Follow the Money · 13 — The Cause: When the Ledger Exposed the Donors

Follow the Money — Case 13. This register follows illicit value from the keyboard to its final resting place, and closes on the money's disposition: LAUNDERED · RECOVERED · FROZEN · CONVERTED · VANISHED · SPENT.

There is a story everyone thinks they already know: terrorists discovered cryptocurrency, and now they raise untraceable money in the shadows, beyond the reach of the banks and the state. It is a frightening story, and it is mostly wrong. This case follows the money into terrorist financing — the use of crypto to fund designated terror organizations, most visibly the public bitcoin-donation appeals of Hamas's military wing, the al-Qassam Brigades — and the forensic record tells almost the opposite of the fear narrative. When designated terror groups turned to the public ledger to raise money, the public ledger turned on them.

The method that drew the headlines was the public appeal. A designated group would post a cryptocurrency donation address on a website or a social-media channel and ask supporters around the world to send funds. For an organization locked out of the formal financial system by sanctions, this looked like a breakthrough: a way to receive money from anyone, anywhere, without a bank that would freeze the account. It borrowed the logic of ordinary online crowdfunding — publish an address, collect donations — and applied it to terror.

But a crypto donation address is not a secret account. It is a permanent, public entry on an open ledger, and every donation sent to it is recorded forever, for anyone to read. This is the letter about what happened when terror financiers learned that lesson the hard way. The disposition is FROZEN — because US and Israeli authorities traced the solicited funds and seized them, in what was described as the largest-ever terror crypto seizure and, later, a roughly $94 million seizure of Palestinian-Islamic-Jihad-linked wallets. The tool meant to raise untraceable money instead wrote a donor list on a public wall, and the state read it.

1. Against the Fear Narrative

Start by correcting the frame, because the fear narrative distorts everything downstream, and the register's job is the evidence, not the alarm. The popular belief is that crypto is where terrorists now raise their money, an untraceable revolution in terror finance. The documented record — including the US Treasury's own 2024 National Terrorist Financing Risk Assessment — does not support that belief. It supports a more sober and more useful picture: crypto is one channel among several, it is comparatively small next to the traditional methods, and, crucially, it is traceable in ways that make it a poor choice for anyone who thinks carefully about staying hidden.

The assessment describes a terror-financing landscape that has evolved, and not primarily toward crypto. It notes that while some individuals still seek to send money to foreign terror groups, many now forgo 'financial jihad' entirely and focus their resources on attacks against soft domestic targets; that ISIS- and al-Qaeda-related financial activity in the US is most commonly small-dollar and tied to individuals; and that terror financing overall uses diverse methods. Crypto appears in that catalogue alongside cash, informal value transfer, and the abuse of legitimate businesses and charities — as a venue, not the venue. Every serious assessment, including the FATF's work, reaches the same conclusion: terrorist financing still runs overwhelmingly on cash, on hawala and other informal transfer systems, on abused charities, and on state sponsorship. Crypto is a growing concern, but it is not where most terror money moves.

This matters for two reasons the register insists on. First, accuracy: overstating the crypto threat misdirects resources away from the cash and hawala channels that actually carry most terror money, which is a real cost. Second, and more pointed for this case, the reason crypto stays a minor channel is precisely its traceability. Sophisticated terror financiers, the ones who survive and persist, tend to prefer the old opaque methods for exactly the reason this whole register keeps documenting — the public ledger remembers. So the register begins Case 13 by refusing the frightening simplification, not to minimize the danger, which is real, but to see the actual shape of it: a channel that terror groups tried, that exposed the ones who tried it, and that the careful ones therefore mostly avoid.

2. The Public Appeal and Its Fatal Flaw

Now the specific method, because the al-Qassam Brigades' public-donation campaigns are the clearest illustration of the paradox at the heart of the case. The Brigades — Hamas's designated military wing, and the perpetrators of the October 7, 2023 attack on Israel that killed hundreds and took hostages — posted cryptocurrency donation addresses publicly and asked supporters worldwide to contribute. It was, on its face, a clever exploitation of crypto's permissionless nature: no bank could refuse the donations, no account could be closed, money could flow in from any country.

The fatal flaw was structural and unavoidable. To solicit donations publicly, you must publish the address publicly. And the moment the address is public, so is every transaction to it — permanently, on an open ledger that anyone in the world can read, including the investigators now watching. Every donation's amount, its timing, the address it came from — all of it written into the record the instant the money moved. The early campaigns compounded the exposure by reusing a single address, which made the analysis trivial: one address, all the donations in one place, a complete public account of the fundraising. The register has spent twelve cases describing the ledger's permanence as the criminal's eventual undoing; here it undoes the fundraiser at the moment of the very first donation, because the address that collects the money is the address that documents it.

And the exposure did not stop at the donations. Following the funds a step further — to and from the identity-bearing exchanges where crypto meets real names — frequently led investigators to the donors themselves. A public terror-donation address is, in effect, a self-assembling list of a support network: each contribution a signed entry, each signer potentially resolvable to a real person. The 2020 US action described as the largest-ever seizure of cryptocurrency in the terrorism context grew directly out of tracing exactly these public appeals. What the al-Qassam Brigades built as a fundraising channel, the state read as an intelligence product. The appeal asked the world for money and, in the same gesture, handed the world a map of everyone who gave it.

3. The Seizures: FROZEN by the Ledger

The counter-forensic record is a sequence of seizures, and it is what earns the disposition. Because the funds were visible and traceable, authorities in the US and Israel did not merely watch them — they took them, freezing terror-linked crypto before it could be spent on an operation.

The US Department of Justice and Treasury/OFAC pursued the American thread, tracing solicited crypto to the wallets that held it and seizing it, with the 2020 action standing as the landmark: the largest seizure of cryptocurrency ever, at the time, in the terrorism context. Israel's National Bureau for Counter Terror Financing, the NBCTF, pursued a parallel and prolific campaign using its own administrative seizure authority, issuing orders against crypto wallets linked to Hamas, to Palestinian Islamic Jihad — including the roughly $94 million in PIJ-linked wallets the Treasury assessment cites — and to Hezbollah and Iran's Quds Force. Two different legal systems, two different mechanisms, one shared enabling fact: the money was on a public ledger, so it could be found, and once found and attributed to a designated entity, it could be blocked.

This is the FROZEN disposition, and it is a specific and important one. The terror funds were not laundered clean, not spent on an attack, not vanished into a mixer beyond reach. They were exposed in transit and seized — stopped, blocked, taken out of the hands that raised them before they could serve their purpose. Case 04's FROZEN was a stablecoin issuer flipping a kill switch; this FROZEN is the state reaching a wallet it could see and freezing what a terror group had raised. The mechanisms differ, but the meaning is the same: value stopped before it could do its intended harm. And the reason it could be stopped is the reason the whole case exists — the fundraisers chose a medium that recorded their every receipt, and the state was reading the recording.

4. The Adaptation, and Why It Wasn't Enough

Criminals learn, and terror financiers are no exception, so the register follows the adaptation honestly — including where it partially worked. After the early exposure of reused addresses, campaigns changed technique: instead of one public address collecting everything, they began generating a unique donation address for each donor, or rotating addresses frequently. This is a real improvement in operational security, because it defeats the simplest form of blockchain analysis — the clustering that lumps every donation to a single address into one obvious pile.

But the adaptation ran into the same wall that stops every technique in this register, and it is worth being precise about why. Fresh addresses hide the donations from the laziest analysis; they do not remove the donations from the ledger. Every contribution, to however many unique addresses, is still written permanently and publicly. And more decisively, the money cannot stay scattered across a thousand fresh addresses forever — to be useful, it has to be consolidated and, eventually, cashed out into something spendable. At the point of consolidation the fresh addresses converge; at the point of cash-out the funds hit an identity-bearing exchange. Both are exactly the moments where the trail re-forms, and both are where the seizures kept landing. The adaptation bought time and complexity. It did not buy escape, because the medium remembers regardless of how many addresses touch the money, and the money's own need to become useful drags it back into the light.

The register draws a general lesson from this that runs through the whole series: operational-security improvements in crypto crime tend to slow tracing rather than defeat it, because they work against the analyst but not against the ledger. You can make the investigator's job harder — more addresses to follow, more hops to reconstruct — but you cannot make the transactions unhappen, and you cannot spend the money without eventually re-converging it somewhere reachable. Fresh per-donor addresses were a rational response to exposure, and they were not enough, and the seizures continued through the adaptation. That is the pattern: the ledger's permanence is not defeated by address hygiene, only inconvenienced.

5. The Paradox as a Counter-Terror Asset

Step back, because Case 13 inverts the register's usual mood, and the inversion is the point. In most cases the ledger's permanence is a slow, after-the-fact accountability — the money gets away and the record merely documents the getting-away. In terror financing by public appeal, the permanence becomes something rarer and more valuable: a real-time, durable, court-usable intelligence asset that the traditional methods never leave behind.

Consider what cash and hawala do not produce. When a terror group raises money through couriers, informal transfer networks, and abused charities, it leaves fragmentary, deniable, non-public traces — a whispered debt in a hawala ledger no outsider can read, a cash handoff no camera caught. Reconstructing that network is painstaking, often impossible, and rarely yields a clean list. When a terror group raises money through a public crypto appeal, it produces the opposite: a permanent, public, timestamped record of every donation, sitting on a ledger that will still be there in a decade, resolvable — at least in part — to the exchanges and identities behind the donations. The fundraising channel is simultaneously a self-generating map of the support network. That is a counter-terrorism asset of a kind the pre-crypto world could only dream of, and terror financiers built it themselves, for the convenience of raising money without a bank.

This is why the register frames the whole case against the fear narrative. The frightening story says crypto gave terrorists an untraceable new weapon. The record says crypto gave terrorists a tool that exposes them, seizes their funds, and maps their donors — which is exactly why the sophisticated ones retreat to cash and hawala, and why the public-appeal experiment produced a string of seizures rather than a funding revolution. The danger is real: crypto terror financing exists, it is growing, privacy coins and more careful techniques complicate the picture, and no register should be complacent about a channel that funds violence. But the honest forensic finding is that, so far, the ledger has been more the terror financier's liability than their asset. When they asked the public wall for money, they signed the wall, and the state was reading it.

6. The counter-narrative, steelmanned

The strongest objections come from opposite directions, and both deserve a fair hearing.

The first says the register is dangerously complacent. Downplaying crypto terror financing as 'smaller and traceable,' the argument goes, invites exactly the under-reaction that lets the threat grow: terror groups are moving to privacy coins like Monero, to unhosted wallets, to more careful operational security, and to jurisdictions beyond seizure, so treating the public-appeal failures as the whole story ignores where the threat is heading; any money that reaches a designated terror group is a catastrophe regardless of scale, because it funds violence, and a register that emphasizes traceability risks telling policymakers to relax. The second objection runs the other way: that even discussing terror financing forensically risks propagandizing designated groups, or that the seizures are overstated wins in a domain where most terror money was never crypto in the first place, so the whole case is a sideshow.

The register grants what is true and holds its ground. Yes, any funding of a terror group is grave, and the register never says otherwise — the disposition is FROZEN precisely because the seizures matter; stopping the money before an attack is the point, not a reason for complacency. Yes, the threat is adapting toward privacy coins and better operational security, and the register says so explicitly, flagging Monero and careful technique as real complications and warning against complacency in Section 5 — the claim is not that terror crypto is harmless but that, on the documented record so far, the public ledger has exposed more than it hid. And yes, most terror money was never crypto — that is the register's own point against the fear narrative, not a rebuttal to it; naming crypto as a minor, traceable channel is the accurate finding, and accuracy is what directs resources to the cash and hawala channels that carry the bulk. What the register will not concede is either extreme: not the alarmism that says crypto is terror's untraceable weapon, which the seizures refute, nor the dismissiveness that says it does not matter, which the funding of violence forbids. The truth is the forensic middle — a real, growing, but so-far-exposed channel, countered by turning its own permanence against it — and holding that middle honestly is worth more to the people terrorism targets than either comforting or terrifying them.

7. Disposition — FROZEN

Case 13 followed the money into terror financing and found the register's founding paradox operating as a weapon for the defense. Designated groups — most visibly the al-Qassam Brigades — tried to raise funds through public crypto appeals, posting donation addresses to a permissionless network that no bank could block. And the permanence that made the ledger permissionless made it merciless: every donation recorded forever, in public, resolvable toward the donors, readable by the state that had designated the recipients as terrorists.

The disposition — the money's fate — is FROZEN. Traced on the open ledger, terror-solicited crypto was seized and blocked — the largest-ever terror crypto seizure in 2020, roughly $94 million in Palestinian-Islamic-Jihad-linked wallets, Hezbollah and Quds seizures, US and Israeli authorities working parallel mechanisms toward the same end: value stopped before it could serve an attack. The funds were not laundered clean or spent on violence or vanished beyond reach. They were exposed in transit by the very medium meant to move them, and frozen. And when the campaigns adapted to fresh per-donor addresses, the seizures continued, because address hygiene inconveniences the analyst without erasing the transaction, and the money's own need to consolidate and cash out kept dragging it back into the light.

Hold the case's stubborn correction of a comfortable fear. The story says terrorists found in crypto an untraceable revolution; the record says they found a tool that seized their funds and mapped their donors, which is why the careful ones retreated to cash and hawala and why the public-appeal experiment produced seizures rather than a funding surge. The danger is real and adapting — privacy coins and better tradecraft are genuine complications, and no seizure count should breed complacency about money that funds violence. But the honest forensic finding stands: so far, the public ledger has been more the terror financier's liability than their asset. The honeypot beneath these words watches attackers try to hide; this case watched terror fundraisers ask the whole world for money and, in the asking, hand the world their books. The vectors do not lie: the appeal was public, the ledger was permanent, and the state was reading it. Center the victims of terrorism, whom this financing exists to harm. Then hold the finding that runs against the fear — that when a terror group tried to raise untraceable money on a public ledger, the ledger exposed the donors, and the money was frozen before it could kill.

Follow the Money continues. Case 13 disposition: FROZEN. Confidence: HIGH on the documented record — the tracing and seizure of terror-linked crypto (US DOJ/OFAC and Israel's NBCTF), including the ~$94M Palestinian-Islamic-Jihad-linked seizure and Hezbollah/Iran-Quds seizures, and the framing of terror financing as still dominated by cash, hawala, charities, and state sponsorship with crypto a growing but comparatively small channel, are stated in the US Treasury 2024 National Terrorist Financing Risk Assessment (with cited Elliptic/Chainalysis analysis). The al-Qassam Brigades' October 7, 2023 attack is per CrowdStrike's 2024 report. Designated terror organizations are named on the adjudicated designation record; the victims of terrorism are centered; the strict line between adjudicated fact and allegation is held, and no operational detail that would aid evasion is provided. The 'largest-ever terror crypto seizure' (2020) is characterized per the public DOJ record. Classification: TLP:WHITE. Include everything — the vectors do not lie, and they do not judge. The reader judges the financiers, the seizure, and the ledger that exposed the donors.