TLDR: Nominis intelligence enabled ChangeNOW to freeze funds tied to a fake humanitarian NGO acting as an IRGC proxy
Overview
Nominis' investigations team identified a network of Solana wallets tied to a group posing publicly as a humanitarian non-profit while, in fact, operating as a fundraising channel for Hezbollah, acting as an IRGC proxy. Rather than stopping at publication, Nominis notified its exchange partners directly so that findings could be translated into action.
ChangeNOW's compliance team reviewed the intelligence and froze the funds tied to the flagged wallets, cutting off access before the money could move further.
The Front
The group presented itself online as a humanitarian organisation, using social media to solicit donations from a broad, often unsuspecting audience.
Behind that front, Nominis assesses the operation was affiliated with Hezbollah and functioning as part of an IRGC-linked fundraising apparatus. Humanitarian branding of this kind is a recurring tactic among terror-financing networks: it lowers the guard of donors and platforms alike, and it allows funds to be raised in the open rather than through channels that would immediately draw scrutiny.
The Investigation
Nominis's investigations team traced the group's on-chain activity to a cluster of wallets on Solana, a chain that terror-financing networks have increasingly turned to. Nominis assesses that the wallets were used to collect and move donations raised through the group's social media presence, consolidating funds in a pattern consistent with organised fundraising rather than isolated, incidental transfers. The findings were compiled and shared directly with exchange partners rather than held for publication alone, reflecting the view that intelligence which sits in a report achieves little on its own.
The Response
ChangeNOW's compliance team reviewed the findings Nominis shared and moved quickly. Funds tied to the flagged wallets were frozen, cutting off the group's access before they could be moved further into the financial system. The turnaround, from notification to action, is the part of this case that Nominis wants to hold up as a model: intelligence surfaced quickly, shared directly with the exchanges positioned to act on it, and acted on without delay.
Why It Matters
Terror-financing networks depend on speed and on the assumption that intelligence, when accurate, will not reach the people who can act on it in time. This case shows what happens when that assumption fails: a fundraising channel built behind a humanitarian front was identified, reported, and shut down before it could do further damage.
Compliance teams that move at ChangeNOW's speed make a genuine dent in how these networks operate, and Nominis regards this kind of fast, direct collaboration between intelligence providers and exchanges as exactly how the ecosystem is meant to work.
