When the U.S. Justice Department seized $560,000 in cryptocurrency from Hamas-linked fundraising campaigns between March 2025 and August 2026, they didn't just disrupt one transaction. They mapped an entire financial network, address by address, using blockchain analytics to follow the money as it moved across chains, through exchanges, and into operational wallets.
If your institution handles cryptocurrency transactions, you need the same investigative capability. This checklist will help you build it.
What This Checklist Covers
This guide is for compliance teams tasked with detecting and investigating potential terrorist financing in cryptocurrency transactions. It focuses on the investigative techniques law enforcement used in the Hamas cases: identifying shared infrastructure, tracing funds across chains, and building network maps over time. Each item includes specific actions you can take and what success looks like.
Prerequisites
Before you start, confirm you have:
- Access to blockchain analytics software capable of transaction tracing and network visualization (tools like Chainalysis Reactor or similar platforms)
- Authority to freeze or escalate suspicious crypto activity under your institution's AML/CFT framework
- Clear escalation procedures for potential terrorist financing cases, including contact information for law enforcement
- Staff trained on FATF Recommendation 6 (targeted financial sanctions related to terrorism financing) and your jurisdiction's counter-terrorist financing obligations
Blockchain Investigation Checklist
1. Identify and Monitor Gas Wallets
Action: When you detect a suspicious cryptocurrency address, trace all transactions funded by the same gas wallet. Gas wallets pay transaction fees and often connect multiple addresses controlled by the same entity.
Requirement reference: This technique supports your ongoing due diligence obligations under FATF Recommendation 10 by identifying beneficial ownership patterns.
What good looks like: You've mapped at least three generations of addresses funded by a single gas wallet and documented the connections in your case file. In the Hamas investigation, a recurring gas wallet linked numerous addresses controlled by the al-Qassam Brigades that initially appeared unrelated.
2. Trace Funds Through Bridges and Cross-Chain Activity
Action: Don't stop at the blockchain boundary. When funds move through bridging services to another chain, continue tracing them on the destination blockchain.
Requirement reference: This fulfills your obligation to maintain complete transaction records under 31 CFR 1022.210 (recordkeeping requirements for money services businesses).
What good looks like: Your investigation file documents the complete path of funds across multiple blockchains, including bridge addresses, timestamps, and amounts. You've identified whether the cross-chain movement appears designed to obscure the trail.
3. Map Consolidation Patterns
Action: Track how multiple donation or deposit addresses funnel into consolidation wallets. Document the timing, frequency, and amounts.
Requirement reference: Structuring patterns support Suspicious Activity Report filings under 31 CFR 1022.320.
What good looks like: You can show a clear diagram of funds flowing from multiple source addresses into one or more consolidation points, with transaction dates and amounts. In the Hamas cases, investigators traced how donation addresses fed into operational wallets before funds moved onward.
4. Identify Single-Use Address Cycling
Action: When you see an entity using a new address for each transaction, document the pattern. Look for other shared infrastructure (gas wallets, timing patterns, similar amounts) that connects the addresses.
Requirement reference: This supports your customer risk profiling under your AML/CFT framework.
What good looks like: You've identified that an entity cycled through single-use donation addresses but continued using the same gas wallet or consolidation pattern, allowing you to link the activity despite address changes. According to the October 2025 affidavit in the Hamas cases, the group shifted to single-use donation wallets after the initial seizure.
5. Flag OTC and Exchange Endpoints
Action: When crypto flows into an exchange or OTC desk, record the entity, jurisdiction, and whether the endpoint exhibits money mule indicators (rapid in-and-out movements, amounts just below reporting thresholds).
Requirement reference: This supports your Travel Rule compliance obligations and helps you identify high-risk counterparties.
What good looks like: Your case file includes the name and location of each exchange or OTC desk that received traced funds, plus a risk assessment of each endpoint. In the Hamas investigation, FBI agents identified a Lebanon-based OTC broker and an account with money mule patterns.
6. Document Infrastructure Evolution Over Time
Action: Revisit earlier suspicious activity when you detect new patterns. Blockchain data doesn't disappear, so you can compare current tactics to historical behavior.
Requirement reference: This supports your periodic review obligations and helps you update customer risk ratings.
What good looks like: You maintain a timeline showing how an entity's methods changed (for example, shifting from multi-use to single-use addresses, or starting to use bridges) and you've updated your monitoring rules to detect the new patterns. The Hamas cases evolved from March 2025 through August 2026 as investigators built on earlier findings.
7. Coordinate with Law Enforcement Before Freezing
Action: When you identify potential terrorist financing, contact law enforcement before freezing assets. They may request you monitor activity to gather additional intelligence.
Requirement reference: Under FATF Recommendation 6, you must freeze designated persons' assets without delay, but coordination with authorities can enhance the investigation's effectiveness.
What good looks like: You have documented communication with law enforcement (FBI, FinCEN, or your jurisdiction's financial intelligence unit) before taking action, and you've followed their guidance on timing.
Common Mistakes
Stopping at the first exchange. Just because funds hit an exchange doesn't mean the trail ends. In the Hamas cases, investigators continued tracing through exchanges to identify subsequent movement.
Treating each address as a separate case. Shared infrastructure connects addresses. Always check for common gas wallets, timing patterns, and consolidation points.
Waiting for perfect certainty. You don't need to prove terrorist financing before filing a Suspicious Activity Report. Reasonable suspicion is the standard. File when the pattern warrants it.
Ignoring small amounts. Terrorist financing often involves smaller sums than money laundering. The initial Hamas seizure was approximately $200,000 in stablecoins, not millions.
Next Steps
After completing this checklist:
- Update your transaction monitoring rules to flag the patterns you've identified (gas wallet reuse, single-use address cycling, bridge activity followed by rapid exchange deposits).
- Train your team on the investigative techniques in items 1-6, using sanitized case studies.
- Test your blockchain analytics tools against a known suspicious pattern to confirm they can trace cross-chain activity and identify shared infrastructure.
- Review your law enforcement contacts and confirm you have current escalation procedures for potential terrorist financing cases.
Your blockchain investigation capability isn't built in one case. It's built over time, as you learn to recognize patterns, connect infrastructure, and follow the money wherever it goes.
