Hamas Unit Told Donors to Avoid Binance, Preferred Bybit, OKX and TRC-20 USDT
TREE NEWS reports: A U.S. Department of Justice asset forfeiture filing has surfaced an internal letter from the Al-Qassam Brigades, the military wing of Hamas, in which the group advised donors to steer clear of Binance for moving funds and instead recommended Bybit, OKX, Kast and Redotpay, with transfers routed through USDT on Tron’s TRC-20 network. Binance Chief Compliance Officer Noah Perlman seized on the disclosure, saying that when a terrorist organization tells people to avoid Binance, it shows the exchange’s controls are working. OKX pushed back, stating the wallet addresses in question are not connected to its platform, have been flagged by internal risk systems as suspected illicit addresses, and that any transfer attempt toward them would be blocked.
Why the Disclosure Matters
The episode is less about any single exchange and more about how illicit finance adapts to enforcement pressure. When a sanctioned group explicitly names platforms to avoid, it is effectively publishing a map of where compliance friction has become high enough to matter. That is a meaningful signal for regulators who have spent years arguing that aggressive know-your-customer and transaction-monitoring regimes change behavior rather than simply displacing it.
It also highlights the persistent appeal of Tron’s TRC-20 rail for USDT transfers. Low fees and deep liquidity have made it a default settlement layer for dollar-denominated value movement, including by actors who prefer speed and cost efficiency over transparency. Tether has repeatedly frozen addresses tied to sanctioned entities, but the cat-and-mouse dynamic continues.
Exchange Responses and the Compliance Arms Race
- Binance framed the mention as external validation of its compliance overhaul, which followed a landmark U.S. settlement and years of intensified monitoring.
- OKX denied any affiliation with the cited addresses and said its risk engine had already blacklisted them, meaning inbound transfers would be intercepted.
- Bybit, Kast and Redotpay did not immediately detail their exposure, but the naming puts their screening and geofencing practices under scrutiny.
The broader takeaway is that naming and shaming cuts both ways. A platform cited as a preferred channel faces reputational and regulatory risk even if it blocks the specific addresses, while a platform cited as avoided gains an unusual, if uncomfortable, compliance credential.
What to Watch Next
Expect U.S. authorities to use the filing to press exchanges on wallet-level attribution and to push for faster information sharing across the industry. Chain analytics firms will likely publish follow-up tracing on the cited addresses, and Tron-based USDT flows tied to sanctioned actors will remain a focal point for Treasury’s Office of Foreign Assets Control. For exchanges, the operational priority is clear: demonstrate that flagged addresses are not just monitored but actively blocked, and that donor-facing rails cannot be repurposed faster than compliance teams can respond.
