Following the October 7 attack on Israel, OFAC designated wallets that linked to multiple individuals and entities, one of the most communicated events was the designation of Buy Cash and the owners.
This highly communicated designation resulted in multiple articles by the leading Blockchain Analytics firms at that time, and one specifically had the title of:
“Inaccurate Methodologies for Estimating Cryptocurrency’s Role in Terrorism Financing”.
The article challenges this view and explains that the actual scale of terrorist use of digital assets is far smaller than many public claims suggest. Traditional financial channels, including conventional banking systems and informal cash-based networks, remain the primary methods used by terrorist organizations, largely because they provide more practical anonymity than transparent blockchain activity.
A central issue highlighted in the article is the use of flawed methodologies that significantly inflate estimates. Many reports have treated the entire transaction volume flowing through a cryptocurrency service provider as if it were associated with a terrorist-linked wallet. This approach is inaccurate because such services pool and process funds from many legitimate users. Once funds enter these platforms, on-chain activity alone cannot determine which portion is illicit. As a result, a wallet associated with a relatively small amount of suspicious activity can be mistakenly linked to tens of millions of dollars processed by the service provider it interacted with.
But reality tells an incredibly different story. Terror financing amounts in crypto have exceeded $1 billion.
So normalised has this reliance on digital assets become, that the IRGC has in fact expanded to the open sale of weapons via online platforms, where cryptocurrency is advertised as a viable payment method, as seen in the screenshots below.
Over the last 2 years, the extensive designation by OFAC and the NBCTF revealed a network of terror linked to the IRGC, Hezbollah, Hamas and the Houthis in Yemen.
This article will focus on the terror financing in Gaza, Hezbollah, the Houthis, and their benefactor, the IRGC.
Gaza: Terror Financing via Financial Aid
Hamas’ reliance on cryptocurrency has grown out of necessity rather than convenience. Isolated from the formal financial system, subject to extensive US and international sanctions, and facing tightened scrutiny across traditional banking channels, the organization has increasingly turned to digital assets as a primary mechanism for moving money into and out of Gaza. Cryptocurrency facilitates the rapid transfers and reduced exposure to regulated intermediaries, and allows Hamas to operate financial pipelines that persist even when bank accounts are frozen. Therefore it has become a structural component of Hamas’ financial resilience.
Hamas has demonstrated a sophisticated use of humanitarian branding to solicit crypto under the guise of aid. As the war against Hamas, that began with their attack on Israel on October 7th 2023, continues, charitable campaigns have appeared online. Campaigns such as ‘Water for Gaza Emergency Relief’ effort positioned themselves as charitable initiatives collecting donations in USDT on the Tron network, promoting urgent humanitarian messaging to attract foreign, sympathetic supporters. Blockchain analysis however, can trace deposited funds into wallets linked to Hamas financial operations, demonstrating that the project functioned not solely as relief, but as covert fundraising apparatus.
Meanwhile, Hamas also uses institutional services, such as Buy Cash, a currency exchange, to facilitate crypto flows for Hamas. Buy Cash in particular is explored below.
Fundamentally, the combination of sanctioned exchanges like Buy Cash, and humanitarian themed crypto fundraising, enables Hamas to maintain cash flow despite its economic isolation.
Buy Cash Operations and Its Direct Connection to Terror Financing
Buy Cash presents itself as a simple cash for crypto service. In practice, it operates as a financial pipeline deeply intertwined with Hamas and other designated terrorist organizations. The structure, behavior, and personnel surrounding Buy Cash reveal a system intentionally designed for secrecy, anonymity, and the rapid laundering of digital assets. The evidence paints a clear and unmistakable picture: Buy Cash = Hamas = Terror Financing.
In June 2021, Israel’s NBCTF seized a number of virtual currency wallets in connection to a Hamas fundraising campaign, some of which were linked to the Izz al-Din Qassam Brigades. One of the seized wallet addresses belongs to Buy Cash Money and Money Transfer Company (Buy Cash), a Gaza-based business that provides money transfer and virtual currency exchange services, including Bitcoin.
In addition to involvement in Hamas fundraising, Buy Cash has also been used to transfer funds by affiliates in other terrorist groups. In September 2019, Buy Cash’s Bitcoin wallet 19D1iGzDr7FyAdiy3ZZdxMd6ttHj1kj6WW received a Bitcoin transfer equivalent to over $2,000. The transfer was facilitated by a Türkiye-based money services business operator and al-Qa’ida affiliate. Additionally, in 2017 a Buy Cash account was registered by individuals involved in payment for procurement of large quantities of online infrastructure on behalf of the Islamic State of Iraq and Syria (ISIS). Ahmed M. M. Alaqad (Alaqad), who is based in Gaza, registered Buy Cash’s domain in July 2015. Alaqad has acted as Buy Cash’s representative and is the owner of Buy Cash financial exchange.
The Buy Cash Infrastructure
Buy Cash functions through a network of representatives who control wallet clusters, customer channels, and cash conversion points. These representatives use multiple email identities tied directly to Buy Cash’s internal operations. The following emails appear repeatedly across operational accounts and crypto wallets:
- buycash0@gmail.com
- buycash222@gmail.com
- buycash.com@gmail.com
These emails are associated with high volume wallet activity, Binance accounts, and TRX based USDT flows that collectively move tens of millions of dollars. The exchange model relies heavily on Telegram based coordination, short lived wallets, and opaque intermediaries that exist only long enough to receive and reroute significant transfers. This mirrors laundering models used by intelligence designated terror financing networks.
Primary Individuals Behind Buy Cash
Ahmed M. M. Alaqad
Alaqad is one of the central figures behind Buy Cash’s organizational and technical backbone. He is linked to the ownership, domain registration, and operational facilitation of the service. His involvement is not administrative. He is directly tied to enabling crypto fundraising networks for Hamas and overseeing wallet activity that routed funds to the group’s military wing. His actions link Buy Cash to the financial infrastructure of Hamas with clarity that leaves no plausible alternative explanation.
Ahmed Y. A. Abughali
Abughali emerges as the most active Buy Cash representative and the operational executor behind many of Buy Cash’s high risk transactions. He is tied to the emails buycash0@gmail.com and buycash222@gmail.com, as well as known Telegram presence under the handle @Ahmed879900.
Abughali controls multiple Binance accounts and Tether wallets that serve as on and off ramps for funds moving between Buy Cash and terror affiliated networks. One of his primary Binance accounts is Binance Account 1098, which interacts with US based financial institutions, creating direct exposure to the American banking system. He continues to advertise Buy Cash services even after international sanctions were imposed. He also issued a new working USDT address known as Address WGy after sanctions, showing active intent to evade enforcement and continue servicing Hamas aligned channels.
Another individual tied to Buy Cash infrastructure appears in the source through the email sahaomer1980@gmail.com, which is linked to wallets associated with Buy Cash operational flows.
Wallet Networks and Financial Trails
Buy Cash linked wallets display identical characteristics to laundering typologies used by Hamas and Palestinian Islamic Jihad. They conduct rapid consecutive transfers, short duration wallet usage, and mirrored inflows and outflows that are typical in terror finance layering schemes.
High value wallet clusters tied to Buy Cash representatives repeatedly exchange funds with:
- Hamas donation
- PIJ linked wallets
- Iranian exchanges used for sanctions evasion, including Nobitex, Wallet.ir, and Garantex
These interactions are not incidental. They form a repeating pattern of deliberate movement of USDT and other digital assets through known terror affiliated nodes.
Post Sanctions Activity
Following sanctions designating Buy Cash for its role in terror financing, Buy Cash representatives continued operations. They immediately began issuing new wallet addresses, maintained communication channels, and provided uninterrupted access to crypto conversion services. This is an indicator of deliberate sanctions evasion and confirms Buy Cash’s operational alignment with Hamas rather than legitimate users.
Assessment of the Connection
The cumulative evidence establishes that Buy Cash is not a passive vector exploited by terrorists. The platform and its representatives demonstrate active involvement through:
- Direct interaction with Hamas and PIJ controlled wallets
- Established email identities tied to high risk financial flows
- Sanctions evasion behavior
- Rapid multi stage laundering transfers
- The participation of named individuals with clear connections to Hamas aligned financial facilitation
The operational reality is unmistakable. Buy Cash is an integrated component of the financial architecture that supports Hamas. Its systems, personnel, and wallets form a deliberate network created to move money covertly in support of designated terrorist organizations. The line between Buy Cash and terror financing is not blurred. It is direct, explicit, and repeatedly demonstrated in transactional behavior and representative action.
Buy Cash linked wallets processed over $635m on the TRON network - and the top 10 wallets received ~$230 million
Above is a screenshot from the Nominis Vue transaction monitoring platform, demonstrating the risk score applied to a known Buy Cash wallet, wallet TR2i…znVF. This wallet was in use from 2021 until 2024, known to facilitate crypto flows for Hamas. Notably, almost $198 million has moved through this wallet.
The Gaza Population and Wealth
After assessing the role of Buy Cash, it is important to assess the Gaza population and financial conditions.
Estimates place Gaza’s population at roughly 2.1 million people, of whom around 1.2-1.3 million are adults. Gaza’s collapsing economy, extreme unemployment, and dependency on humanitarian aid mean that individuals holding large liquid assets are statistically rare. Even without exact figures, it is reasonable to assume that only a very small fraction-likely well under 1% of adults -possess more than $100,000 in cash or easily accessible wealth, given the territory’s poverty levels, restricted banking system, and heavy reliance on informal cash-based networks. Gaza’s financial environment is tightly regulated and monitored by Hamas, which exercised de-facto governance from 2007 and controlled licensing, taxation, imports, tunnel taxes, business operations, and the money-changing sector. Because of these structural conditions, any person or business handling large sums of money, and any financial institution operating inside Gaza, necessarily interacts with Hamas-controlled regulatory, taxation, or security frameworks. This does not mean every wealthy individual is politically aligned with Hamas, but it does mean that significant wealth or financial activity in Gaza cannot exist without some level of contact, compliance, or oversight from Hamas due to the group’s monopoly over administrative and economic mechanisms.
Hamas political and military structures had more stable and sometimes higher income streams.
Several credible sources indicate that:
- Hamas had independent revenue streams: taxes, tunnel revenue, business networks, and foreign funding (especially from Iran and Qatar). (Levitt Testimony, 2023 p.2)
- Members of the military wing (al-Qassam Brigades) received stipends, housing, and benefits not available to ordinary civilians. (Tenenbaum, 2023)
Therefore, the senior leadership and financial operatives were significantly wealthier.
Senior Hamas leaders abroad (Qatar, Turkey, Lebanon) managed investment portfolios worth hundreds of millions (documented in OFAC sanctions).
Some Gaza-based businessmen close to Hamas reportedly controlled valuable real estate and import monopolies.
These individuals lived far above Gaza’s economic average.
Connecting the evidence:
- Approximately 1% of the adults able to hold over $100,000 (120,000 people)
- Hamas seniors are wealthy
- Buy Cash acted as the “Financial arm of Hamas”
- $635m processes through Buy Cash
- The top 10 receivers from Buy Cash received ~$230m
Open-source sanctions designations, forfeiture filings and blockchain analysis consistently identify Hamas and its affiliated financial facilitators as the only non-state actors in Gaza that operate cryptocurrency and informal payment channels at multi-million-dollar scale.
While it is impossible to prove that no other individual in Gaza has ever controlled a wallet balance above 10 million USD, there are no publicly documented cases of such high-volume crypto activity linked to neutral or non-Hamas-affiliated Gazan actors.
By contrast, all identified Gaza-based operators with that scale of transactional activity are designated or described as Hamas-linked.
The breakdown of the Gazan crypto infrastructure
Over the last 12 months, NOMINIS worked closely with investigators and Law Enforcement Agencies to map and collect OTC desks, with a specific ambition to map the crypto infrastructure of Gaza.
The 400 wallets of OTC desks that were unveiled have processed $100s of million in funds over the years. The majority of these Gazan brokers have processed Hamas funds.
Hezbollah: Terror Financing via Drugs
Hezbollah’s financial ecosystem has evolved far beyond the traditional charity networks and cash-based donations it once relied upon. With mounting sanctions pressure, the organization has been pushed to diversify its revenue sources and expand its presence within the shadow economy. Cryptocurrency has emerged as one of the group’s preferred financial instruments, not as a replacement for cash but as a parallel option to move value across borders quickly and quietly, with reduced exposure to regulated financial institutions.
While crypto is one pillar, Hezbollah also invests in smuggling, trade-based laundering, involving the exploitation of diaspora networks. The necessity to increase funds has driven Hezbollah to seek new revenue channels by cooperating with transnational crime groups, notably those in South America, positioning themselves at the intersection between drug-trafficking and terror financing via cryptocurrency.
Recent investigations by the Nominis Intelligence Team have revealed a striking financial nexus between Iran’s Islamic Revolutionary Guard Corps (IRGC), its proxy Hezbollah, and Latin American drug cartels, namely the Sinaloa Cartel, Jalisco New Generation Cartel (CJNG) and even gangs like the MS-13. -Our investigations into this MENA - LatAm pipeline suggestt that these groups have been using cryptocurrency to move illicit proceeds across continents.
What initially may have appeared as isolated on-chain movements have revealed a deeper pattern: wallets connected to the Middle Eastern militant networks interacting with addresses linked to Sinaloa, CJNG and MS-13; this connection reflects a growing trend in which terrorist organisations and cartel groups reply on one another’s strengths, using cryptocurrency as a bridge that enables fast, discreet and cross-border financial collaboration.
The Latin American cartels boast financial structure is built on enormous volumes of illicit cash. Groups like the Sinaloa Cartel, CJNG and MS-13 generate billions through cocaine, methamphetamine, fentanyl and human trafficking operations, which then must be laundered and integrated into the global financial system. The US State Department explicitly describes these cartels as highly sophisticated money laundering organisations, capable of moving vast revenues through a combination of bulk cash smuggling, shell companies, and digital assets. The speed, borderless nature and decentralisation of crypto makes it ideal for converting physical drug proceeds into digital value.
This overlap of needs creates a natural incentive for collaboration. Terrorist groups need access to liquid capital outside and beyond the reach of sanctions, while cartels need partners who can move or store value outside the traditional finance system. Further external investigations demonstrate schemes moving drug profits through Syrian financial intermediaries before reaching the Middle East, which illustrate how integrated these networks have become.
IRGC-QF and the Houthis: Terror Financing via Oil
The second use case focuses on an Iranian sanctions-evasion architecture built around Sa’id Ahmad Muhammed Al-Jamal, supported in the cryptocurrency sphere by Alireza Derakhshan and Arash Estaki Alivand. Together, these individuals represent a functioning value-transfer mechanism that converts petroleum revenue into deployable liquidity, beyond standard financial oversight. Unlike the Buy Cash Gaza ecosystem, which is more retail-level, the Al-Jamal system is industrial-scale and rooted in the economics of state-oil output, maritime transport, and high-value digital asset acquisition.
The Key Players
Al-Jamal serves as the primary financial broker, and coordinates the movement of Iranian oil via maritime shipping networks, front companies, and layered commercial documentation. Revenue from those exports become liquidity that must be moved offshore. This capital is deliberately distanced from its origin, through complex invoicing and book-keeping, shell-registered companies, and vessel transfers across jurisdictions. This obfuscation strategy is designed to hide the ultimate beneficial ownership and origin.
Once proceeds are sufficiently distanced from the source, Derahkshan and Alivand enter such a pipeline. Individuals like them would then convert traditional capital into cryptocurrency, especially high-liquidity stablecoins such as USDT, Ethereum and TRON networks, according to the most recent US sanctions targeting from 2023-2025 . This conversion is described as a core function: it allows formerly sanctioned oil-sale funds to be transformed into digital currency capable of rapid cross-border movement at a low cost, and minimal visibility.
Once digitized and delinked from the oil-sale origin, the funds can be funneled into procurement networks, operational accounts, or proxy-use wallets, belonging to IRGC or IRGC-linked groups. This effectively enables funding flows to groups such as Hezbollah, PIJ and other regional militias without requiring direct remittance or exposure to regulated banking systems. Liquidity becomes fluid, transferable, and deniable, significantly increasing operational resilience and funding flexibility.
Derakhshan and Alivand were publicly designated by the US Department of Treasury (OFAC) in September 2025, for facilitating over $100 million in cryptocurrency purchases in the last 2 years, tied to oil sales, using a network of fronting companies in multiple jurisdictions. (US Dept of Treasury, 2025) The proceeds from these operations benefit Iran’s defense apparatus, via the IRGC-Quds Force and the Iranian Ministry of Defence. These are classified as part of a ‘military-support’ financing network.
Sanctioned individuals have facilitated the movement of over $100 million in cryptocurrency in the last 2 years, funding the IRGC.
Separately, Sa-id al-Jamal has been under sanctions for longer, designated for his role in maritime trade and illicit oil shipments intended to fund the Houthis and the IRGC. Treasury releases have shown that al-Jamal’s network includes shipping companies, vessels, and foreign facilitators involved in the export of Iranian petroleum and other products, using forged documents and shopping papers as well of course as front companies. (US Dept of Treasury, 2024).
Below demonstrates the risk assessment and analysis of a wallet associated with the Houthis, who directly benefit from Al-Jamal’s pipeline.
The funding of the IRGC Regime essentially relies on pipelines such as this use case. This network reflects a shift from a regular, state-budget financing, to a shadow economy infrastructure, dominated by illicit actors. Funds routed through the likes of sanctioned individuals such as Al-Jamal, Derakhshan and Alivand are controlled by terrorist power centres, rather than transparent state institutions. This places economic leverage firmly in the hands of the IRGC, rather than any type of transparent civil administration.
The roles of Al-Jamal, Derakhshan and Alivand along the pipeline funding the IRGC illustrates how the Iranian regime has evolved its financing architecture into a hybrid of maritime trade, offshore corporate structures, and cryptocurrency: a structural pillar of the shadow economy that sustains the IRGC’s widespread proxy conflict abroad, and avoids regulatory scrutiny and accountability.
Oil leaves Iranian ports under companies and employees with false documents, revenue exits the banking system and re-enters on the blockchain rails, funding wars in Gaza/ Israel, Yemen, Lebanon and elsewhere, free from the restrictions of traditional finance or virtual asset regulation, ready for immediate use to fund terror.
Conclusion
To date, there has been no comprehensive report that fully explores the different mechanisms of terror financing in cryptocurrency, nor the sheer scale of funds that have moved through the wallets and hands of terror groups worldwide, particularly those acting as proxies for the IRGC. While the concept of crypto-enabled terror financing is not new, its prevalence has increased significantly in recent years. Despite this, the recognition of the issue’s scale and operational significance by blockchain analytics firms has remained limited.
Some prior reports from other analytics firms have suggested that the volume of terror financing in crypto is overstated. Our findings, however, demonstrate that this is not the case. Individual wallets associated with terror groups, dating back to 2021, 2022, and 2023, have acumulatively moved billions of dollars. These figures represent only a subset of wallets held by these organisations, indicating that the actual flows are far more extensive than previously understood.
It is important to contextualize these numbers: although we are discussing billions of dollars in illicit flows, this still represents a small fraction of the total cryptocurrency ecosystem. Nevertheless, the impact is material and strategic. The problem is increasingly affecting banks, major exchanges, and other financial actors. Proper mitigation of terror financing will not be achieved until blockchain analytics firms fully acknowledge the scale and intensity of the issue and incorporate these realities into their monitoring frameworks. Recognizing the true magnitude of crypto-enabled terror financing is an essential step toward protecting the integrity of the global financial system and cutting off funding channels for high-risk actors.
All research content and accompanying reports are provided for informational purposes only and should not be relied upon as professional advice. Accessing these materials does not create any professional relationship or duty of care. Readers are encouraged to consult appropriately qualified professionals for guidance. We uphold the highest standards of accuracy in all the information we provide. For any questions or feedback, please contact us at contact@nominis.io.
.jpg)
.jpg)