In a recent filing submitted to a federal court, the U.S. Department of Justice (DOJ) disclosed internal communications from the military wing of Hamas that detail a sophisticated strategy for moving cryptocurrency donations.
The documents illustrate how the organization, which controls the Gaza Strip and is designated as a terrorist group by the United States, the European Union, and several other jurisdictions, is actively seeking to evade financial sanctions and detection by law‑enforcement agencies. The core of the guidance is a clear directive to donors: avoid using the popular exchange Binance for any transaction involving the group’s funds, and instead rely on a suite of alternative services—namely Trust Wallet, Bybit, OKX, Kast, and Redotpay—to transfer digital assets into a designated TRON‑based wallet that lies outside the direct oversight of mainstream crypto platforms. The DOJ filing, which forms part of a broader investigation into illicit financing of terrorism, includes screenshots of messages sent by Hamas operatives to prospective benefactors. In these messages, the militants explicitly warn that Binance’s compliance procedures and its ties to the broader financial system make it a risky conduit for money destined for the group.
They argue that Binance’s “Know‑Your‑Customer” (KYC) and anti‑money‑laundering (AML) protocols could flag suspicious activity and potentially freeze or seize the assets. By contrast, the recommended platforms are portrayed as more permissive, with looser verification requirements and a reputation for facilitating rapid, cross‑border transfers. Trust Wallet, a non‑custodial mobile wallet, is highlighted for its ability to hold a wide range of tokens without requiring users to register personal information.
Bybit and OKX, both major cryptocurrency derivatives exchanges, are cited for their high liquidity and the ease with which users can convert fiat into crypto and vice‑versa. Kast and Redotpay, lesser‑known services that specialize in peer‑to‑peer crypto payments, are also mentioned as “low‑profile” options that can further obscure the trail of funds. The final destination for the transferred assets is a TRON (TRX) wallet, chosen for its speed, low transaction fees, and relative anonymity compared with Bitcoin or Ethereum networks.
The strategic choice of TRON is noteworthy. TRON’s blockchain architecture allows for fast transaction finality, often completing within seconds, and its network fees are among the cheapest in the industry. Moreover, TRON’s ecosystem includes a large number of decentralized applications (dApps) and token standards that can be leveraged to further layer transactions, making forensic analysis more challenging.
By funneling money into a TRON wallet, Hamas can quickly redistribute the proceeds to operational accounts, purchase equipment, or fund logistical needs without attracting the same level of scrutiny that would accompany a Bitcoin transaction, which is more heavily monitored by blockchain analytics firms. The documents also reveal a nuanced understanding of the regulatory landscape. Hamas operatives acknowledge that many jurisdictions have begun to impose stricter reporting obligations on crypto exchanges, especially those that serve as on‑ramps for fiat currency.
They advise donors to split larger sums into multiple smaller transfers, a technique known as “structuring,” to stay below reporting thresholds and avoid triggering automated alerts. Additionally, the messages suggest the use of “mixers” or “tumblers”—services that blend multiple users’ crypto together before redistributing it—to further mask the origin of the funds. From a broader perspective, this revelation underscores the growing importance of cryptocurrency in the financing of extremist groups. Traditional fundraising channels—such as charitable donations, cash smuggling, and hawala networks—have long been monitored and disrupted by intelligence agencies.
Digital assets, however, present a novel set of challenges. Their pseudonymous nature, borderless reach, and the rapid evolution of decentralized finance (DeFi) tools enable actors like Hamas to adapt quickly to enforcement actions. Law‑enforcement officials have responded by intensifying collaboration with international regulators, private sector blockchain analytics firms, and cryptocurrency exchanges. The DOJ’s case illustrates how investigators are increasingly able to trace illicit flows through a combination of on‑chain data, metadata from messaging platforms, and cooperation agreements that compel exchanges to share user information.
In recent years, several high‑profile arrests have been made based on crypto transaction trails, demonstrating that anonymity is not absolute. The guidance to avoid Binance is particularly significant given the exchange’s prominence. Binance, founded in 2017, has grown to become the world’s largest crypto exchange by trading volume. It offers a wide array of services, including spot trading, futures, staking, and a native token (BNB).
While Binance has implemented robust compliance frameworks, it has also faced criticism and regulatory pressure in multiple jurisdictions for perceived laxity in monitoring illicit activity. By steering donors away from Binance, Hamas aims to sidestep the exchange’s heightened scrutiny and potential cooperation with law‑enforcement agencies.
The DOJ filing also touches on the operational benefits of using multiple platforms. By diversifying the pathways through which funds move, Hamas reduces the risk that a single point of failure—such as a seizure of assets on one exchange—could cripple its financing pipeline.
This redundancy mirrors tactics used in traditional smuggling operations, where contraband is routed through several intermediaries to dilute exposure. In response to these findings, several crypto platforms have reiterated their commitment to combating terrorist financing.
Bybit and OKX, both named in the Hamas communications, have publicly announced enhanced KYC procedures and have pledged to cooperate fully with any lawful requests from authorities. Trust Wallet, being a non‑custodial solution, maintains that it does not hold user data and therefore cannot be compelled to share information, a stance that complicates investigative efforts. The emergence of crypto as a financing tool for Hamas signals a broader trend that experts warn will intensify. As blockchain technology matures and new financial primitives—such as stablecoins, decentralized exchanges, and non‑fungible tokens—gain traction, terrorist organizations are likely to experiment with these instruments to further obscure their revenue streams.
Policymakers are therefore urged to balance the need for innovation and financial inclusion with the imperative to prevent abuse. In conclusion, the DOJ’s disclosure of Hamas’ internal crypto‑fundraising instructions provides a rare glimpse into the tactical thinking of a designated terrorist group as it navigates the evolving digital finance landscape. By explicitly advising supporters to avoid Binance and to channel assets through a constellation of less‑regulated platforms into a TRON wallet, Hamas demonstrates a sophisticated awareness of both the opportunities and the risks inherent in cryptocurrency. This development underscores the necessity for continued vigilance, international cooperation, and adaptive regulatory frameworks to ensure that the promise of blockchain technology is not undermined by those who would exploit it for violent ends.