How Israel failed to stop Hamas’ cryptocurrency flow

Since Hamas took control of the Gaza Strip in 2007, the terror organization has raised a sum estimated at least in the hundreds of millions of dollars for its military operations. Some of these funds were wired through public channels, notably money transfers from Qatar, which were carried out with the approval and knowledge of the Israeli government for the so-called “rehabilitation of the Strip” and were then subsequently used by Hamas.

Israel, along with other security bodies worldwide, was aware of terrorist organizations’ use of cryptocurrencies, but its response to the issue has been slow and too late, and primarily took place after Hamas had already converted the digital coins into cash.

Hamas’s initial cryptocurrency fundraisers date back to January 2019. It’s impossible to verify how much money was gathered at the time, but there’s evidence that two and a half years later, in the summer of 2021 and during Operation Guardian of the Walls, cryptocurrency wallets were already filling quickly.

According to researchers from TRM Labs, a company specializing in digital asset compliance and risk management, in the weeks of the operation alone, Hamas reportedly raised cryptocurrency funds amounting to around $400,000.

This increased activity drew the attention of security services in Israel and around the world, prompting them to regulate actions with stock and cryptocurrency exchanges in an attempt to block the channel in which the money flowed. It’s unclear whether this action has been effective, but in April Hamas announced that it would stop accepting donations in Bitcoin, the most well-known cryptocurrency in the world.

This announcement should be taken with a grain of salt, since other cryptocurrency wallets linked to the organization and its various branches, as well as wallets associated with the Palestinian Islamic Jihad (PIJ), remained active and continued to raise funds in the months since. Israel reported success in freezing several crypto wallets on October 10, three days after Hamas’ murderous attack and over half a year after the terror organization’s initial announcement.

GazaNow is a news platform operating on Telegram with over a million followers worldwide. In the past two years, several fundraising campaigns for Hamas and the Islamic Jihad took place on this platform, including the publishing of cryptocurrency wallet numbers for accepting money transfers. Attempts to trace the flow of funds from some of these wallets indicate that large amounts of money were received.

For example, a specific crypto wallet was first posted on the platform in August 2021 for fundraising purposes and reappeared later. Over time, this wallet collected a sum of $800,000, to which an additional $20,000 was added in the two days following the attack on October 7th.

This wallet is only one example, and numerous others circulate the network. On October 19, GazaNow published the numbers of two new crypto wallets for digital donations – one for Ethereum and the other for Bitcoin. Although these two wallets operated for only a few days before being frozen, they managed to collect a combined total of around $10,000.

The money flowing into the wallets is quickly withdrawn by Gaza’s terrorist organizations. For example, the funds in the Ethereum wallet were transferred almost immediately to another crypto wallet and then sent for deposit to an account on an online platform called Bybit, a company registered in the Virgin Islands and operating from Dubai, Qatar.

The platform, essentially a type of currency exchange, allows the conversion of cryptocurrencies to cash while bypassing regulation and sanctions. Opening an account is done solely by providing an email and password, and there are several options for withdrawing cash, some of which allow users to maintain absolute anonymity. These options include using a Bybit-issued cash card, withdrawing from an ATM using a QR code, or transferring funds to bank accounts registered somewhere else.

Bybit’s activity was prohibited in the United States several years ago and on, October 1, it was forced to cease operations in the UK due to new regulatory laws. However, it still allows money exchange in other parts of the world.

Another platform through which funds were redeemed from GazaNow’s crypto wallets is Binance – a Chinese company operating from Singapore for several years that was forced to relocate its offices to the Cayman Islands and Malta.

Similar to Bybit, until August 2021, Binance required only an email to register an account – a vulnerability exploited by Russian and North Korean criminals. Currently, Binance is facing increasing legal pressures and investigations in the United States due to suspicions of its involvement in money laundering.

In recent years, Israeli law enforcement has intensified its efforts to identify and block the use of cryptocurrencies by terrorist organizations. Locating and freezing crypto wallets are complex tasks both legally and technologically due to the need to identify the wallets themselves and the required legal procedures to stop their operation.

In this context, Israeli authorities are required to issue local seizure orders and then approach the courts in countries where crypto wallet registration platforms operate. Alternatively, they may directly approach these platforms and exchanges hoping they’ll be willing to cooperate due to concerns about financing terror.

According to reports in foreign media, this cooperation – at least in some cases – has led to the freezing of several crypto accounts. In recent weeks, a group of Israeli volunteers and local crypto companies has been established to identify suspicious crypto wallets for Israeli authorities.

Over the past year, the Defense Ministry has successfully frozen numerous suspicious crypto accounts. Defense Minister Yoav Gallant revealed this in a speech he gave in June at the National Bureau for Counter Terror Financing of Israel’s third cryptocurrency conference.

“In addition to the constant and uncompromising fight against terrorism, a new battlefield has emerged – the fight against the resources behind terrorism, or in simple terms – the fight against terrorist funds,” said Gallant. “This is a first-of-its-kind event. Those who fund terrorism or manage financial relationships with terrorists should know that they are targets, similar to anyone aiding terrorist activities.”

Despite Gallant’s words, it’s evident that many crypto wallets associated with terrorist organizations continue to operate unhindered, at least until the attack on October 7. The Israel Police’s Lahav 433 unit reported it successfully froze Hamas crypto accounts.

However, this only took place three days after the attack, and no additional details were provided. Based on the timing of this operation, it seems one of the frozen accounts is the GazaNow crypto wallet.

Another example is a directive Gallant signed in April, authorizing the seizure of over 80 Binance accounts linked to Hamas. Some of these crypto wallets had been mentioned in official documents almost a year and a half before the directive was put into motion and, in the meantime, tens of thousands of dollars were withdrawn from them.

A third example is a seizure order issued by the Defense Ministry on July 4 to freeze crypto wallets linked to the PIJ. According to reports, these crypto wallets managed a total of $94 million. It was also discovered that some of the wallets received funds from Iran, and in an attempt to obscure Iran’s involvement, funds from other sources were also used. Despite the seizure order, some of these crypto wallets still continue their operations.