Crime

Israeli Government Seizes Cryptocurrency Addresses Associated with Hamas Donation Campaigns

Israel’s National Bureau for Counter Terror Financing (NBCTF) released information on the seizure of cryptocurrency held by several wallets associated with donation campaigns carried out by Hamas. The seizure included but was not limited to the Al Qassam Brigades (AQB), which is Hamas’s military wing.

This action comes after a sizable uptick in cryptocurrency donations to Hamas in May following increased fighting between the group and Israeli forces. Notably, this is the first terrorism financing-related cryptocurrency seizure to include such a wide variety of cryptocurrencies, as NBCTF seized not just Bitcoin, but also Ether, XRP, Tether, and others, following an investigation focused largely on analysis of OSINT, including social media posts, as well as blockchain data.

Below, we’ll look at how blockchain analysis contributed to the investigation.

Blockchain analysis shows movement of donation funds to exchanges

The Chainalysis Reactor graph below shows the Bitcoin portion of the transactions carried out by many of the addresses listed in the NBCTF announcement. Many of these addresses have been attributed to individuals connected to the donation campaigns.

Open in new tab to enlarge

The orange hexagons represent deposit addresses hosted by a large, mainstream cryptocurrency exchange and controlled by individuals named in the NBCTF announcement. On the graph, we see how funds moved to those exchange addresses from Hamas donation addresses, often passing first through intermediary wallets, high-risk cryptocurrency exchanges, and money services businesses (MSBs). Interestingly, we can also see that two addresses named in the announcement received funds from addresses associated with the Idlib office of BitcoinTransfer, a Syrian cryptocurrency exchange connected to previous terrorism financing cases. Another received funds from a Middle East-based MSB that had previously received funds from the Ibn Taymiyya Media Center (ITMC), an organization that has also been associated with terrorism financing in the past.

List of addresses seized and identified

Below is a list of all cryptocurrency addresses named in the NBCTF announcement, broken down by the individual controlling the address where possible. We are also in the process of labeling these addresses in all of our products, and will notify clients of any exposure they have to them.

Ali Ismail Shafiq Abualkas

  • 13iQsrwBYdrLpnitG5EV79o3PeHjH8XUBc​
  • 15soXrE3NJBMkkQhrccXonTT9bpjpPvE67​​
  • D5hkVKXQvJnw9nEvd36eRipxJgu1ts8ydx​
  • 0xc077bbfcf9b5b9eec0dd105e15b65ebc2a030600​
  • 12sDU3FyYJXc2oRzE6XXuuhVHCBJvaoCC8​
  • TRU6fdxpMMDdEykV1fPvcqtMNRLeyw6Ymt​
  • 0xad92a818e26fc3dbce7a1972308a4a86f54dd683​
  • TG7YAAmZ5ALicdhuxKoE3DqnuBPj2zgG1Q​

Mahmoud Madhat Ahmed Baroud

  • 1GALPyvUDDXqA6H2eHQ9Y1yidfQ6T1Drvn​
  • 0x99d29380a2e37c04e4fe75111b7d410674a6cab3​
  • rEb8TK3gBgk5auZkwc6sHnwrGVJH8DuaLh​
  • LcCBQ7fKwTrNf3nM522dcDXWsktbx95fTv​
  • 1Gg25VzQkqCizXHNSNet4RoysLEe19su4s​
  • TJKofAGPQ2mSmnPwugN79p1Ceu39KBZyHC​
  • DDifCccot9tnVqh99qnQmFSXYX99jw2aD8​
  • GAHK7EEG2WWHVKDNT4CEQFZGKF2LGDSW2IVM4S5DP42RBW3K6BTODB4A​
  • 27f405bf5c5caf0db56316b76dfc3067846cffcf8f2ffda5d5f754114ec1db35b3f6310fb25b​
  • 12154055877559948854L​

Tareq Alla Mohammedali Baraaasi

  • 1Lm9BCDUKoBUk888DCXewM5p8bJyr83cEp​
  • 0x11069987e8507d0669c870b578cc9f9b4017d127​
  • bnb136ns6lfw4zs5hg4n85vdthaad7hq5m4gtkgf23​
  • D7i5trghauwmVDT8KBqnwaYDrDU7j2xgS8​
  • TMKe9i1J46K3YDx5NjtyRTg1VDjbBhyfyJ​

Mahmoud Mohammed Mahmoud Ayesh​

  • 164fawNZVwsR5SamAJypvCMtkMx4Xv1B3f​
  • 0xddd42d46a17b9a5b0c53c5ef2b79a6acb1b50333​
  • LQsYaykwDfsKXKkVnQUNhyoVQuhiDEQrZT​
  • 1481074704939202117L​
  • D7pCdGvzKPEtnuYnFVWtW4pTGTjD9v2Tuo​
  • DF6guxhXjjBPKMxFcy9LZQsMh8GnRRhbi2​
  • TVbaPNrc2UbGrGBKwjRjjn6UENoTBnkB2d​
  • SGP2HJQBCDEX4B4PH7TVIWJZ4YZZX5C5B3TQ24QA3USY7O5X2KO5V2FPXM​
  • 13ztYvFxVpioqRvr8YUz7UmJm36ERJhMBG​

Karem Munir Mohammed Abed

  • 1JpSBaUwrZaEgmsYka7mzm9t3Z4syyaw7A​
  • TU1TTeKBxtCVYNHrVrobBtvGAeJvuqyx6p​

Mohammed Ramadan Hasan Abukwaik

  • 1A7pDH1EdrkH9YZtsPnc8uzirBFnAN9Eay​
  • LdEaGBJzGRyZBEo8vqRAeKLwRAK4hXwWP5​
  • 0xebfe7a29ea17acb5f6f437e659bd2d472deedc54​
  • 1BPf9qr7M5xUgNHUYtrQtEKvUKcyERzXao​
  • t1SfdPR5gMz1QAMGJKGTNgzCauTEMnNU6GR​
  • TXVG2seoqhk4i1WpzG6t64YAW6SCUQfDhW​
  • DKQfVwp2hm54XeUhwMbyccmgHmrP6kL7uz​

Mohammed Nasser Ibrahim Abulaila

  • 1DrhHEkv42JVwiDQNi28JFdSuiSGgPNXwP​
  • LLuDSfYfCXL24rhCGMLgguHWLvQHzHPm78​
  • 0xc0d227bd0580bad9435ca0b884ebee7ff8da71c9​
  • 1EnX6BuJiGWydqXJT9BN5dSvfLg3QW4Mdz​
  • 3177043342364495742L ​
  • D8jJNUtbmC9z1nfY8QRJ2GNWYFQz5btGot​
  • 66413449033389c6d27e9515284a9d8fd0eacf6e2c69e916b7f5451deeb4723a68c2b78e4974
  • SNwdHP6Qpkk6exSAqMG4GdTRkQRAu28SSS​
  • THuvw2pY2GSBmDewHKzahQum2yUWHJeJKh​

Other

  • 1QH9hfeSSb2iftcVpgpQp3NsFD174crFoW​
  • 1EfmRn6Bp3cjrTBubaH8MzRRc2ikSjNGXw​
  • 1Lm9BCDUKoBUk888DCXewM5p8bJyr83cEp​
  • 19D1iGzDr7FyAdiy3ZZdxMd6ttHj1kj6WW​
  • 3FWSkG5NmyXF3rqMav7piXiJUDYzKpgFRT​
  • 17QAWGVpFV4gZ25NQug46e5mBho4uDP6MD​
  • 1QAV9VoTVw7XoyqiTjmNHaKSkNc9QWfqAh​
  • 3HQJ9ta7TmYNRjkby3nbMGdHzNCCiXs3Ui​
  • 18yzhmcgHtRVoEX3doCrqhis6fFU1dHFUE​
  • 0xe090669ee62e02f4437b89058a073dc7874aed8f​
  • 179bzhS4FY7qLDza9YjuorhWyXVVYZu2YH​
  • 1LPTaRfyoNwvwAtmYzcetZLjBfUxVkJrr4​
  • bc1qg9h7s7hn4t9m7uw26gnwfm7xfxk77fkj878sg3​
  • 19XVEDZCGVMA9WCF1qUayxtnjUnyD7zDDQ​
  • 1uLdz4wXrcXjCy2CqLWuJUiE85Y7SJ1ge​
  • 1ULEqcd5te8AWqFpH7HD4KvJZ1AKcJPam​
  • 1348ThkNoDupq1bws95diMiL8haGs61K7M​
  • 1EVTZmTMqZPMzGxsug9TXBtvPJZH8dXSCK​
  • 1EDcKCRypUTFoTZbxDWF9MBAT4W7XUGB32​
  • 1EYya5dfNvuYDwpeboGKBtkXzJcEHMCQXR​
  • 1LhRW1msre1cFgT7fBY2BRrZ4ANMPwVj9u​
  • 31yqH1jVEPDJ7x9L648Ec5umM2G3zNDoe5​
  • bc1qwsqdcas3llkcx53sx4lqrcrdpxmr5s4eke6d8y​
  • 3MhdvQccMd5zAh92WrW7SpcHXwfW1uiamD​
  • 1GC2SjzCyCwxo1uxTi28oqn9L3mJj7bLPs​
  • 1C6hetVWVXZnS6P2BYBNu5Y1ZJ57JyXGac​
  • TC71Nb9mtcv4vPezL8KEKvUs3aKoYwiJZa​
  • TAHg5ZFkxaJq5wE6pGpM8mY5Q1YEvz6W3G​
  • D9KKhKM68nRaYtQJJAA82cKhd3bGWqCW46​
  • DNmxLVUn5AuzoDo2CSc7P13wcMSvZ4nsYY​
  • RPW95tQG7y47QTqS6cNA4EQ5mBmATrG91o​
  • 3c61d17a6a55c7434afa3cb43e4dcef2819f38cff2484a6c1e2fffaf089548e2db3328145343​
  • DdzFFzCqrht4k4DfGDtBaqv6boi1jjyzW2QyEFA2imphJipAcAfdEUyFeMZJtBjjiQJBFYk8JZHffuqgUK9hxbjRwrNpeUgPD78U49Vt​​

The value of blockchain analysis in conjunction with other data sources

This investigation is a perfect example of the value of blockchain analysis, especially when used in conjunction with other open source data. Israeli authorities analyzed OSINT to find Hamas’ donation addresses and, with blockchain analysis tools, were able to follow the funds to find consolidation addresses and uncover the names of individuals associated with the campaigns. Up to date transaction data across several blockchains was crucial here, as agents tracked and seized funds in several different varieties of cryptocurrency. We commend the Israeli authorities for a successful operation and look forward to facilitating more such successes for our government partners around the world.