Update, 4/1/24: NBCTF issues seizure order for Gaza Now addresses, Tether freezes funds
Today, Israel’s National Bureau for Counter Terror Financing (NBCTF) published a seizure order that was issued on January 24 against Gaza Now, naming several addresses included in OFAC and OFSI’s sanctions designation against the social media news outlet. As a result, Tether has blacklisted those addresses, meaning they are unable to withdraw any USDT that they hold. Those addresses are:
- 0x21B8d56BDA776bbE68655A16895afd96F5534feD
- TH96tFMn8KGiYSLiwcV3E2UiaJc8jmcbz3
- 0x175d44451403Edf28469dF03A9280c1197ADb92c
The NBCTF seizure order also includes accounts hosted at cryptocurrency exchanges, but does not note the addresses associated with those accounts.
Chainalysis assisted NBCTF in identifying these funds, and we remain committed to working with the public and private sectors in shutting down the use of cryptocurrency for terrorism financing activities.
Original post, 3/27/24
On March 27, 2024, the U.S. Treasury’s Office of Foreign Assets Control (OFAC) and the UK’s Office of Foreign Sanctions Implementation (OFSI) sanctioned two individuals and three entities for their role in raising money for Hamas following the October 7 attacks against Israel. Those individuals and entities are:
- Gaza Now, a social media news outlet based in Gaza that has posted pro-Hamas content and solicited donations for Hamas, including via cryptocurrency
- Mustafa Ayash, the founder and director of Gaza Now
- Al-Qureshi Executives and Aakhirah Limited, two London-based businesses that sent money to Gaza Now and promoted Gaza Now as a partner in a joint fundraising effort for Hamas
- Aozma Sultana, the director of Al-Qureshi Executives and Aakhirah Limited
In the case of Gaza Now, OFAC and OFSI included in their designations several cryptocurrency addresses controlled by the media outlet, which have been used in crypto donation campaigns. In total, those addresses have received nearly $4.5 million in cryptocurrency. Below, we’ll share those addresses and an analysis of Gaza Now’s pro-Hamas activity and crypto transaction history.
Gaza Now’s support for Hamas and crypto fundraising
Gaza Now is a social media news outlet with millions of followers across platforms like Instagram, Twitter, and most of all, Telegram. Following October 7, Gaza Now increased its online profile and attracted followers by posting highly graphic videos of the attacks and subsequent fighting in Gaza (for this reason we recommend readers not visit Gaza Now’s social media channels). A 2017 article from the Times of Israel highlights the controversy Gaza Now’s broadcasts of violent content, such as the livestream of an execution, has caused in the past.
Gaza Now makes no secret of its support for terrorist organizations. In the screenshot of its Telegram channel below, for instance, the outlet expresses praise for the Hamas-aligned Al-Aqsa Martyrs’ Brigades.
Gaza Now had long promoted crypto donation campaigns, and some of the addresses highlighted in sanctions designations today began receiving funds in 2021. However, Gaza Now ramped up these efforts after October 7, frequently changing addresses as a result of increased scrutiny following the attacks and the channel’s subsequent growth in followers Gaza Now regularly posted and then deleted posts asking for donations and switched between several different cryptocurrencies as part of these efforts.
In the screenshot below, Gaza Now provides donation options for both crypto and fiat, and also references Aakhirah Limited, which was also sanctioned by OFAC concurrently with Gaza Now.
We can see Gaza Now’s crypto fundraising and subsequent transactions on the blockchain as well. The addresses highlighted in the sanctions designations include both personal wallet addresses and addresses hosted at exchanges. First, we’ll look at some of the inflows to Gaza Now’s mainstream exchange deposit addresses on the Chainalysis Reactor graph below. These account for the vast majority of Gaza Now’s total inflows, having received a total of over $4.4 million in cryptocurrency.
Inflows have come primarily from mainstream exchanges, but as we show on the graph above, the addresses have also received funds from three wallets previously targeted in an NBCTF seizure, as well as from an exchange based in Iran and a money services business (MSB) based in Gaza.
Gaza Now’s personal wallets, on the other hand, have received just over $40,000 in inflows across a variety of cryptocurrencies.
Most of those funds have come from mainstream exchanges, but as we see above, funds have also come in from instant exchanges, mixers, and smart contracts, suggesting that some donors took extra steps to obfuscate their activity. On the outflows side, these addresses have sent cryptocurrency primarily to nested services at mainstream exchanges, presumably to be converted into cash.
Overall, Gaza Now’s incoming transactions have come in a wide range of sizes, with most being under $10,000.
It’s possible that the larger transfers have been due to internal movements of funds by Gaza Now or its collaborators, rather than from donations.
Gaza Now cryptocurrency addresses identified by OFAC
OFAC and OFSI highlighted the following cryptocurrency addresses in its designations of Gaza Now:
- TH96tFMn8KGiYSLiwcV3E2UiaJc8jmcbz3
- TGJVc32ig2u8tQsYMLE7KXHT5NDQroaVNU
- TXEsK1sEsKjZ1xtHitnyAAoqw3WLdYdRNW
- 0xE950DC316b836e4EeFb8308bf32Bf7C72a1358FF
- 0x21B8d56BDA776bbE68655A16895afd96F5534feD
- 3Q8H2ZWMtc4R1M3mkmhnTjCoYKTeCFigDP
- TTgcTTNbNuFdbrhvbjMZVrdU5KALyzDaPw
- 0x175d44451403Edf28469dF03A9280c1197ADb92c
All of these addresses are now attributed as belonging to a sanctioned entity in all Chainalysis products.
Combatting terrorism financing is vital
Terrorism financing via cryptocurrency is a complex problem. Sanctions designations and the highlighting of specific addresses, as seen in this action, is a critical step toward fighting this activity, and toward understanding its true scope so that the industry can respond as effectively as possible.
This website contains links to third-party sites that are not under the control of Chainalysis, Inc. or its affiliates (collectively “Chainalysis”). Access to such information does not imply association with, endorsement of, approval of, or recommendation by Chainalysis of the site or its operators, and Chainalysis is not responsible for the products, services, or other content hosted therein.
This material is for informational purposes only, and is not intended to provide legal, tax, financial, or investment advice. Recipients should consult their own advisors before making these types of decisions. Chainalysis has no responsibility or liability for any decision made or any other acts or omissions in connection with Recipient’s use of this material.
Chainalysis does not guarantee or warrant the accuracy, completeness, timeliness, suitability or validity of the information in this report and will not be responsible for any claim attributable to errors, omissions, or other inaccuracies of any part of such material.