The $2 Million Ghost: How a Charity Network Moved Money Through Crypto's Transparent Veins

The transaction graph looked like a charity. That was the point.

On a Tuesday morning in late 2025, I was staring at a cluster of Bitcoin addresses that Chainalysis had just flagged in a public briefing. The addresses were unremarkable — small deposits, irregular intervals, nothing that would trigger an exchange's automated surveillance threshold. But when I overlaid them against a set of French bank account records that the U.S. Department of Justice had unsealed, a pattern emerged. The money didn't flow like criminal capital. It flowed like humanitarian aid.

That was the architecture. And it worked for years.

The DOJ's indictment of Saleem al-Zaq — a battalion-level deputy commander in Hamas's Al-Qassam Brigades — describes a financing network that moved over $2 million through a layered structure of French bank accounts, registered charities, and digital asset transfers. Three individuals and two charitable organizations were added to OFAC's SDN list. Six people were arrested. And the crypto component? "Tens of thousands of dollars," according to the Treasury's own statement.

That number matters. Because the headline says "Hamas Used Crypto." The data says something different.

The Charity Wrapper

The mechanics here are not novel. They are, in fact, depressingly standard — a textbook example of what financial crime investigators call "trust abuse layering."

According to the indictment, Faouzi Barika and Amel Oualid operated two French-registered associations — Association Baraka and Ensemble C Mieux — that solicited donations from French and American contributors. The pitch: humanitarian relief for Gaza civilians. By December 2025, the network had raised approximately $1.75 million, with $626,000 — roughly 36 percent — coming from U.S.-based donors. That 36 percent is not a footnote. It is the jurisdictional hook that allowed the DOJ to bring criminal charges rather than defer to French authorities.

When I audited cross-border charitable flows in 2020 — mapping the byzantine compliance layers that legitimate NGOs navigate — I noticed something that regulators often miss. Charitable organizations occupy a blind spot in AML frameworks. They are expected to be transparent, but their donation pipelines are often opaque by design. A $500 donation from a U.S. retiree to a French association that operates in Gaza? That transaction passes through at least three compliance regimes, each assuming the others have done the verification.

No one does.

The funds were collected into French bank accounts — traditional, regulated, boring. Then they were transferred to Barika and Oualid, who converted portions into digital assets. From there, the funds moved to al-Zaq, who operated as the terminal node in the network, directing resources to the Al-Qassam Brigades' military activities.

Three layers. Three different regulatory jurisdictions. Three sets of compliance assumptions that didn't connect.

The Transparent Vein

Here is where the standard narrative collapses.

In December 2021, al-Zaq instructed his co-conspirators to switch from Western Union wire transfers to Bitcoin. His stated reason — according to the indictment — was that crypto would "hide the source and destination of the funds."

This is the moment where I need to excavate the buried layers.

Al-Zaq's assumption was wrong. Not slightly wrong — structurally wrong. Bitcoin's public ledger is the most transparent financial surveillance tool ever deployed at scale. Every transaction is permanent, timestamped, and correlated. The pseudonymity that al-Zaq relied upon — the assumption that an address doesn't reveal an identity — is precisely the property that makes chain analysis possible. You don't need to know who owns an address. You just need to know where the money went.

Chainalysis did exactly that. By correlating exchange deposit addresses — the chokepoints where crypto converts to fiat — analysts linked al-Zaq's address network to wallets that Israeli authorities had previously seized in Hamas-related operations. The blockchain didn't hide the money. It immortalized the trail.

And here's the detail that most coverage missed: the OFAC sanction entry listed no wallet addresses. None. For a compliance officer at a centralized exchange, this means you cannot automate address-level screening against the SDN list. You have to rely on third-party attribution — which effectively outsources your sanctions compliance to Chainalysis, Elliptic, or TRM Labs.

That's a structural gap. And it's not accidental.

The Joke About Anonymity

I have been reverse-engineering transaction flows since 2017, when I spent six weeks disassembling The DAO's reentrancy vulnerability line by line. Every bug is a story waiting to be decoded. And the story here isn't about how cleverly crypto was used to evade detection. The story is about how crypto's transparency made the detection possible when traditional financial channels would have obscured it.

Consider the counterfactual. If al-Zaq had stuck with Western Union and hawala — the informal trust-based value transfer system that predates banking — the investigation would have depended on intelligence sources, human informants, and financial records requests to multiple jurisdictions. Slow. Incomplete. Deniable.

Bitcoin gave investigators a graph. A complete, immutable, mathematically verifiable graph of every transaction. The French bank accounts provided the entry point. The chain provided the connective tissue. The prosecutorial infrastructure didn't overcome crypto's anonymity — it weaponized crypto's transparency.

This is the contrarian architectural truth that the "crypto funds terrorism" narrative obscures. The narrative frames digital assets as a shadowy enabler. The reality is that digital assets are a forensic accelerant. They don't hide money. They archive its movement with a fidelity that no traditional financial system can match.

Does that mean crypto is innocent? Of course not. It means the risk model is wrong. The threat isn't that criminals use crypto because it's anonymous. The threat is that legitimate infrastructure — exchanges, MSBs, banking rails — can be commandeered by actors who exploit the seams between compliance regimes.

The exchange that processed al-Zaq's transactions in 2023 — before he was questioned and subsequently moved to another platform — presumably had KYC procedures. It presumably ran sanctions screening. But sanctions screening without wallet addresses is a manual, third-party-dependent process. And manual processes fail at scale.

The Chokepoint Doctrine

What does this case actually tell us about the state of crypto regulation?

It tells us that the enforcement strategy has crystallized. Sanction the individuals (OFAC). Prosecute the network (DOJ). Squeeze the infrastructure (exchanges and MSBs). This is the chokepoint doctrine, and it is being applied with increasing precision.

The precedent was set in October 2023, when OFAC sanctioned Buy Cash, a Gaza-based exchange. That action sent a signal: infrastructure nodes are targets, not just the criminals who use them. The al-Zaq case reinforces that signal with criminal charges.

For centralized exchanges, the compliance implications are severe. Every deposit address is a potential connection to an illicit network. Every withdrawal is a potential sanctions violation. The burden of proof — and the cost of verification — falls squarely on the platforms that operate the fiat-crypto boundary.

And for the rest of us? The case demonstrates that on-chain analytics have become the de facto compliance layer for an industry that claims to be decentralized. Chainalysis is not a neutral observer. It is a private surveillance contractor whose product is the correlation of pseudonymous addresses to real-world identities. When OFAC doesn't publish wallet addresses, it is effectively delegating enforcement to this private infrastructure.

Is that stable? Is that accountable? Is that even legal under traditional administrative law principles that require notice and specificity in sanctions designations?

I don't have a definitive answer. But I know that the compliance gap is real, and it is being filled by private actors whose methodologies are proprietary and whose error rates are not publicly auditable.

What the Next Indictment Will Look Like

I have spent enough time in the labyrinth where value flows unseen to recognize patterns before they become consensus. Here is what I see forming:

The next enforcement cycle will not target another charity network. It will target the tools that the current network didn't use — but that the next one will. Non-custodial wallets, privacy-preserving protocols, and decentralized exchanges are the logical next step for actors who have learned from this case that centralized chokepoints are liabilities.

The al-Zaq network was caught because it depended on exchanges. The next network will try to eliminate that dependency. It will use atomic swaps, peer-to-peer protocols, and cross-chain bridges that don't require KYC.

Will it succeed? Partially. But here is the structural limitation that no amount of privacy technology can overcome: the fiat off-ramp always exists somewhere. Someone, somewhere, needs to convert digital value into something that buys food, pays rent, or purchases weapons. And that conversion point — no matter how decentralized the protocol layer becomes — is where the chokepoint doctrine will focus.

The real question isn't whether crypto can be used for illicit finance. It obviously can. The question is whether the regulatory response will be proportionate to the actual risk, or whether it will be driven by a narrative that treats "crypto" as a monolithic threat rather than a transparent ledger that makes certain types of crime more visible, not less.

The crypto in this case was "tens of thousands of dollars." The traditional banking channels moved millions. Yet the headline says "Crypto."

Follow the data, not the headline. The data says the money was moved through banks, disguised as charity, and converted at the margins. The data says the blockchain didn't hide the crime — it documented it.

That distinction is not semantic. It is the difference between regulating a tool and regulating a threat. And if we get it wrong, we will build a compliance regime that punishes transparency while the next network moves millions through channels we never thought to watch.