On September 1, 2026, the U.S. Department of Justice announced that the FBI had seized more than USD 560,000 in cryptocurrency intended to support Hamas. The operation also took control of related fundraising and recruitment websites, domains, and server infrastructure.
This is not just a story about one frozen address.
The DOJ announcement and the publicly released seizure warrant packages show a more useful investigative pattern: law enforcement did not stop at a single transfer. It connected on-chain flows, rotating donation addresses, Gas Wallet funding, aggregation wallets, exchange accounts, OTC indicators, fundraising websites, and server infrastructure into one case view.
For VASPs, wallets, payment companies, and stablecoin issuers, the lesson is not simply to add more addresses to a blocklist. The harder question is whether a compliance system can still recognize the same fundraising network when the front-end donation address keeps changing.
1. The case begins with a fundraising process, not a single address
According to the DOJ announcement dated September 1, 2026, the fundraising activity used encrypted communication groups and websites to direct supporters to contact the fundraising network and obtain cryptocurrency donation addresses. The announcement specifically noted that the addresses were rotating rather than fixed.
That detail matters.
Traditional address screening is good at answering whether a known address has already been labeled. But if each supporter is given a new address, a static blocklist will always be late. The investigation has to continue beyond the initial hit: who funded the transaction fees, where did the funds move next, did the address connect to the same aggregation wallet, and did the funds later enter an exchange or cross-chain conversion service?
In this case, the on-chain starting points included three types of information: TRON USDT donation addresses disclosed in court documents, Gas Wallets shared across those addresses, and the al-Qassam Brigades Operational Wallet that received funds.
2. Donation Address 1 was not an isolated address
The DOJ warrant package dated June 25, 2025 states that the FBI obtained a TRON USDT address from a confidential source: TSWL3euRjZWXiFJgzuV9tYAGiwShtPWkZK. The document refers to it as Donation Address 1.
The fundraiser claimed that addresses would be changed periodically and that each address would be used only once in the support process. On-chain records told a different story. Donation Address 1 received 34 deposits between February 11 and February 21, 2025, totaling 25,211 USDT. It then made six outbound transfers across four dates between February 12 and February 23, each time largely clearing its balance.
That already shows one thing: a rotating address is not necessarily a one-time address.
The more important question is where the funds went. The warrant states that of the 25,211 USDT received by Donation Address 1, 23,618 USDT was transferred directly to TA3aQxRwocYytqZBKqMPHPZT6pYvwGjLg1, identified as the al-Qassam Brigades Operational Wallet. Around 1,600 USDT was transferred to an address cluster identified as related to BTCTurk.
Using Donation Address 1 as the starting point, the ChainTrust research team reviewed the on-chain path in CT Probe. The address behaved more like a front-end collection address: funds came in, were quickly split out, and one core path led to the Operational Wallet disclosed in the DOJ documents.
If we only look at Donation Address 1, it appears to be a short-lived receiving address. If we follow the outbound path, it becomes an entry point into a wider fundraising network.
3. The Operational Wallet is the main investigative object
For a compliance team, the risk of Donation Address 1 does not come only from that address. It comes from the back-end wallet it connects to.
The DOJ warrant states that TA3aQxRwocYytqZBKqMPHPZT6pYvwGjLg1 received approximately 1,574,719 USDT between October 28, 2024 and March 21, 2025. This was not an ordinary receiving address. It was the Operational Wallet: it absorbed funds from multiple donation addresses, then distributed funds onward to exchange accounts, OTC-linked addresses, and other intermediaries.
In CT Check, the address appears as SEVERE and triggers rules including Sanctions & CTF - Deposit and Issuer Blocklist Withdrawal. The list view is useful because it explains why the address should be prioritized: risk level, triggered rules, inflow and outflow scale, and screening status are visible together.
The detail page brings together risk rules, transaction statistics, and top counterparties. For a compliance analyst, that is more useful than a binary hit/no-hit result because it immediately answers two practical questions: where did the risk come from, and where did the funds mainly go?
This is the difference between an alert and an investigation. If a system only says that a customer deposit address is risky, the analyst still has to piece together the upstream address, back-end wallet, outbound counterparties, and triggered rules. If the system shows the Operational Wallet's risk level, fund scale, and counterparties in one view, the case priority is easier to judge.
4. The Gas Wallet links the rotating addresses
The most important relationship signal in this case is the Gas Wallet.
On TRON, USDT transfers require TRX to pay transaction fees. If many new donation addresses receive TRX from the same Gas Wallet and ultimately route funds to the same Operational Wallet, those addresses are no longer isolated. They start to look like an address group controlled by the same operator or network.
The DOJ warrant package dated June 25, 2025 states that the FBI identified multiple donation addresses whose outbound transactions were funded by the same Gas Wallet. The document also states that around 93% of outbound transactions from the al-Qassam Brigades Operational Wallet were paid for by the same Gas Wallet.
That signal is more valuable than the balance of any single address.
A fundraising network can keep changing its receiving address. But if the fee source, aggregation destination, transfer rhythm, and clearing pattern remain consistent, the investigative graph can still expand.
On February 17, 2025, another confidential source provided the FBI with seven additional USDT donation addresses. The warrant states that these seven addresses received approximately 45,948 USDT between February 14 and February 28, 2025. During the same period, the Operational Wallet received 155,448 USDT from other addresses. The FBI observed that those addresses were also funded by the same Gas Wallet and that most of the funds moved to the Operational Wallet.
In other words, the case was not about finding seven new addresses. It was about using Gas Wallet funding and aggregation behavior to show that the addresses belonged to the same funding network.
CT Probe's Analysis Report can turn the graph canvas into a readable fund-flow record: source clusters, intermediary layers, Donation Address 1, the Operational Wallet, and CEX exits can be reviewed side by side. This is useful as analyst review material, not as a replacement for human judgment.
5. After freezing, the network changed routes
Many compliance systems treat freezing as the end of a case. This case shows why the post-freeze period can produce new relationship evidence.
The warrant states that on March 12, 2025, Tether froze certain accounts funded by the Operational Wallet at the request of the U.S. government. After that, the FBI still observed donations entering the Operational Wallet. Around March 17, 2025, new donations began moving through other intermediary wallets, while the transactions were still funded by the same Gas Wallet.
That means the network migrated after disruption. It did not simply disappear.
The later paths were also specific. On April 13, 2025, the FBI received information from an industry partner indicating that Target Property 28, 29, and 30 were involved in the funding network. The warrant states that Target Property 28 received two donations totaling around 382 USDT, which were aggregated with other donation funds into Target Property 35. The funds were then exchanged through Bridgers.xyz, an automated cross-chain conversion service, and ultimately returned to Target Property 35 before 40,010 USDT was sent to a Binance user account identified as Target Property 38.
In another path, Target Property 35 aggregated 153,106 USDT on April 14, 2025 and distributed approximately 83,700 USDT to Target Property 36 and Binance user accounts. Target Property 36 received around 43,700 USDT and, within 20 minutes, sent about 43,610 USDT to two Binance accounts.
For CTF investigations, this is the point: after one node is frozen, the question is not how much money remains in that address. The question is whether the network starts using new addresses, new routes, new conversion services, or new off-ramp accounts.
6. What this means for institutional compliance teams
If an exchange, wallet, or payment company only runs address hits, this kind of case can easily be underestimated.
First, rotating addresses weaken static blocklists. A customer deposit address received today may not have appeared on yesterday's list, but it may still be funded by the same Gas Wallet and route funds to the same aggregation wallet.
Second, Gas Wallets can be critical relationship signals. A Gas Wallet is not always the final recipient and may not hold a large balance, but it can connect a group of short-lived addresses and reveal control relationships.
Third, actions by stablecoin issuers and exchanges can change fund routes. After freezes, restrictions, or account seizures, a funding network may shift to new intermediaries, bridges, conversion services, or off-ramp accounts. Post-freeze monitoring needs to be part of the AML/CTF workflow.
Fourth, on-chain addresses and internet infrastructure should be investigated together. The DOJ announcement dated September 1, 2026 states that the FBI not only seized cryptocurrency but also took control of websites, domains, and servers. That allowed authorities to intercept later donations and obtain information about thousands of individuals who attempted to contact the fundraising network. CTF investigation is no longer only chain tracing. It is a combined view of on-chain funds and online infrastructure.
7. How ChainTrust would handle this type of case
From a ChainTrust analyst perspective, this type of case should not start with the largest possible graph. It should start with a few verifiable questions.
First, use CT Probe with Donation Address 1 from the DOJ documents as the seed address. Review USDT inflows, outbound transfers, and clearing times to confirm whether 23,618 USDT moved directly to the Operational Wallet.
Second, expand one and two hops around the Operational Wallet. Identify other donation addresses active in the same period and mark candidate addresses that show one-time receiving behavior, fast balance clearing, and concentrated transfers to the same destination.
Third, check the TRX fee source for those candidate addresses. If multiple outbound transfers were funded by the same Gas Wallet, the addresses can move from "similar behavior" to "likely same control network."
Fourth, separately trace post-freeze migration. The key nodes include Target Property 35, Target Property 36, Binance user accounts, the Bridgers.xyz route, and any new addresses still supported by the same Gas Wallet after disruption.
Fifth, place these nodes into CT Monitor. If new TRON USDT donation addresses appear, if the same Gas Wallet keeps funding TRX, or if related Operational Wallet addresses continue moving funds to exchanges or cross-chain services, the system should attach those signals back to the original case.
The point is not to replace human judgment. It is to turn an address hit into a relationship network, an evidence trail, and a set of actionable review steps.
Conclusion: The network matters more than the single address
The key lesson from the DOJ Hamas cryptocurrency seizure is not how much money one address received. It is the investigative pattern the case reveals.
Donation addresses can rotate. Individual addresses can clear quickly. Routes can migrate after a freeze. But as long as the Gas Wallet, aggregation wallet, transfer rhythm, off-ramp accounts, and online infrastructure remain connected by verifiable relationships, the network can still be reconstructed.
For institutions, the more valuable capability is not a longer blocklist. It is the ability to connect addresses, transactions, entities, infrastructure, and case actions into one reviewable investigation.
ChainTrust Labs
Learn more about ChainTrust KYT, CT Probe on-chain investigations, and CT Monitor risk monitoring:
References
[1] U.S. Department of Justice | Justice Department Continues to Disrupt Hamas Terrorist Financing Schemes Through Seizures of Cryptocurrency and Internet Infrastructure | 2026-09-01
[2] U.S. Department of Justice | 25-sz-34_06-25 Seizure Warrant Package | 2025-06-25
[3] U.S. Department of Justice | Justice Department Disrupts Hamas Terrorist Financing Scheme Through Seizure of Cryptocurrency | 2025-03-27
[4] U.S. Department of Justice | 25-sz-20_03-25 Seizure Warrant Package | 2025-03-25
[5] U.S. Department of Justice | 26-sz-49 Seizure Warrant Package | 2026-08-18