FBI takes control of the server handing out Hamas's rotating donation addresses

Start with the ratio the filings allow. The addresses in this pipeline moved more than $1.5m from October 2024 ^[4], and the announced seizure comes to more than $560,000 ^[1][5], so roughly 37 cents of every traced dollar ended up in government custody ^[16], a number that means one thing if the $1.5m was current as of the March 2025 coverage that first carried it (about $300,000 a month) and another if it runs through the last 2025 warrant (about $125,000 a month) ^[18][8]. Spread across the accounts the court documents name, 18 held at Tether and three at Binance ^[3], the haul averages about $26,700 per account ^[19]. That average is too small to fund an informant network on its own.

The instrument that did the work is a hosting instruction, an order to a provider to block a box and hand its name service to law enforcement ^[2], and it operates entirely on the hosting layer, no private key required. Once the site that publishes the day's address is being operated by the people investigating it, rotation stops being evasion and becomes intake, because donations can be caught on arrival instead of reconstructed afterwards ^[10][7]. The earlier seizure in the same system shows why arriving first matters: only $89,900 of that $201,400 sat in crypto accounts and $111,500 was already elsewhere ^[14], which is 45% on chain ^[17].

For exchanges, and for the analytics vendors selling them screening, the practical change is from a list to a provenance question. An address handed out inside an encrypted group chat is newer than any roster of designated addresses by construction ^[7], so the detectable object is the channel that mints it. Where the asset is a stablecoin the leverage sits with the issuer rather than the chain, and an issuer clawback is an accounting entry rather than a confiscation of keys ^[11]; with Chainalysis putting stablecoins at 84% of illicit crypto transactions in 2025 ^[12] and FATF warning about the same use ^[13], that entry has a wide field to work in.

This is probably wrong, but the replicable half of the case is the paperwork against the host rather than the tradecraft: the affidavit needed a magistrate's approval ^[2], while the human sources the Albuquerque field office ran inside the operation take time and cultivation to build, not a switch to flip on demand ^[6]. It can run a few ways from here. One path: hosts and registrars turn into the standard place to serve process, and orders like this stop being remarkable. Another: donors shift to rails with no issuer to instruct, so seizure totals shrink along with the visibility. Or the money was never the point, and the real yield is the identifying data the Justice Department says the takeover produced on people who wrote in about donating ^[9], in which case the metric to track is charged donors, and no count of those has been published. My reading breaks the day a case in this line arrives with tracing and a hosting order and no informant at all, at which point Brett Leatherman's promise to keep intercepting illicit funds ^[15] describes a cheap repeatable process rather than an expensive bespoke one.