Israel’s National Bureau for Counter Terror Financing (NBCTF) released information on the seizure of cryptocurrency held by several wallets associated with donation campaigns carried out by Hamas. The seizure included but was not limited to the Al Qassam Brigades (AQB), which is Hamas’s military wing.
This action comes after a sizable uptick in cryptocurrency donations to Hamas in May following increased fighting between the group and Israeli forces. Notably, this is the first terrorism financing-related cryptocurrency seizure to include such a wide variety of cryptocurrencies, as NBCTF seized not just Bitcoin, but also Ether, XRP, Tether, and others, following an investigation focused largely on analysis of OSINT, including social media posts, as well as blockchain data.
Below, we’ll look at how blockchain analysis contributed to the investigation.
Blockchain analysis shows movement of donation funds to exchanges
The Chainalysis Reactor graph below shows the Bitcoin portion of the transactions carried out by many of the addresses listed in the NBCTF announcement. Many of these addresses have been attributed to individuals connected to the donation campaigns.
The orange hexagons represent deposit addresses hosted by a large, mainstream cryptocurrency exchange and controlled by individuals named in the NBCTF announcement. On the graph, we see how funds moved to those exchange addresses from Hamas donation addresses, often passing first through intermediary wallets, high-risk cryptocurrency exchanges, and money services businesses (MSBs). Interestingly, we can also see that two addresses named in the announcement received funds from addresses associated with the Idlib office of BitcoinTransfer, a Syrian cryptocurrency exchange connected to previous terrorism financing cases. Another received funds from a Middle East-based MSB that had previously received funds from the Ibn Taymiyya Media Center (ITMC), an organization that has also been associated with terrorism financing in the past.
List of addresses seized and identified
Below is a list of all cryptocurrency addresses named in the NBCTF announcement, broken down by the individual controlling the address where possible. We are also in the process of labeling these addresses in all of our products, and will notify clients of any exposure they have to them.
Ali Ismail Shafiq Abualkas
- 13iQsrwBYdrLpnitG5EV79o3PeHjH8XUBc
- 15soXrE3NJBMkkQhrccXonTT9bpjpPvE67
- D5hkVKXQvJnw9nEvd36eRipxJgu1ts8ydx
- 0xc077bbfcf9b5b9eec0dd105e15b65ebc2a030600
- 12sDU3FyYJXc2oRzE6XXuuhVHCBJvaoCC8
- TRU6fdxpMMDdEykV1fPvcqtMNRLeyw6Ymt
- 0xad92a818e26fc3dbce7a1972308a4a86f54dd683
- TG7YAAmZ5ALicdhuxKoE3DqnuBPj2zgG1Q
Mahmoud Madhat Ahmed Baroud
- 1GALPyvUDDXqA6H2eHQ9Y1yidfQ6T1Drvn
- 0x99d29380a2e37c04e4fe75111b7d410674a6cab3
- rEb8TK3gBgk5auZkwc6sHnwrGVJH8DuaLh
- LcCBQ7fKwTrNf3nM522dcDXWsktbx95fTv
- 1Gg25VzQkqCizXHNSNet4RoysLEe19su4s
- TJKofAGPQ2mSmnPwugN79p1Ceu39KBZyHC
- DDifCccot9tnVqh99qnQmFSXYX99jw2aD8
- GAHK7EEG2WWHVKDNT4CEQFZGKF2LGDSW2IVM4S5DP42RBW3K6BTODB4A
- 27f405bf5c5caf0db56316b76dfc3067846cffcf8f2ffda5d5f754114ec1db35b3f6310fb25b
- 12154055877559948854L
Tareq Alla Mohammedali Baraaasi
- 1Lm9BCDUKoBUk888DCXewM5p8bJyr83cEp
- 0x11069987e8507d0669c870b578cc9f9b4017d127
- bnb136ns6lfw4zs5hg4n85vdthaad7hq5m4gtkgf23
- D7i5trghauwmVDT8KBqnwaYDrDU7j2xgS8
- TMKe9i1J46K3YDx5NjtyRTg1VDjbBhyfyJ
Mahmoud Mohammed Mahmoud Ayesh
- 164fawNZVwsR5SamAJypvCMtkMx4Xv1B3f
- 0xddd42d46a17b9a5b0c53c5ef2b79a6acb1b50333
- LQsYaykwDfsKXKkVnQUNhyoVQuhiDEQrZT
- 1481074704939202117L
- D7pCdGvzKPEtnuYnFVWtW4pTGTjD9v2Tuo
- DF6guxhXjjBPKMxFcy9LZQsMh8GnRRhbi2
- TVbaPNrc2UbGrGBKwjRjjn6UENoTBnkB2d
- SGP2HJQBCDEX4B4PH7TVIWJZ4YZZX5C5B3TQ24QA3USY7O5X2KO5V2FPXM
- 13ztYvFxVpioqRvr8YUz7UmJm36ERJhMBG
Karem Munir Mohammed Abed
- 1JpSBaUwrZaEgmsYka7mzm9t3Z4syyaw7A
- TU1TTeKBxtCVYNHrVrobBtvGAeJvuqyx6p
Mohammed Ramadan Hasan Abukwaik
- 1A7pDH1EdrkH9YZtsPnc8uzirBFnAN9Eay
- LdEaGBJzGRyZBEo8vqRAeKLwRAK4hXwWP5
- 0xebfe7a29ea17acb5f6f437e659bd2d472deedc54
- 1BPf9qr7M5xUgNHUYtrQtEKvUKcyERzXao
- t1SfdPR5gMz1QAMGJKGTNgzCauTEMnNU6GR
- TXVG2seoqhk4i1WpzG6t64YAW6SCUQfDhW
- DKQfVwp2hm54XeUhwMbyccmgHmrP6kL7uz
Mohammed Nasser Ibrahim Abulaila
- 1DrhHEkv42JVwiDQNi28JFdSuiSGgPNXwP
- LLuDSfYfCXL24rhCGMLgguHWLvQHzHPm78
- 0xc0d227bd0580bad9435ca0b884ebee7ff8da71c9
- 1EnX6BuJiGWydqXJT9BN5dSvfLg3QW4Mdz
- 3177043342364495742L
- D8jJNUtbmC9z1nfY8QRJ2GNWYFQz5btGot
- 66413449033389c6d27e9515284a9d8fd0eacf6e2c69e916b7f5451deeb4723a68c2b78e4974
- SNwdHP6Qpkk6exSAqMG4GdTRkQRAu28SSS
- THuvw2pY2GSBmDewHKzahQum2yUWHJeJKh
Other
- 1QH9hfeSSb2iftcVpgpQp3NsFD174crFoW
- 1EfmRn6Bp3cjrTBubaH8MzRRc2ikSjNGXw
- 1Lm9BCDUKoBUk888DCXewM5p8bJyr83cEp
- 19D1iGzDr7FyAdiy3ZZdxMd6ttHj1kj6WW
- 3FWSkG5NmyXF3rqMav7piXiJUDYzKpgFRT
- 17QAWGVpFV4gZ25NQug46e5mBho4uDP6MD
- 1QAV9VoTVw7XoyqiTjmNHaKSkNc9QWfqAh
- 3HQJ9ta7TmYNRjkby3nbMGdHzNCCiXs3Ui
- 18yzhmcgHtRVoEX3doCrqhis6fFU1dHFUE
- 0xe090669ee62e02f4437b89058a073dc7874aed8f
- 179bzhS4FY7qLDza9YjuorhWyXVVYZu2YH
- 1LPTaRfyoNwvwAtmYzcetZLjBfUxVkJrr4
- bc1qg9h7s7hn4t9m7uw26gnwfm7xfxk77fkj878sg3
- 19XVEDZCGVMA9WCF1qUayxtnjUnyD7zDDQ
- 1uLdz4wXrcXjCy2CqLWuJUiE85Y7SJ1ge
- 1ULEqcd5te8AWqFpH7HD4KvJZ1AKcJPam
- 1348ThkNoDupq1bws95diMiL8haGs61K7M
- 1EVTZmTMqZPMzGxsug9TXBtvPJZH8dXSCK
- 1EDcKCRypUTFoTZbxDWF9MBAT4W7XUGB32
- 1EYya5dfNvuYDwpeboGKBtkXzJcEHMCQXR
- 1LhRW1msre1cFgT7fBY2BRrZ4ANMPwVj9u
- 31yqH1jVEPDJ7x9L648Ec5umM2G3zNDoe5
- bc1qwsqdcas3llkcx53sx4lqrcrdpxmr5s4eke6d8y
- 3MhdvQccMd5zAh92WrW7SpcHXwfW1uiamD
- 1GC2SjzCyCwxo1uxTi28oqn9L3mJj7bLPs
- 1C6hetVWVXZnS6P2BYBNu5Y1ZJ57JyXGac
- TC71Nb9mtcv4vPezL8KEKvUs3aKoYwiJZa
- TAHg5ZFkxaJq5wE6pGpM8mY5Q1YEvz6W3G
- D9KKhKM68nRaYtQJJAA82cKhd3bGWqCW46
- DNmxLVUn5AuzoDo2CSc7P13wcMSvZ4nsYY
- RPW95tQG7y47QTqS6cNA4EQ5mBmATrG91o
- 3c61d17a6a55c7434afa3cb43e4dcef2819f38cff2484a6c1e2fffaf089548e2db3328145343
- DdzFFzCqrht4k4DfGDtBaqv6boi1jjyzW2QyEFA2imphJipAcAfdEUyFeMZJtBjjiQJBFYk8JZHffuqgUK9hxbjRwrNpeUgPD78U49Vt
The value of blockchain analysis in conjunction with other data sources
This investigation is a perfect example of the value of blockchain analysis, especially when used in conjunction with other open source data. Israeli authorities analyzed OSINT to find Hamas’ donation addresses and, with blockchain analysis tools, were able to follow the funds to find consolidation addresses and uncover the names of individuals associated with the campaigns. Up to date transaction data across several blockchains was crucial here, as agents tracked and seized funds in several different varieties of cryptocurrency. We commend the Israeli authorities for a successful operation and look forward to facilitating more such successes for our government partners around the world.