The Sanctions Entry With No Addresses
When the US Treasury's Office of Foreign Assets Control published a fresh sanctions package against three individuals and two French-registered charities tied to Hamas financing, most crypto reporters led with the number. Two million dollars. Charities. Bitcoin. The familiar drumbeat.
I led with the omission. The SDN entry listed no wallet addresses. Not one.
I audit the exit, not the entrance. So when a regulator names a terrorist financing network and simultaneously withholds the single piece of data that compliance teams can actually action โ the on-chain identifier โ I stop reading the press release and start reading the gaps. The absence of addresses is not a footnote. It is the whole architecture of the case, and it tells you more about how enforcement actually works than the headline figure ever will.
This is not a story about a new criminal technique. There is no novel exploit here, no clever smart contract, no zero-knowledge trick. This is a story about a layered money-movement operation that leaned on a French bank account, two charity shells, a handful of money services businesses, and โ for a slice of the total โ a centralized exchange account that a blockchain analytics firm matched back to a wallet Israeli authorities had already seized.
The most underrated signal in this case is not that crypto hid the money. It is that crypto exposed it.
Context: The Structure Behind the Two Million
Let me lay out what is actually documented, because the press framing buries the mechanics.
Saleem al-Zaq is described as a battalion-level deputy commander in the Al-Qassam Brigades, the military wing of Hamas. He sits at the center of the network as the receiving node. Above him in the fundraising chain sit two France-based operatives, Faouzi Barika and Amel Oualid, who ran two registered charities โ Association Baraka and Ensemble C Mieux. Below the charities sat the donors, and the donation flow is the part that matters for jurisdiction.
According to the prosecutors' filings, the network raised roughly $1.75 million through December 2025. Of that, approximately $626,000 โ call it 36% โ came from US-based donors. That single ratio is why the Department of Justice could unseal an indictment against al-Zaq and why six people were arrested. Domestic donor participation is the jurisdictional hook. Without it, the case becomes a far messier extraterritorial argument.
The crypto slice of the total is where the reporting gets loose. Treasury's broader network estimate sits at $2 million-plus. The crypto portion is described as "hundreds of thousands of dollars." Run the arithmetic. If the crypto figure is, say, $300,000 against a $1.75 million documented base, that is under 20%. If it is $200,000, it is closer to 11%. The headline says "using crypto." The data says crypto was a minority transit layer.
That gap between the headline and the ledger is the entire reason this case is worth an article rather than a tweet.
The mechanics ran in three stages. First, collection: donations into French bank accounts, with charity branding providing the legitimate appearance. Second, conversion: funds moved into digital assets. Third, disbursement: out through money services businesses and at least one centralized exchange, landing with al-Zaq, then onward to the military wing.
That is a textbook layering structure. Traditional fiat at the front, crypto in the middle, fiat-adjacent rails at the back. Crypto was never the end-to-end solution. It was the middleman.
Core: Why the Chain Convicted Them, Not the Charity
Here is where the technical reading diverges hard from the narrative.
The public story is that a terrorist group used crypto because crypto is anonymous. The actual record shows the opposite. Chainalysis correlated the counterparty relationships around an exchange deposit address and tied al-Zaq's address cluster back to a Hamas-linked wallet set that Israeli authorities had already seized under a prior court order.
Read that again. The linkage was made through exchange deposit addresses โ the exact chokepoint where a centralized platform has already performed know-your-customer checks. The public chain is pseudonymous, not anonymous. Every address is a permanent, queryable record. When you have to touch a regulated venue to convert fiat to coin, you plant a flag that analytics firms can walk straight back to your door.
The network's own operational security tells the same story. In December 2021, according to the filings, al-Zaq instructed the operatives to switch to Bitcoin specifically because he believed it would be harder to trace. That is a naive model of traceability. Bitcoin's ledger is the most heavily indexed financial record on earth. Choosing it for opacity is like hiding in a glass house because you think the windows are one-way.
The second tell: in May 2023, after being questioned, the network moved funds to a different exchange. That is not a technical upgrade. That is a compliance-avoidance move. When you rotate venues after scrutiny, you are not defeating chain analysis โ you are acknowledging that the previous venue's review process was the binding constraint. You are running from KYC, not from cryptography.
And here is the structural point that the "crypto funds terror" framing always skips. The network could not function without centralized choke points. A French bank account to aggregate. A money services business to disburse. A centralized exchange to convert. Every one of those is a regulatable node with a legal entity behind it. This is not a protocol that you can fork or a smart contract you can pause. It is a pyramid of named humans sitting on top of licensed institutions.
Liquidity is just trust with a speed limit. And in this case, the trust that moved fastest was the trust the donors placed in two charity logos.
The donor-side analysis is the most uncomfortable part. The charities presented as civilian aid for Gaza. The funds, per the filings, routed through al-Zaq and then to the military wing. This is not a Ponzi flywheel โ it does not pay early participants with late money. It is something colder: a trust-abuse structure that converts good-faith donations into financing for violence. The donors and the knowing co-conspirators are not the same population, and the filings do not cleanly separate them.
From a network-resilience standpoint, the structure is fragile. It depends on a handful of individuals. Al-Zaq is a single load-bearing node between fundraising and command. Remove him and the receiving layer collapses. That is why the enforcement play was a decapitation strike โ sanctions plus arrest โ rather than an infrastructure takedown. You do not need to kill the protocol when there is no protocol. You just need to name the people and freeze the accounts.
The Contrarian Read: The Wrong Question Gets Asked Every Time
Here is where I part company with most of the coverage, and where I think the industry keeps losing the argument by accepting the frame.
Everyone asks: how much did crypto enable? The better question is: how much did crypto expose that cash and hawala never would have?
Compare the rails. Pre-2021, this network used Western Union-style transfers. Then it iterated to digital assets. Ask yourself which version was easier to reconstruct after the fact. A cash handoff leaves no queryable ledger. A hawala transfer settles on trust and memory. A Bitcoin transaction leaves a permanent, timestamped, counterparty-linked record that a firm can subpoena-adjacent its way through without ever touching the criminal's private keys.
The enforcement record here is not a case against crypto. It is a case for the transparency of public ledgers. The reason this network got mapped is precisely because the middle layer was auditable. If the whole flow had stayed in fiat and informal value transfer, the two-million figure would likely still be an estimate, not an indictment.
Volatility is the tax on unverified assumptions. And the assumption the public keeps paying tax on is that anonymity is a property of the technology rather than a property of the user's discipline. The user here was undisciplined. He reused exchange rails. He switched venues after being noticed. He left the exact footprint that analytics firms monetize.
Now the harder contrarian point, the one that will annoy both sides. Look at the regulatory response and ask what it actually targets. The case did not run through self-custody wallets. It did not run through mixers. It did not run through DeFi, or privacy coins, or non-custodial infrastructure of any kind. It ran through banks, charities, MSBs, and a centralized exchange. Yet the sanctions package is already being cited in broader arguments about wallet-level controls, charity on-chain fundraising compliance, and crypto ATM oversight.
That is the real risk. Efficiency without empathy is just extraction โ and so is enforcement without proportionality. If the policy response to a fiat-heavy, charity-facilitated, exchange-intermediated case lands on self-custody tools that were never involved, the industry gets regulated for a crime it did not commit with a tool that was not used. That is not compliance. That is collateral.
The compliance gap is concrete and worth naming. Because OFAC published no addresses, a centralized exchange cannot run an automated address-level screen against this designation. The compliance burden gets pushed downstream to third-party analytics providers who maintain their own attribution sets. That is a structural weakness: it means the effectiveness of a sanctions program depends on private labeling rather than a public list. It also means a well-resourced evasion operation can, in principle, exploit the lag between designation and attribution.
I have watched this pattern since I manually cross-referenced ICO whitepaper teams against LinkedIn records back in 2017. The lesson then and now is identical: the primary source beats the narrative, every time. The primary source here โ the sanctions entry โ is missing the field that would make it operationally useful. That is the finding. Everything else is commentary.
Takeaway: What To Watch, Not What To Feel
Strip the emotion out and treat this like a position, because that is the only useful way to read enforcement news in a sideways market.
Three signals matter going forward.
First, watch for a supplementary address publication. If OFAC amends the SDN entry with wallet addresses, it signals the earlier omission was an intelligence-protection choice, not an operational blind spot. If no addresses ever appear, treat the omission as a policy feature and price in a persistent compliance gap for exchange-level screening.
Second, watch for a parallel French proceeding. The fundraising and the two charity operators sit in France. A domestic French action would tell you whether cross-jurisdictional coordination is tightening or whether the US is carrying the case alone. One is a system maturing. The other is a system fragmenting.
Third, watch the unnamed exchange. A venue that moved funds after a May 2023 inquiry and then saw its counterparties mapped by analytics has a compliance problem it has not yet been asked to explain publicly. If a name surfaces alongside a regulatory inquiry, that is the node to reprice.
What I am not doing is predicting a price move. This event does not touch the market structure of BTC or ETH in any measurable way. The pricing impact is under 5% and mostly confined to reputation. The tradeable consequence, if there is one, sits in compliance technology demand and in the regulatory premium that clear rules eventually confer on compliant venues.
The ledger here does not prove that crypto finances terror. It proves that a ledger, unlike a handshake, remembers. The uncomfortable question for everyone reading this is not whether the technology can be abused โ of course it can, any rail can. The question is whether we will let a case built on charity fraud and bank aggregation be used to legislate against tools that never appeared in the flow.
Code is law until the governance vote kills it. Policy is narrative until the addresses get published. Watch for the addresses.