At NOMINIS, we stand by our argument that effective blockchain attribution is built from layers: on-chain information, clustering heuristics, off-chain intelligence, behavioural analysis, geointelligence and more. Each layer adds contextual insights that others can’t provide alone.
Within the process, gas funding transactions trails have been a consistently useful signal. When a new wallet appeared on-chain, it needed to be seeded with a native token before it could make a transaction elsewhere. That top-up created a traceable connection between the new wallet and whoever funded it, giving investigators a starting point even when other signals were thin.
However, terror actors have recognised this starting point, instead, they are increasingly weaponising gasless architecture.
Gasless wallet infrastructure allows a wallet to receive and send tokens without ever holding the network’s native coin. Nowhere is the growth of this adoption more visible that the TRON blockchain, which has become a highly used corridor for USDT-denominated terror financing flows. Understanding how this infrastructure works and why it can defeat conventional on-chain analysis is now an important baseline for financial crime investigators and compliance teams.
TRON, USDT and the Shift Away from Bitcoin
The migration of terror financing networks towards TRON is very well documented. Between July 2021 and October 2023, the NBCTF, an authority responsible for combating the financial infrastructures of terror groups, froze over 143 TRON wallets linked to terrorist groups. 87 of these wallets were seized in 2023 alone, linked to Hamas, Palestinian Islamic Jihad, and Hezbollah linked actors. The accelerated appeal for these groups to utilise TRON is understandable: TRON hosts the largest circulating supply of USDT, processes transactions quickly, and has historically offered low fees. USDT on TRON combines the stability of a dollar-pegged asset with the pseudonymity and borderless settlements of a blockchain. So, from an operational perspective, it is ideal for moving assets across jurisdictions while facing very little friction.
More recently, enforcement actions have continued to expose the scale of these flows. In early 2025, Israel's NBCTF ordered the seizure of wallets and accounts connected to El-Kahira for General Trading (also known as the Dubai Company for Exchange), a Gaza-based entity accused of providing substantial assistance to Hamas. The 58 TRON wallet addresses listed in the seizure order had collectively received over $160 million in USDT since February 2021. Separately, in March 2025, the US Department of Justice disrupted a Hamas financing scheme in which at least 17 addresses, shared through an encrypted group chat with Hamas supporters globally, had laundered more than $1.5 million in virtual currency since October 2024.
These cases confirm a consistent operational pattern: TRON-based USDT, moving through a web of wallets, exchanges, and intermediaries, is the dominant mechanism for crypto-denominated terror financing today.
Gasless Transactions
To understand why gasless wallets matter for investigators, it helps to understand TRON's resource model.
Normally, sending USDT on TRON requires a wallet to hold some TRX, TRON's native coin. The network runs on two computational resources: Bandwidth (which covers basic transaction data) and Energy (which is required to execute the smart contract logic behind every TRC-20 token transfer). When a wallet lacks sufficient Energy, the network burns TRX from the wallet's balance to cover the cost. Without TRX, the transaction simply fails.
Historically, this created a forensically useful artefact. Every new wallet that wanted to send USDT needed to be seeded with TRX first. That seeding transaction was traceable on-chain: it came from somewhere, which meant the new wallet was immediately connected to another wallet, another cluster, another actor. Investigators could use that connection as a starting point for attribution, asking who sent the gas, whether that sender appeared in other known networks, and what that implied about ownership and control.
Gasless infrastructure removes this requirement entirely. Under TRON's GasFree mechanism, now supported by a growing number of wallets and service providers, the network fee is deducted directly from the USDT being sent. The user holds only USDT. They never need to acquire TRX. They can open a wallet, receive funds, and begin transacting without any prior interaction with the broader ecosystem. No seeding transaction means no gas trail.
Why this should concern investigators and compliance officers
The gas trail was never the most important investigative tool, on its own but incredibly useful for clustering connected wallets within a network. Every new wallet that wanted to transact had to create that seeding event, whether the operator wanted to or not. It was a signal that required no cooperation from the subject. Now it can be bypassed entirely.
The shift to gasless wallets means wallet activation is no longer linking a new event. Previously, the moment a new wallet became active on TRON, it generated a connection to whatever funded it. With gasless infrastructure, a wallet can be activated and transact without ever creating that connection. First-time wallets become orphaned nodes: visible on-chain but contextually isolated.
Infrastructure separation becomes easier. Sophisticated terror financing networks have long sought to compartmentalise wallet infrastructure, keeping fundraising addresses, consolidation addresses, and cash-out addresses in separate clusters that resist linkage. Gasless wallets make this compartmentalisation cheaper and easier to maintain. There is no overhead cost, in the form of TRX top-ups, that might inadvertently create cross-cluster connections.
The barrier to entry has dropped. One consistent feature of Hamas-linked financial activity is the use of individuals with limited technical sophistication, locally-based money changers, hawala operators, and community-level fundraisers who handle small volumes. Gasless wallets reduce the operational knowledge required to participate in this infrastructure. Receiving and forwarding USDT without any understanding of blockchain fee mechanics is now entirely achievable.
At NOMINIS, while tracking Gaza-based financial activity over the past year, we have observed increasing use of wallets that display no gas-funding history. These wallets appear to have been opened, funded in USDT directly, and used to transact without any native token interaction.
The following wallet is an example of a gasless wallet used by a Gazan OTC.
Critically, its gasless nature means it is almost impossible to cluster such wallets, given they lack a starting point. Every time a terror actor creates a new gasless wallet, the network must be rebuilt from the beginning, unless a blockchain intelligence platform with a multisource approach to circumvent the new obstacle of gasless wallets.
This wallet has exposure to 5 major exchanges, who all accepted funds from this wallet. Since it is gasless, the wallet was able to pass all 5 exchanges’ blockchain compliance platform, despite it’s critical risk score.
The wallet’s ‘CreatedByContract’ is a clue to its gasless nature. To open a gasless wallet, typically, a smart contract is used to create it.
Multi Source Intelligence
On-chain intelligence of course has real value: its transparent, auditable nature has contributed to major enforcement actions. Without it, the NBCTF seizures mentioned earlier would not have been effectively fulfilled. But, it has a hard limit. On chain analysis can only see what is on the chain.
When the signals that link wallets to each other and to real-world actors are removed, as gasless infrastructure allows, on-chain tools produce addresses without context. A wallet that received $500,000 in USDT and forwarded it onward is visible. Who controls it, whether it appears in a Telegram fundraising channel, whether the operator appears in a sanctions designation or corporate registry, none of that is on-chain.
Closing that gap requires combining transaction data with the off-chain signals that gasless infrastructure cannot eliminate:
Open-source and social intelligence (OSINT/SOCMINT). Fundraising campaigns, wallet addresses, and operational communications regularly surface in Telegram channels, social media platforms, and encrypted messaging groups. These off-chain disclosures connect wallet addresses to identities and organisations before any transaction-level signal is available.
Sanctions and designation data. NBCTF designation orders, OFAC listings, and UN sanctions lists name individuals, entities, and in some cases specific wallet addresses. Cross-referencing live transaction flows against these datasets, and connecting them to corporate structures and identified individuals, is work that on-chain tools alone cannot do.
Geointelligence. Behavioral activity combined with proprietary methodology associated with wallet creation and transaction activity analysis can place wallets in operational contexts that on-chain data cannot provide.
The value of this multi-source approach is not simply additive. It is multiplicative. A wallet with no gas history, no on-chain clustering links, and no prior transaction record may be forensically opaque viewed through an on-chain lens.
The same wallet, cross-referenced against a Telegram channel soliciting donations for a Hamas-linked cause, a corporate registry entry naming a sanctioned individual as a director of the associated exchange, and geolocation data placing the wallet’s creation in Gaza, is no longer opaque at all.
This is the approach that produces actionable intelligence rather than transaction maps. And as gasless infrastructure continues to mature and propagate across TRON and other networks, it is the approach that will increasingly separate those who can follow the money from those who are following a trail that no longer exists.
NOMINIS Intelligence Beyond the Chain
At Nominis, our methodology is built on the premise that on-chain data is a starting point, not a conclusion. Our platform integrates blockchain transaction analysis with, sanctions and designation tracking, open-source intelligence, and individual-level identification, and further propriety methodology producing a complete picture of the entities behind wallet addresses rather than the addresses themselves.
For financial institutions, VASPs, and law enforcement agencies operating in an environment where gasless wallets are becoming standard infrastructure for bad actors, that completeness is the difference between a compliance alert and an investigation that leads somewhere.
All research content and accompanying reports are provided for informational purposes only and should not be relied upon as professional advice. Accessing these materials does not create any professional relationship or duty of care. Readers are encouraged to consult appropriately qualified professionals for guidance. We uphold the highest standards of accuracy in all the information we provide. For any questions or feedback, please contact us at contact@nominis.io.
.png)
.jpg)