Loading story…
The U.S. Department of Justice announced a court-authorized FBI operation that seized more than $560,000 in cryptocurrency allegedly intended for Hamas's al-Qassam Brigades. Authorities also took domains and servers allegedly used to solicit crypto donations and recruit or communicate with supporters, following investigations spanning March 2025 through August 2026.
Investigators traced funds through donation and consolidation wallets, cross-chain bridges, over-the-counter brokers, exchanges, and money-mule-like accounts. Although the network reportedly shifted to single-use donation wallets and bridging services after prior seizures, recurring gas-funding wallets helped link its infrastructure; the FBI also obtained information on thousands of people who allegedly contacted Hamas online, supporting continuing counterterrorism investigations.
See the reporting duties and controls this puts on the clock.
5 events from the most recent confirmed update back to the earliest known activity.
The Department of Justice announced that the FBI had seized more than $560,000 in cryptocurrency allegedly connected to Hamas fundraising campaigns and disrupted associated websites and communications channels. The announcement consolidated five related actions conducted from March 2025 through August 2026.
The FBI conducted a further court-authorized cryptocurrency seizure tied to Hamas fundraising. An October affidavit reported that Hamas had adopted cross-chain bridging services and single-use donation wallets after the earlier seizure, while investigators traced funds and froze certain assets.
Federal investigators used human-source information to identify, trace, and seize additional cryptocurrency allegedly intended for Hamas's al-Qassam Brigades. A June affidavit said blockchain analysis had traced donations through further addresses and accounts used to consolidate and move funds.
In the initial case, the FBI seized approximately $200,000 in stablecoins allegedly donated to Hamas after tracing funds from donation addresses through an operational wallet. Investigators also identified recurring gas-funding infrastructure linked to numerous al-Qassam Brigades-controlled addresses.
U.S. authorities targeted and seized domains and servers allegedly used by the al-Qassam Brigades to solicit cryptocurrency donations and communicate with supporters. Control of the infrastructure enabled the FBI to intercept intended donations and gather information on attempted contributors.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See what this changes for your reporting obligations and which controls it puts on the clock.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
US authorities reported multiple enforcement actions tied to **crypto-enabled crime**. In the Empire Market case, prosecutors said co-creators **Raheim Hamilton** and **Thomas Pavey** designed the dark web marketplace to help users evade law enforcement and launder proceeds; the market allegedly facilitated about **$430M** in transactions (drugs, stolen payment data, counterfeit currency) before disappearing in 2020 in what investigators described as an exit scam that stole an estimated **$30M** in bitcoin. Hamilton pleaded guilty to federal drug conspiracy charges and agreed to forfeit roughly **1,230 BTC** plus **24.4 ETH** and real estate; Pavey previously pleaded guilty and agreed to forfeit about **1,584 BTC** and other assets. Separately, reporting highlighted alleged misuse and laundering of digital assets in other contexts. On-chain investigator **ZachXBT** traced movements from wallets associated with **US-seized crypto** (held under U.S. Marshals Service custodianship) to wallets allegedly linked to **John Daghita**, the son of a federal contractor executive, with claims of roughly **$23M** in diverted cryptocurrency and another wallet holding about **$36M** in Ethereum; ZachXBT said he alerted the **U.S. Marshals Service**. In another DOJ case, **Jingliang Su** (a Chinese national) was sentenced to **46 months** for laundering proceeds from a cryptocurrency investment fraud that authorities said victimized **174** people for **$36.9M**, using social engineering via social media/dating platforms and counterfeit trading sites, with **$26.9M** restitution ordered and multiple US agencies involved in tracing funds and dismantling the network.
Jun 29, 2026
The U.S. Treasury launched **Operation Economic Outcast**, a sweeping sanctions campaign targeting the Iranian regime and its support network, designating nearly 60 entities, individuals, and vessels and issuing five sectoral sanctions determinations under Executive Order `13902`. Treasury also explicitly identified **digital assets** as a sanctionable Iranian sector, a move that raises secondary-sanctions exposure for exchanges and other firms that facilitate significant transactions involving Iranian digital asset businesses. A key cyber component of the action targeted five individuals tied to the Iran-based **Mabna Institute**, whose members were also charged by the U.S. Department of Justice for an alleged long-running hacking-for-hire operation conducted on behalf of the **IRGC** and other Iranian clients. OFAC published 30 cryptocurrency addresses linked to four Mabna defendants across **Bitcoin, Ethereum, and TRON**; blockchain analysis cited in reporting said the addresses received about **$16.8 million** since 2018, with roughly **92%** of the volume concentrated in wallets attributed to **Keyvan Fayaz**.
Aug 25, 2026
U.S., Chinese, Thai, and Dubai law enforcement agencies disrupted a major cryptocurrency investment fraud network by raiding at least nine scam centers in Dubai and arresting 276 people across the Middle East and Southeast Asia. The investigation began after the FBI received complaints from American victims who lost millions of dollars in so-called pig-butchering schemes, and authorities said the operation used fake online personas, romance-style social engineering, and fraudulent crypto investment platforms to steal funds from victims worldwide. U.S. prosecutors in San Diego unsealed fraud and money laundering charges against alleged operators **Thet Min Nyi**, **Wiliang Awang**, **Andreas Chandra**, and **Lisa Mariam**, along with two fugitive co-conspirators. Investigators said the network operated through **Ko Thet Company**, **Sanduo Group**, and **Giant Company**, luring victims to bogus platforms including `CoinswiftTrading` and `SwiftLedger`, then moving stolen money through cryptocurrency accounts to obstruct recovery. The Justice Department said the action forms part of its broader Scam Center Strike Force campaign against cyber-enabled fraud that reportedly cost Americans **$16 billion** in the prior year.
Jun 29, 2026