In a recent filing submitted to the United States Department of Justice, investigators disclosed a striking piece of internal communication from the military wing of Hamas, the Palestinian Islamist organization designated as a terrorist group by the U.S. government.
The document reveals that Hamas’ armed faction explicitly instructed its financial backers to avoid routing cryptocurrency donations through Binance, the world’s largest cryptocurrency exchange by volume, and instead to employ a collection of alternative services—namely Trust Wallet, Bybit, OKX, Kast, and Redotpay—to funnel money into a TRON-based wallet located outside of mainstream exchange ecosystems. The guidance appears in a series of encrypted messages that were intercepted as part of a broader crackdown on illicit financing networks supporting extremist groups.
According to the DOJ’s analysis, the Hamas military wing is increasingly turning to digital assets as a means of circumventing traditional banking channels, which are subject to rigorous anti‑money‑laundering (AML) and counter‑terrorism financing (CTF) regulations. By leveraging the relative anonymity and cross‑border speed of cryptocurrencies, the organization hopes to sustain its operational budget while evading detection by financial intelligence units worldwide. Why Binance? The filing notes that Binance, despite its massive user base and extensive compliance program, remains a high‑visibility target for regulators.
The exchange has faced multiple investigations in the United States, Europe, and Asia over alleged lapses in customer due‑diligence and the facilitation of illicit transfers. Hamas’ decision to steer clear of Binance reflects a strategic assessment: using a platform that is constantly under scrutiny increases the risk that transactions will be flagged, frozen, or reported to authorities. By moving funds through less regulated wallets and exchanges, the group aims to reduce the digital footprint of its financial flows. The alternative platforms listed in the instruction each have distinct characteristics that make them attractive for covert financing.
Trust Wallet is a non‑custodial mobile wallet that allows users to store private keys locally on their devices, eliminating the need for a centralized service that could be compelled to share data. Bybit and OKX are derivatives‑focused exchanges that, while still subject to AML obligations, have historically been slower to implement stringent verification processes for certain transaction types, especially for users operating in jurisdictions with weaker oversight. Kast and Redotpay, lesser‑known services operating primarily in the Asian market, provide additional layers of obfuscation by routing transactions through a network of micro‑payment channels and off‑ramp solutions that are not as tightly integrated with global compliance frameworks.
The choice of the TRON blockchain as the final destination for the funds is also noteworthy. TRON, a high‑throughput platform known for low transaction fees and fast settlement times, has become a popular conduit for illicit actors because its ecosystem includes a multitude of decentralized applications (dApps) that can be used to mask the origin of assets.
Moreover, the TRON network’s governance model and relative lack of rigorous KYC requirements for many of its token issuers make it a fertile ground for laundering proceeds from illicit activities. By directing donations to an external TRON wallet, Hamas can quickly convert fiat‑derived crypto into a variety of tokens, further complicating the trail that investigators would need to follow. The DOJ filing also highlights the broader trend of terrorist organizations adopting sophisticated crypto‑finance strategies. Over the past few years, intelligence agencies have documented a rise in the use of privacy‑enhancing coins such as Monero and Zcash, as well as the exploitation of decentralized finance (DeFi) protocols that operate without a central authority.
Hamas appears to be following a similar playbook, adapting its tactics to the evolving digital landscape. The organization’s internal memo stresses operational security, urging donors to use VPNs, anonymizing tools, and to avoid linking their personal identities to any blockchain address that could be traced back to them.
From a policy perspective, the revelation underscores the challenges that regulators face in balancing the legitimate growth of the cryptocurrency industry with the need to prevent abuse by malicious actors. While major exchanges like Binance have invested heavily in compliance infrastructure, the sheer volume of daily transactions—often exceeding billions of dollars—means that some illicit flows inevitably slip through the cracks.
Smaller, less regulated platforms, on the other hand, can become attractive havens for those seeking to evade detection. In response to these findings, U.S. authorities are likely to intensify scrutiny of crypto service providers that cater to high‑risk jurisdictions. The Financial Crimes Enforcement Network (FinCEN) has already issued guidance urging firms to implement enhanced due‑diligence measures for transactions involving high‑risk countries and to monitor for patterns indicative of terrorist financing.
Additionally, the Treasury’s Office of Foreign Assets Control (OFAC) may expand its sanctions list to include specific wallet addresses or smart contracts associated with Hamas’ crypto operations. For the broader public and the crypto community, the DOJ’s disclosure serves as a reminder of the dual‑use nature of digital assets.
While blockchain technology offers unprecedented opportunities for financial inclusion, transparency, and innovation, it also provides a veil for those intent on funding violence and destabilizing societies. Stakeholders—including exchanges, wallet providers, developers, and users—must remain vigilant, adopt robust compliance practices, and cooperate with law‑enforcement agencies to mitigate the risk of their platforms being co‑opted for extremist financing. In summary, the Department of Justice’s recent filing paints a clear picture of Hamas’ evolving financial strategy: a deliberate shift away from high‑profile exchanges like Binance toward a constellation of lesser‑known services and a TRON‑based wallet infrastructure.
This approach reflects a calculated effort to exploit gaps in the global regulatory regime, leverage the anonymity afforded by certain blockchain networks, and sustain the organization’s operational capabilities despite mounting international pressure. As governments and the private sector continue to grapple with the complexities of crypto‑related terrorism financing, the case of Hamas underscores the urgent need for coordinated, adaptive, and technologically sophisticated responses.