In a series of internal communications that have now been disclosed in a filing by the United States Department of Justice, the military arm of Hamas – the organization that governs the Gaza Strip and is designated as a terrorist group by the United States, the European Union and several other jurisdictions – issued explicit instructions to its financial backers on how to move digital assets in a manner that would reduce the risk of detection by law‑enforcement agencies and financial regulators. The guidance, which was originally circulated among donors and operatives in 2023, makes clear that the group is not only aware of the growing popularity of cryptocurrencies as a fundraising tool, but also possesses a fairly sophisticated understanding of how to exploit the ecosystem of exchanges, wallets and blockchain networks to conceal the origin and destination of funds. The documents reveal that Hamas’ military wing specifically warned supporters against using Binance – the world’s largest cryptocurrency exchange by trading volume – as a conduit for sending money.
Binance, which is headquartered in the Cayman Islands and operates a global platform that allows users to buy, sell and trade a wide variety of digital tokens, has been the subject of regulatory scrutiny in multiple countries. By advising donors to stay away from Binance, Hamas appears to be attempting to avoid the heightened oversight and compliance checks that the exchange faces, especially in relation to anti‑money‑laundering (AML) and counter‑terrorist‑financing (CTF) obligations. Instead, the instruction list directs contributors to employ a set of alternative services that are perceived to have looser regulatory oversight or that are known for offering greater anonymity.
The recommended tools include Trust Wallet, a non‑custodial mobile wallet that gives users full control over their private keys; Bybit, a cryptocurrency derivatives exchange that, while regulated in some jurisdictions, is often used for its relatively swift onboarding process; OKX, another major exchange that provides a broad suite of trading products; Kast, a lesser‑known platform that markets itself as a privacy‑focused service; and Redotpay, a payment gateway that facilitates crypto‑to‑fiat conversions with minimal user verification. After moving the funds through one of these channels, donors are instructed to forward the cryptocurrency to an external wallet that operates on the TRON blockchain. The choice of TRON (TRX) as the final destination is notable for several reasons. First, TRON is known for its high transaction throughput and low fees, which make it attractive for moving relatively large sums quickly and inexpensively.
Second, the TRON network’s architecture allows for the creation of custom tokens and smart contracts, providing additional layers of obfuscation. By converting donations into TRX or TRON‑based stablecoins, Hamas can take advantage of the network’s privacy features, such as the ability to generate new wallet addresses for each transaction, thereby making it more difficult for analysts to trace the flow of money back to the original donor. The DOJ filing also includes excerpts from the internal memo that emphasize the strategic rationale behind the guidance.
According to the memo, “the use of mainstream exchanges like Binance increases the likelihood of triggering automated AML alerts and subsequent freezing of assets.” It further notes that “alternative platforms with weaker KYC (Know‑Your‑Customer) procedures, combined with the anonymity afforded by TRON’s address model, provide a more resilient pathway for financing operational activities, procurement of weapons, and payment of personnel.” The language suggests that Hamas’ financial operatives are actively monitoring the regulatory environment and adapting their methods in real time to stay ahead of enforcement actions. From a broader perspective, this revelation underscores the evolving tactics that terrorist organizations employ to harness emerging financial technologies. While traditional fundraising methods – such as charitable fronts, cash smuggling, and hawala networks – remain in use, the digital age has opened new avenues for rapid, cross‑border transfers that bypass conventional banking oversight.
Cryptocurrencies, with their pseudo‑anonymous nature and global reach, present both opportunities and challenges for security agencies. On one hand, the immutable ledger of a blockchain can provide investigators with a trail of transaction hashes that, when linked to known addresses, can help map out funding networks.
On the other hand, the sheer volume of daily blockchain activity, coupled with privacy‑enhancing tools like mixers, tumblers and privacy‑oriented blockchains, can obscure the true source and beneficiary of funds. Law‑enforcement officials in the United States and allied nations have been intensifying efforts to disrupt the flow of illicit crypto to extremist groups. Recent operations have targeted exchange accounts suspected of facilitating terrorist financing, seized digital wallets, and imposed sanctions on individuals and entities that provide crypto‑related services to sanctioned groups.
The DOJ’s decision to unseal the Hamas memo is part of a broader strategy to publicize the methods used by terrorist financiers, thereby encouraging financial institutions and crypto service providers to adopt stricter compliance regimes. Critics, however, argue that the crackdown on cryptocurrency platforms can inadvertently stifle legitimate innovation and marginalize users in jurisdictions with limited access to traditional banking.
They point out that many of the services listed by Hamas – such as Trust Wallet – are open‑source tools that are widely used for lawful purposes, and that imposing blanket bans could harm privacy‑conscious users and developers. In response to the emerging threat, several regulatory bodies have proposed new rules aimed at increasing transparency in the crypto space.
The Financial Action Task Force (FATF) has issued guidance on “travel rule” compliance, requiring virtual asset service providers (VASPs) to share sender and receiver information for transactions above a certain threshold. Meanwhile, the U.S.
Treasury’s Office of Foreign Assets Control (OFAC) continues to update its sanctions list to include specific wallet addresses and blockchain entities linked to terrorist financing. The Hamas memo also hints at a possible future shift toward more advanced privacy technologies. The mention of “custom TRON smart contracts” suggests that the group may be experimenting with decentralized finance (DeFi) protocols to embed funding mechanisms directly into code, further complicating detection. If successful, such tactics could enable automated disbursement of funds to operatives without human intervention, reducing the risk of interception.
In summary, the DOJ filing provides a rare glimpse into the internal financial playbook of Hamas’ armed wing, revealing a calculated approach to leveraging cryptocurrency platforms that are perceived to be less regulated. By steering donors away from Binance and toward a suite of alternative services before funneling assets into a TRON wallet, the organization aims to minimize exposure to AML alerts and maximize the speed and secrecy of its funding streams. This development highlights the ongoing cat‑and‑mouse game between terrorist financiers and authorities, and underscores the need for continued vigilance, adaptive regulatory frameworks, and international cooperation to counter the misuse of digital assets for violent extremism.