The Server in São Paulo: How the F.B.I. Traces and Freezes Hamas’s Cryptocurrency

2026.09.08 Author: Robert Nogacki

On September 1, 2026, the Justice Department unsealed five applications for seizure warrants: five hundred and sixty thousand dollars in cryptocurrency, along with the domains and servers through which the al-Qassam Brigades, the armed wing of Hamas, had been collecting donations from sympathizers around the world. The most recent of the documents, signed on August 18, 2026, by Matthew J. Sharbaugh, a federal magistrate judge in Washington, concerns a single server in a Brazilian data center, leased from a company in London. Forty-three pages of sworn testimony by an F.B.I. special agent, blacked out in places, are the last chapter of a story that began a year and a half earlier with one courteous e-mail, and whose first chapter, dated March 25, 2025, sits beside it in the same release, along with three intermediate ones. Read together, they show from the inside how a government pursues money that, by design, belongs to no one, and why every precaution with which Hamas reassured its donors turned into a trail.

A Letter from the Brigades

On February 10, 2025, someone in the United States wrote to fund@alqassam.ps asking how to make a donation to the al-Qassam Brigades. A few hours later, a reply arrived in Arabic. It opened with a verse from the Koran about striving with one’s wealth and one’s life in the cause of God, proceeded to a greeting (“Dear sister”), and then delivered a set of instructions as courteous and patient as a bank’s guide for first-time customers. If you have no experience with digital currencies, ask a friend, or go to a currency exchange. Show them only the wallet address; do not tell them who the transfer is for. Here is an address on the Tron network, TRC20 standard, in the currency USDT. Copy it without spaces, or better, scan the QR code. The address is good for one transfer only; we change it regularly for your safety, so write again before your next donation. Do not send from Binance, because they will block your wallet: you may buy there, but send through Trust Wallet, RedotPay, OKX, Kast, or Bybit. And one more thing: our reply may land in your spam folder.

The sender did not know that he was writing to an F.B.I. informant. He knew perfectly well, however, how the modern anti-money-laundering system works, and he was explaining to donors, point by point, how to get around it. It is rare for one side in a conflict to draw so precise a map of the other side’s battlefield. On one side stands an organization that needs money and must, to get it, disclose an address. On the other stands a government with an inexhaustible supply of patient people willing to ask for that address, a public ledger of every transaction ever made, and the telephone number of the company that issues the currency. Everything that followed is a consequence of that asymmetry.

Hamas, for that matter, knew the asymmetry from experience. In 2019, the Brigades began collecting Bitcoin, first on Telegram and then on their own Web sites: alqassam.net, alqassam.ps, and qassam.ps. They boasted that the donations were untraceable, published instructional videos, and generated a fresh address for each donor. In August, 2020, the Justice Department announced the seizure of some hundred and fifty accounts and admitted outright that the F.B.I. had covertly taken over the infrastructure behind alqassam.net and, for a time, run it itself. Anyone who donated during that period was donating to the United States government. In April, 2023, Hamas announced that it was giving up Bitcoin out of concern for donors’ safety. As it turned out, it drew from that lesson precisely the wrong conclusion.

The Address That Took In 25,211 Dollars

The anonymity of cryptocurrency is a linguistic misunderstanding. A blockchain is a public ledger in which every transfer is recorded forever, with its amount, its time, its sender, and its recipient; the only thing missing is a name beside the address, the string of letters and digits that serves as an account number. Whoever can read the ledger sees the movement of money in its entirety. Whoever wants to know whose money it is must find the place where an address meets an identity document. Blockchain analysis is the art of finding such places, and the March affidavit, sworn by a special agent from the F.B.I.’s Albuquerque field office (name redacted; his résumé shows a former Marine Corps communications officer, with the Bureau since 2022 and one of two agents in that office licensed to trace cryptocurrency in commercial analytics software), is a tutorial in that art conducted on a live specimen.

The address that the informant received on February 10, which the document calls Donation Address 1, took in 25,211 USDT in all: according to the June affidavit, in thirty-four deposits between February 11 and February 21, although the letter had promised that the address was good for a single transfer. Not even those who made the safety promise kept it. Of that sum, 23,618 USDT flowed to a single address that the agent christened the al-Qassam Brigades Operational Wallet. About 1,600 USDT went to a cluster of addresses that the analytics software attributed to BTCTurk, an exchange in Istanbul; the agent notes that he did not request records from it for fear that the exchange would tip off its customers. The Operational Wallet turned out to be the heart of the network: between October 28, 2024, and March 3, 2025, roughly 1,349,725 USDT flowed into it, about seventy-five thousand a week. An organization that generates a separate address for each donor must eventually gather the money in one place in order to spend it; the movement from many addresses to a common point betrays that they all belong to one hand. The federal courts accepted this form of inference, known as clustering, as a basis for evidentiary findings as early as 2020, in United States v. Gratkowski, and the agent invokes it.

The key to the network, however, was found not in the flow of money but in the fees paid to move it. Every USDT transfer on the Tron network requires a small fee in TRX, the network’s native token, the way a car requires gas, and the gas has to be delivered to the address first. On February 16, 2025, the head of national-security intelligence at the analytics firm whose tools the F.B.I. uses (Person No. 1, in the document) showed the agent that the fees for withdrawals from one donation address after another had been paid from the same wallet. The agent named it the Gas Wallet. More than ninety-two per cent of the withdrawals from the Operational Wallet were fuelled by it, too. The Brigades changed the address for every donor, but someone had to fill each of those addresses with fuel, and he always filled them from the same can. The rotation of addresses, advertised as a safety measure, did indeed defeat the static blacklists in exchanges’ compliance systems. It defeated nothing else.

From that moment, the investigation became arithmetic. A second informant, CHS-2, coaxed seven more addresses out of fund@alqassam.ps: all were fuelled from the Gas Wallet, all surrendered most of their funds to the Operational Wallet, all lived for a few days and were emptied to zero. Over two weeks, from February 14 to February 28, they took in about 45,948 USDT, while the Operational Wallet received 155,448 USDT from other sources in the same period. The agent then identified eight further addresses that no informant had supplied, solely on the basis of shared fuel and identical behavior. Since every address was single-use and issued on request, the F.B.I. collected them simply by asking; the agent writes of three human sources in March, 2025, alone, and of others who were still receiving addresses in February, 2026. The safety measure became an intelligence channel, and every new address a specimen.

The Edge of the Ledger

The ledger, however, has an edge. It records what happens between addresses and is silent about what happens inside an exchange. When two customers of the same platform send each other funds, the transaction exists only in the platform’s internal books and leaves no trace on the public chain. The agent concedes this plainly: here open-source tools stop working, and the investigation is at the operator’s mercy. Binance’s records showed that part of the money from the Operational Wallet circulated in exactly this way, among the accounts of various people; from this the agent infers that the Brigades have a network of financiers who use a series of transfers to obscure the donations’ final destination. Another portion went to two addresses whose profile is typical of regional over-the-counter dealers, receiving many large transfers from many sources in a short time. Those addresses remain ownerless in the document, with a footnote noting that the F.B.I. is working on it.

The edge of the ledger is also the place where an address first meets a document. Cryptocurrency is useless until it is exchanged for something that can be spent, and the exchange happens through platforms and dealers subject to know-your-customer obligations. The K.Y.C. file at an exchange is the name behind the address, and that is precisely why the Brigades’ letter warned against sending from Binance. Binance gave the F.B.I. the details of three users who had received funds directly from the Operational Wallet or the Gas Wallet. The first had received 60,800 USDT in ten transfers, held a Palestinian passport, and logged in from Israel and Gaza; on March 12, 2025, his account held about a hundred and six thousand USDT. The second had received 11,800 USDT, held a Turkish driver’s license, and logged in from Turkey, Egypt, and Oman. The third had received a hundred and eleven thousand USDT in fourteen transfers between January 23 and March 6, held permanent residence in Turkey, and logged in from the Netherlands. The affidavit accuses these individuals of nothing beyond the fact that their accounts received funds from the fundraising network; who they are and what role they play, the document does not resolve, and neither will I. What speaks is the geography: donors wrote from all over the world, the money pooled on Tron, and it left through accounts stretched between Gaza, Anatolia, the Gulf, and the Netherlands. That spread of log-ins is in itself an alarm for any transaction-monitoring system, and, as the agent writes, Binance froze the accounts on its own initiative before the F.B.I. asked. The exchange that the Brigades had told donors to avoid turned out to be the fastest to act. The same exchange, in its November, 2023, settlement with the Justice Department, admitted that it had processed transactions for the al-Qassam Brigades. About that admission, and about the fact that laundering happens not on the chain but beside it, in the exchange’s internal ledger, I wrote when Binance applied for a MiCA licence. Two years after the settlement, that same ledger, opened on demand, was the F.B.I.’s most valuable source in the case.

Forty-five Hours

There was a third player, mentioned almost in passing in the March affidavit, who in practice proved decisive. USDT is issued by Tether Limited, a company domiciled in the British Virgin Islands (so say the definitions in every affidavit; the jurisdiction section of the June affidavit already places it in El Salvador, where the company announced in 2025 that it was moving its headquarters). It controls the token’s code and can place any address on a blacklist, rendering the funds sitting there useless to whoever holds the key. A stablecoin, a currency chosen for its convenience, its speed, and its steady price, has an owner, and the owner takes calls from law enforcement. Bitcoin has no such telephone number. The owner, for that matter, is an ambiguous figure: in March, 2025, I wrote about USDT as the shadow dollar, the currency of sanctioned states and of the financial underworld, and about Tether’s habit of blacklisting addresses mostly after the money has already left them. Hamas abandoned Bitcoin for the safety of its donors and chose a currency that can be frozen with a single command. That is the wrong conclusion mentioned above.

The most instructive passage in the March document fits in a single paragraph. On the morning of March 10, 2025, the agent sent Tether a request to freeze eighteen addresses. At that moment, they held about ninety thousand USDT. Tether carried out the freeze roughly forty-five hours later, on the morning of March 12. In the interval, most of the money had left; about 2,740 USDT was frozen. Three per cent. That was no accident. According to ChainArgos data I cited in that piece, by mid-2024 some hundred and fifty-three billion dollars had flowed into addresses that Tether eventually blocked, and 1.4 billion was frozen. In January, 2026, I noted, on the other hand, that with earlier Hamas-linked addresses Tether had frozen wallets on average twenty-eight days before any court order, which means it acted before the paperwork arrived. Here the paperwork came first, and the answer took forty-five hours; a transfer on Tron takes seconds. The rest of the sum seized in March, some two hundred and one thousand dollars in all, came from the Binance accounts, where the exchange had acted on its own and faster.

The conclusion is uncomfortable for both sides. For law enforcement: in a world where a transfer takes seconds and an issuer’s response takes two days, effectiveness is decided not by a court but by a private company’s internal procedures. For the fundraising network: its money survived only because it was in motion, and motion is precisely what the ledger records most faithfully. The agent explains to the court why he is asking for a seizure warrant rather than a restraining order: cryptocurrency moves faster than bank money, cannot be recalled, and, once withdrawn, can be swapped into a privacy coin, after which the trail goes cold. The warrant itself is executed by Tether and Binance, at a time convenient to them, which is why it may be executed at any hour of the day or night. Binance transfers the account balances to an F.B.I. wallet. Tether cannot move tokens out of someone else’s address, so the attachment to the June warrant directs it to burn them and reissue an equal amount to an address designated by law enforcement. The thing against which the proceeding runs is annihilated and created anew in the hands of the state; it would be hard to find a cleaner illustration of what seizure means in a world of tokens. Two further warrants, dated June 25 and October 10, 2025, brought the total seized to roughly five hundred and sixty thousand dollars. According to the August affidavit, the network had taken in more than three million by November, 2025. The gap between those figures is the measure of what a government can do: it takes whatever is still sitting at an address at the moment it identifies it. The rest had moved on before anyone asked.

The June affidavit adds an epilogue. After the freeze of March 12, donors went on paying into the frozen Operational Wallet for several days, presumably because the address was still circulating in letters and nobody had withdrawn the instructions. From about March 17, the flows moved through new wallets, set up in minutes, as always. The fees for them were paid from the same Gas Wallet. The network realized it had been frozen and replaced everything visible: the addresses, the consolidation wallet, the routes. It did not replace the can, because the can, as it understood things, was not part of the security system but part of the logistics. By March 21, the Operational Wallet had received roughly 1,574,719 USDT in all, nearly two hundred and twenty-five thousand more than on March 3.

The same affidavit, the second of the three concerning tokens, also shows where the money went next. Part of the consolidated donations was passed through Bridgers.xyz, an automated cross-chain exchange: USDT was swapped into ether and back into USDT, which is meant to break the continuity of the record. But the exchange runs a public explorer of its own transactions, with source address, destination address, amount, and time, and the agent simply used it. From there the funds went to Binance accounts opened on Lebanese passports, with log-ins from Lebanon, France, and Italy. One of them had never held more than five hundred dollars in three months, until, on April 14, 2025, more than twenty-three thousand USDT arrived. The agent calls such accounts mules and adds that a Lebanese passport is typical in that role because it is easy to obtain or forge; that is his assessment, not a finding. Binance blocked withdrawals from those accounts the same day, again without a request from the F.B.I., and its investigator told the agent about automatic controls freezing addresses linked to this network. Further addresses were passed to the F.B.I. by private parties: an industry partner on April 13, and, on April 17, investigators working for compliance clients. The government was not the only hunter. A good part of the tracking was done in private compliance departments, which have reasons of their own not to want this money on their platforms.

One caveat is necessary here. An agent’s affidavit is a one-sided document, filed ex parte, in a proceeding where nobody is cross-examined under oath. The court decides only whether probable cause exists, not whether the allegations are proved. The figures, assessments, and reconstructions in this article should be read as the government’s claims, not as findings of a court.

The Server That Fled Tehran

Money can be frozen, but the site that collects it lives on, and here the story moves from the ledger to the telephone directory. The August, 2026, affidavit is a story about infrastructure, and it contains the most interesting paradox of the whole affair.

From January, 2024, until at least April, 2026, the domain alqassam.ps was maintained by Amnpardaz Soft Corporation, a provider in Tehran. The agent notes the obvious: hosting in Iran protects a site from being taken down by any provider tied to the United States or its allies, and Hamas’s leaders have publicly thanked Iran for military and financial support for years. But the protection has a price. Iranian infrastructure is slow, filtered, and blocked by many networks around the world. An organization whose financing model depends on reaching a donor in Europe or Asia needs reach, and reach requires Western infrastructure. The affidavit puts it in one sentence: Hamas actors used American networking infrastructure to bypass delivery restrictions and to insure that their message reached supporters across the globe. That the move was a deliberate trade of safety for reach is my hypothesis; the document records only the fact of the migration.

The migration proceeded in stages, and each stage left a different kind of trace. In the spring of 2026, the domain began to wander. The DNS history reproduced in the affidavit of July 29, 2026, shows an address at a Dutch operator in April, a brief return to Iran at the end of May, and, on May 26, a dedicated server in a data center in Atlanta. In the August document the provider’s name is redacted; the July one supplies it: GTHost, a company headquartered in Canada with servers in Atlanta, the same provider at which the domain moved in July to a second server, at 216.106.177.172. Under court order, the provider confirmed that the I.P. address had been statically assigned to alqassam.ps. The warrant of July 29, signed by G. Michael Harvey, a magistrate judge, covered that server together with the domains alaqsaflood.org and host.alaqsaflood.org, which handled fundraising and communications; the F.B.I. executed it on July 30. On August 4, a provider, again redacted, gave the F.B.I. records pointing to yet another server: 45.134.141.68, geolocated to São Paulo and owned by DataCamp Limited, of London, which operates under the brand DataPacket.

Where did the alaqsaflood.org domains come from in the first place? From the headers. The informant handed the F.B.I. three replies from fund@alqassam.ps complete with their full headers, and in them was the server that had authenticated the sender: host.alaqsaflood.org. The messages carried DKIM signatures, the cryptographic mechanism by which a mail server certifies that a message really left a given domain and was not altered in transit. A safeguard against forgery confirmed to the F.B.I. that the Brigades controlled this infrastructure. The name speaks, too: “Al-Aqsa Flood” is the code name of the October 7, 2023, operation, announced in a recording by Mohammed Deif that the affidavit quotes. The fundraising campaign’s mail server bore the name of the attack. From the same server, on July 9, 2025, the day a graphic bearing the Brigades’ addresses appeared on Instagram, the account info@alqassam.ps sent dozens of messages to suspected sympathizers; their e-mail provider, redacted, produced the records to the F.B.I. under legal process. The domains resolved to addresses of the AWS Global Accelerator service leased by GoDaddy, which Amazon confirmed in response to a search warrant. The agent explains why: many operators block traffic originating in Iran, where the site stood, traffic through AWS is restricted far less often, and such services are commonly used in countries with Internet restrictions to get around blocks. That is the concrete meaning of the sentence about American infrastructure: the site in Tehran, the mail going out through the American cloud.

Here open sources enter the picture, and it is worth seeing which ones. The agent checked public repositories of TLS certificates and the history of DNS records. The server in São Paulo carried a certificate issued by Let’s Encrypt for the domain csguard.ir, and csguard.ir is the authoritative name server for alqassam.ps. A name server is the Internet’s telephone directory: when someone types in a Web address, it is the name server that answers which I.P. number the site lives at; whoever seizes the directory redirects every caller. The certificate had been issued so that connections to that server would be encrypted and secure, and for exactly that reason it had been logged in a public certificate-transparency registry, where anyone can find it. The safeguard left a trace, and the trace pointed to the target. It is the same mechanism that had betrayed the wallets a year earlier: rotating addresses required fuel, mail required authentication, encryption required a certificate, and each of these things is a record that someone can read. Hosting in Iran protects against a court order; hosting in the West provides reach; reach leaves footprints.

A Judge in Washington and a Server in Brazil

A lawyer will ask, at this point, the question that occupies a dozen pages of the affidavit: how can a magistrate judge in the District of Columbia order a London company to surrender control of a server standing in Brazil, and a Caribbean issuer to freeze tokens belonging to unknown persons? The answer is a textbook illustration of how American forfeiture law differs from its European counterparts.

First, the proceeding is in rem, against the thing, not against a person. No one needs to be charged, arrested, or even identified; it is enough to show probable cause that the property is subject to forfeiture. Second, the basis is the broadest provision in all of American forfeiture law: 18 U.S.C. § 981(a)(1)(G)(i). It reaches all assets, foreign or domestic, of any organization engaged in a federal crime of terrorism, and all assets that afford anyone a source of influence over such an organization. The agent cites a decision of the federal district court in Washington in the case of a gold ring with a carved gemstone (United States v. One Gold Ring with Carved Gemstone, 2019), in which the court held that the provision reaches property that has never touched American soil, with no requirement of any nexus to a particular crime. It is enough that the property belongs to a terrorist organization. In the case of the tokens, there is an additional argument: Tether is the issuer, so, from the court’s point of view, the funds are in its custody, and the warrant is served on it, wherever their nominal owner may sit.

Third, the government adds a second basis, in case the first should give the court pause. Someone paid for the server. If the money passed from abroad into or through the United States with the intent of supporting a terrorist organization, then the hosting payment itself is international promotional money laundering (18 U.S.C. § 1956(a)(2)(A)), and the server is property “involved in” that transaction. The case law the agent invokes stretches that phrase to cover anything that facilitated the laundering, including clean funds commingled with dirty ones. The hosting invoice becomes the laundering transaction, and the server becomes the thing that was bought with it. This is the weakest publicly visible link in the document: the assertion that the payment entered the United States is made, but the facts supporting it are blacked out. DataCamp has infrastructure in the United States, so the construction is possible; whether it is proved cannot be judged from the unredacted text.

Venue comes from 18 U.S.C. § 3238: offenses committed outside the jurisdiction of any state, where no offender resides in the United States, are tried where the offender is first brought, and, if no one is brought anywhere, in the District of Columbia. Washington is for this reason the natural courthouse for cases in which there is no defendant. Add to that Rule 41(b)(3) of the Federal Rules of Criminal Procedure, which allows a magistrate in a terrorism investigation to issue a warrant for property located outside the district, including abroad. Why a seizure warrant rather than an ordinary restraining order? The same argument that applied to the tokens a year earlier now applies to the server: neither a protective order nor an injunction guarantees that the thing will be available for forfeiture, because a server and a domain can be moved beyond the reach of process in a matter of minutes. So the property is physically taken. Attachment A describes how: DataCamp is to redirect the domain to the name servers ns1.fbi.seized.gov and ns2.fbi.seized.gov, block any changes until the proceedings conclude, propagate the changes through the DNS as quickly as practicable, and take no unreasonable action to frustrate the order. A visitor will be greeted by a banner bearing the emblems of the F.B.I. and the Justice Department. The oath was taken by telephone; the document was to remain under seal, which was lifted on September 1; and there were fourteen days to execute it.

An attentive reader will notice that the August affidavit is not free of stumbles. The paragraph numbering restarts twice, § 2339B becomes, at one point, a nonexistent § 2239B, and the Iranian hosting company is consistently called a “registrar,” though a domain registry is a different function. The same stumbles, along with a reference to § 2339B in Title 50 rather than Title 18 of the U.S. Code and a sentence that breaks off on a conjunction, recur in the July affidavit, which points to a shared template rather than a one-time oversight. The judges signed. This is not a criticism of the judges but an illustration of the standard: in a one-sided proceeding there is no one to point out the errors, and the threshold of probable cause is low by design. Anyone who knows these proceedings from the defense side knows that the fight begins only when the owner of the property files a claim. In this case, it is unlikely that anyone will.

What Follows

The first-order consequences are in the press release: money seized, site taken over, donations intercepted. The second-order consequences are more interesting. The F.B.I. says it obtained information on thousands of people who contacted the Brigades’ site and donated, or tried to donate, in cryptocurrency or by traditional means. That information, the release states, will be used in future counterterrorism efforts. A donor who followed the instructions and asked a friend for help, or went to a currency dealer, drew them into the case as well; the March affidavit mentions outright that exchange records identified several donors to the first address. The list of applications the Brigades recommended is, in turn, a list of firms whose compliance procedures will now interest regulators; whoever processes transfers that a terrorist organization mentions in its instructions to donors will have to answer the question of how that was possible. The special agent in charge of the Albuquerque office stated the operation’s aim: to reduce the organization’s ability to receive donations and to sow distrust in its communications with donors. Distrust is the end product here, worth more than five hundred and sixty thousand dollars, because money can be raised again, and a donor who no longer knows whether he is writing to the Brigades or to the F.B.I. cannot be recovered.

For a European reader, the difference between the systems is worth noting. Polish law knows the seizure of property and the freezing of assets in criminal proceedings, and since December 30, 2024, the European Union’s regulation on information accompanying transfers of funds (the so-called Travel Rule) has required crypto-asset service providers to attach originator and beneficiary data to every transfer. The freezing of terrorists’ assets in Europe is carried out chiefly through sanctions lists, that is, by administrative decision against named persons. The American instrument works differently: a court, on an agent’s application, against a thing, wherever it stands, with no defendant, and with a private issuer or exchange as the executor of the order. It is hard to point to a European equivalent, and that is one reason global cryptocurrency cases so often end up in the District of Columbia.

A network that taught its donors how to evade verification was unravelled by transaction fees, by records from the exchange it had warned against, by the signature with which it vouched for its own mail, by a certificate it had issued to itself, and by a phone call to the issuer of the currency it had chosen. Hamas warned its donors that Binance might block their wallets. It did not warn them that the person politely asking for an address might work for the F.B.I. The ledger does not forget, and in this case the most dangerous donor turned out to be the one who asked for instructions.

Robert Nogacki is a Polish attorney and the founding partner of Kancelaria Prawna Skarbiec, in Warsaw.

This article is based on the public, partially redacted affidavits of an F.B.I. special agent in cases 25-sz-20, 25-sz-34, 26-sz-45, and 26-sz-49 (U.S. District Court for the District of Columbia) and on press releases of the U.S. Department of Justice. The statements in the affidavits are allegations made by law enforcement in ex parte proceedings and have not been tested in adversarial litigation.

Content finder