News

A suspicious activity report that flagged a Bitcoin fundraising campaign by Palestinian group Hamas became the starting point for an interagency investigation that ended with the seizure of more than $2 million in cryptocurrency, according to a senior law enforcement official.

Federal prosecutors in Washington, D.C., disclosed in August 2020 that they had taken control of 150 digital wallets tied to Al Qassam Brigades, the military wing of Hamas, after members of the U.S.-designated terrorist organization publicly sought donations to a single Bitcoin address in January 2019 before switching tactics to more aggressively layer their funds.

William Capra, a senior special agent with Homeland Security Investigations’ cybercrime group in Philadelphia, provided more details on an unspecified cryptocurrency exchange’s part in disrupting the alleged scheme during a panel at the ACAMS AML & Financial Crime Conference in Las Vegas on Tuesday.

“HSI initiated a financial investigation predicated upon a SAR filed by a cryptocurrency exchange alleging [that] Al Qassam Brigades received donations via Bitcoin to finance terrorist acts,” Capra said in his presentation. “Terabytes of data were seized from their servers, [and] hundreds of supporter Bitcoin wallets were seized resulting in the seizure of over $2 million.”

HSI’s involvement in the case began when agents searched an online database of Bank Secrecy Act-mandated reports kept by the U.S. Treasury Department’s Financial Crimes Enforcement Network, and “stumbled upon” a SAR filed by the exchange that explicitly linked a Bitcoin wallet to Al Qassam Brigades, Capra said.

“It was really a pretty low-tech way of how they were doing it,” Capra said of Hamas. “They had a single [wallet] address, which was very easy for us to trace.”

By April 2019, Hamas changed course and began auto-generating new digital wallet addresses for each donor, but even then federal investigators could identify their finances via Bitcoin’s blockchain, a publicly available, real-time ledger of payments made in the cryptocurrency.

As part of the case, which eventually ballooned into a joint investigation with IRS Criminal Investigation and the FBI, HSI agents created online personas and “executed undercover BTC [Bitcoin] donations with Hamas-linked addresses.”

Investigators also took control of a Hamas fundraising website in the month before disclosing the operation to identify more financiers, and re-routed new donations to government-controlled wallet addresses, Capra said.

Law enforcement ultimately seized at least $2 million from roughly 150 cryptocurrency wallets tied to the fundraising operation, but the value of those digital assets today could be closer to $10 million.

“In this case, even the most difficult exchanges responded to our subpoenas because it was related to terrorism,” Capra said.

Two Turkish nationals ultimately drew criminal charges for financially assisting Hamas. One of them, Mehmet Akti, allegedly received at least $227 worth of Bitcoin from a Hamas-linked wallet through an unspecified exchange in February 2019.

The relatively small payment appears to have belied a much larger operation. Akti also allegedly ran a “prolific” black-market money services business that served hundreds of clients, including at least six in the United States, an IRS agent claimed in an affidavit published in August 2020, the same month of the $2 million seizure.

Akti allegedly received U.S. dollar-denominated wire transfers from an unspecified Turkish bank, Bitcoin and Ether, for a total of $82 million from October 2017 to March 2019, at which point he acknowledged to the exchange serving him that he handled “the purchase and sale of cryptocurrency.”

“All of the U.S. dollar wires originated from a Turkish bank account held in the name Deniz Royal Dis Ticaret Limited Sirketi,” the IRS agent wrote. Akti did not appear to have registered as an MSB with FinCEN at any point during the operation.

The exchange severed ties with Akti within days of his admission and transferred his funds to other wallets⁠, including some owned by the second Turkish national charged last year.

Prosecutors did not indicate whether the exchange filed a SAR after deleting Akti’s wallet, and Capra did not say Tuesday whether the exchange that filed the SAR that led to last year’s seizure was the same one described in last year’s indictment.

Details of the case align with this month’s findings by U.S. cryptocurrency exchange Coinbase that Hamas has raised at least $1 million in Bitcoin since January 2019, vastly outpacing other groups that U.S. officials have blacklisted as terrorist organizations. In contrast, the Islamic State and al-Qaida have each raised less than $100,000 in Bitcoin, Coinbase found.

The SAR that led to the seizure described by Capra on Tuesday represents the latest example of a company within the still-nascent cryptocurrency industry proactively working to disrupt illicit finance, a trend that the Financial Action Task Force, an intergovernmental group that sets global anti-money laundering standards, acknowledged in a report one year ago.

Hamas has since resumed its cryptocurrency financing campaign with improved techniques to obscure payments⁠, including “chain-hopping,” a method of layering value through multiple digital assets, Capra said. “This [case] is child’s play … compared to where we’re going.”

Contact Daniel Bethencourt at dbethencourt@acams.org