terrorist groups, demonstrating that law‑enforcement agencies possess both the technical expertise and the legal authority to pursue such offenses. In summary, the Department of Justice’s recent filing reveals a calculated effort by Hamas’ military wing to steer its financial supporters away from mainstream, regulated exchanges like Binance and toward a suite of alternative platforms that offer greater anonymity.
By funneling crypto through Trust Wallet, Bybit, OKX, Kast, and Redotpay before landing it in a TRON wallet, the organization hopes to obscure the money trail and reduce the likelihood of detection. This tactic highlights the ongoing cat‑and‑mouse game between illicit actors seeking to exploit emerging financial technologies and authorities working to adapt their investigative tools to a rapidly changing digital environment. The disclosure not only sheds light on Hamas’ financial logistics but also reinforces the need for continued vigilance, stronger regulatory cooperation, and enhanced compliance measures across the global cryptocurrency ecosystem.