In mid-2019, Israel’s military used a precision strike on a narrow street to kill a Hamas commander whom it called Iran’s money man in Gaza.
The commander ran an off-the-books system of remittances in which trusted agents shuttled physical cash and goods across borders to settle customers’ balances. This so-called hawala network, as it is known in the Middle East, funneled tens of millions of dollars in financing from Iran to Hamas’s military wing.
His replacement, a Palestinian businessman called Zuhair Shamlakh, changed strategy to evade the Israelis: He turned to digital currencies.
Shamlakh’s money exchanges increasingly sent digital tokens to operators abroad to settle hawala balances, according to current and former Israeli law-enforcement officials along with former U.S. officials. Crypto sent to the digital wallets controlled by the Hamas-affiliated money exchanges could also be swapped for cash at their offices in the Gaza Strip.
This pivot helped Hamas and affiliates such as Palestinian Islamic Jihad to receive large sums from Iran during the two years that preceded the attacks on Israel in October, the officials said. It was an attempt to use a new financial technology to lessen the risks of moving physical money and goods.
Since 2021, Israel’s National Bureau for Counter-Terror Financing has issued seven orders to seize crypto funds held by three of these Gazan exchanges.
Digital wallets identified by the NBCTF in two of these orders as being connected to the exchanges had received $41 million in crypto, according to research by Tel Aviv-based analytics and software firm BitOK. Wallets linked by the bureau in another order to PIJ have received a further $93 million.
Officials at the NBCTF said a significant portion of the funds received by the Gazan exchanges were for Hamas, citing Israeli intelligence that went beyond blockchain analysis. They said the PIJ crypto transactions also used the network of money-service businesses aiding Hamas and its affiliates.
Some of the exchanges identified by Israel look like typical storefront operations that offer international money transfers. Part of their businesses involved legitimate activity such as trade payments and remittances in order to generate sufficient cash flow to obscure the Islamist groups’ financing, the NBCTF officials said.
They said, at times, as much as half the money going through the exchanges went to Hamas.
Hamas, Shamlakh and his businesses didn’t respond to requests for comment.
Iran’s mission to the United Nations didn’t comment. Iranian government officials have characterized Western sanctions as illegal financial warfare and have said Iran has secret financing mechanisms meant to sidestep the sanctions and fund its regional allies.
Shamlakh, owner of the Al Mutahadun exchange, which was cited in five of the seizure orders, was Hamas’s “main money changer” tasked with arranging the transfer of Iranian money, according to the Israeli defense ministry, which oversees the NBCTF.
The owner of another exchange, called Dubai Money, was a “key figure in Hamas’s economic infrastructure for laundering and transferring capital” from abroad, the defense ministry has said.
After one 2020 order by the ministry to seize his company’s assets, Shamlakh denied that Al Mutahadun received funds from Iran in a statement carried by Palestinian media, saying Israel’s allegations were “pure lies and slander.”
Using the hawala networks
Initially, Hamas used crypto only to receive small-scale donations from supporters as part of a broader crowdfunding effort, which Israeli officials said has likely raised several million dollars.
Around 2020, crypto became a method of large-scale transfers between Iran and the group within the hawala networks, according to the current and former Israeli officials and ex-U.S. officials.
Since then, crypto has been “an essential part for their operational activity,” one senior NBCTF official said.
Iran has long been Hamas’s primary benefactor, with the U.S. putting regular funding from Tehran at roughly $100 million a year. Hamas also has earned income from a global investment portfolio, raised money through charitable organizations, and skimmed off funds from official foreign aid and tax revenues in Gaza.
The U.S. designated Hamas a terrorist organization in 1997, limiting the group’s access to the international banking system. Israel’s blockade of Gaza has made it hard for Hamas to obtain physical cash. Researchers say the group has often resorted to a network of tunnels to smuggle in bills. Israeli officials said in recent years most of Iran’s financing of Hamas moved through the chain of hawala dealers and money-service providers that are spread across Gaza, Lebanon, Syria and Turkey.
Western intelligence and security officials say that Iran and its proxies often own or control exchange houses as critical nodes for financing their operations.
“This is the silent way for them to get money into Gaza,” said Tom Alexandrovich, director of the cyber defense division at Israel’s National Cyber Directorate, which has supported the NBCTF’s crypto investigations.
Hamas’s use of digital currencies has intensified scrutiny on the crypto industry.
While crypto transactions are visible on public blockchain ledgers, many foreign platforms that customers use to trade digital currencies have weak compliance controls or are designed to conceal their identities.
The Treasury Department last month designated foreign “mixer” crypto platforms, which enable users to exchange cryptocurrency with relative anonymity, as primary money-laundering hubs to combat their use by Hamas and other terrorist groups.
More than 100 U.S. lawmakers signed a letter last month expressing concern about the “serious national security threats” posed by crypto’s use to finance terrorism.
In a response to the lawmakers, the Chamber of Digital Commerce, a business lobby group, disputed crypto’s utility for terrorist financing. “Blockchain technology facilitates the tracking, tracing, and dismantling of blockchain-based terrorist funding and has proven enormously effective for law enforcement,” it said.
Crypto in Gaza
The Israeli military targeted the commander, Hamid Ahmed Khudari, while he was in a car driving down a Gaza street.
Hamas’s armed wing, the Al-Qassam Brigades, in a statement at the time called Khudari “a generous and loyal mujahideen.” A Palestinian media outlet reported that Khudari was one of the territory’s largest currency traders, distributing salaries to poor residents and militants alike.
Shamlakh took his place, according to Israel’s defense ministry.
His Al Mutahadun exchange advertised on its Facebook page conversions for dollars, shekels and other local currencies at its streetfront office in Gaza.
Israeli military intelligence officers began tracing tens of millions of dollars in payments from Iran’s Islamic Revolutionary Guard Corps to Al Mutahadun, and other exchanges owned by Shamlakh, that were earmarked for the Al-Qassam Brigades to buy arms and pay fighters, according to the defense ministry.
The NBCTF took action against Shamlakh’s shift to crypto in 2021.
The bureau issued its first order to seize Al Mutahadun’s crypto funds, targeting 47 accounts at Binance, the world’s largest exchange. It said the funds either belonged to the Gazan firm or were “used for the perpetration of a severe terror crime.”
A Binance spokesperson said it follows internationally recognized sanctions rules, blocking a small number of accounts linked to illicit funds.
That and later orders sought to seize the Hamas-controlled exchange houses’ own crypto trading accounts, as well as their customers’ accounts and digital wallets, people familiar with the actions said. It is possible that not all of the clients were involved with Hamas.
The wallets identified in the seizure orders likely only represented a fraction of the wallets used by Hamas, according to a former Israeli official, who worked on the NBCTF’s investigations until this year.
“It’s a drop in the ocean,” the ex-official said.
The use of crypto by the Gaza money exchanges was more sophisticated than Hamas’s earlier fundraising efforts in bitcoin. Digital wallets connected to the companies moved funds overwhelmingly in the form of the stablecoin tether on a blockchain system called Tron, which has heightened user privacy.
To obscure the money trail, the exchanges often changed the wallet addresses they used each day, and sent funds through mixers, Israeli officials said. They also received funds from Garantex, a large Russian crypto exchange under U.S. sanctions, and several Iranian exchanges, according to the ex-official and blockchain analytics research.
A Garantex spokeswoman said it adhered to international compliance standards on financial crime.
The Gazan exchange network remains active. In late September, another exchange service company called AlKahira, which shares an address and phone numbers with Dubai Money, posted a Facebook ad for cash withdrawals and deposits via tether at its two branches in Gaza.
The NBCTF officials said AlKahira and Dubai Money were affiliated and were also linked to another money-changing house in Istanbul that the bureau targeted in a July order to seize $1 million in assets.
AlKahira didn’t respond to requests for comment.
AlKahira periodically has alerted customers on its Facebook page that it was “paying out funds for the martyrs and wounded inside its branches.” Its most recent such post was on Oct. 3, four days before the attack on Israel.
—Rory Jones and Omar Abdel-Baqui contributed to this article.