A new front has emerged in Israel's fight against the funding of Iran-backed militant groups from Hamas to Hezbollah: A fast-growing crypto network called Tron that until recently attracted less scrutiny than Bitcoin.
Quicker and cheaper than Bitcoin, the Tron network has overtaken its rival as a platform for crypto transfers associated with groups designated as terror organizations by Israel, the United States and other countries, according to interviews with seven financial crime experts and blockchain investigations specialists.
A Reuters' analysis of crypto seizures announced by Israeli security services since 2021 reflects the trend, showing for the first time a sharp rise in the targeting of Tron wallets and a fall in Bitcoin wallet seizures.
"Earlier it was Bitcoin and now our data shows that these terrorist organizations tend to increasingly favor Tron," said Mriganka Pattnaik, CEO of New York-based blockchain analysis firm Merkle Science, citing Tron's faster transaction times, low fees, and stability.
Merkle Science says it counts law enforcement agencies in the United States, Britain and Singapore as clients.
Israel's National Bureau for Counter Terror Financing (NBCTF), which is responsible for such seizures, froze 143 Tron wallets between July 2021 and October 2023 that it believed were connected to a "designated terrorist organization" or used for a "severe terror crime," the Reuters analysis found.
The Oct. 7 attacks by Hamas on Israel killed around 1,200 people. Israel's subsequent strikes and ground invasion of Gaza has killed some 14,000 people. In its response, Israel has also stepped up scrutiny of Hamas' financing.
Contacted by Reuters with a summary of this article, Hayward Wong, a spokesperson for British Virgin Islands-registered Tron said all technologies could "in theory be used for questionable activities," citing as an example US dollars being used for money laundering.
Wong said Tron did not have control over those using its technology and that it was not linked to the groups identified by Israel.
Almost two-thirds of Israel's Tron seizures – 87 - were this year, including 39 wallets that Israel said in June were owned by Lebanon's Hezbollah, and 26 it said in July belonged to Palestinian Islamic Jihad, a Hamas ally that joined the assault on Israel from Gaza.
The seizures have also included 56 Tron wallets NBCTF said were linked to Hamas, including 46 in March last year it connected to a single Gaza-based money exchange company called Dubai Co. For Exchange.
Weeks after the Hamas assault, Israel announced its biggest known seizure of crypto accounts yet, freezing around 600 accounts it connected to Dubai Co., without stating which crypto networks or coins were used.
More than a dozen people whose funds were frozen in that seizure told Reuters they had been using Tron. They said they traded crypto to help their business or personal finances and denied any connection with Hamas or Islamic Jihad.
One of the people, who identified themselves only as Neo, said it was possible they had transferred money on one occasion to somebody associated with Hamas.
Israel calls Dubai Co. a terrorist group "due to the aid that they provide to the Hamas terrorist organization, particularly its military arm, in transferring funds on a scale of tens of millions of dollars a year."
A representative for Dubai Co., whose email was listed on the seizure order, did not respond to a request for comment.
The armed wing of Hamas, which had raised crypto funds since at least 2019, said in April it would cease Bitcoin fundraising, citing increased efforts to prevent donations. Hamas did not mention Tron in the statement.
Reuters could not independently determine whether Hamas had used Tron. NBCTF declined to comment for this story, including about its understanding of the shift to Tron and how it linked the wallets to the militant groups. Hamas, Hezbollah and Islamic Jihad did not respond to requests for comment.
Six people listed on Israel's previous Tron seizure notices who responded to Reuters questions denied connections to militant groups. They included people based in Venezuela, Dubai and the West Bank city of Jenin.
'Axis of resistance'
In the June statement, Israel said it seized funds "intended for use by the terrorist organizations financed by Iran." Iran counts Hamas, Hezbollah and Islamic Jihad in a so-called Axis of Resistance opposing Israeli and American power in the Middle East.
In the seizure statements, NBCTF did not affirm Tehran was the source of the funding. Iran's foreign ministry did not respond to a Reuters request for comment about using Tron to fund groups it supports.
Iran has previously used Tron to skirt US sanctions. Reuters reported last year that Iranian firms used it for $8 billion in transactions between 2018 and 2022.
Estimates of the sums of money that reach proscribed groups through crypto are unreliable because it is hard to say whether money sent to seized wallets was really destined for those groups.
The value of crypto transactions and the digital wallet addresses used for them can be traced on the blockchain - a public ledger that underpins crypto. However, it is hard for those outside law enforcement or crypto trading platforms to know the real identity of those involved in the transactions.
The people Reuters consulted additionally said their research showed the cryptocurrency Tether was dominant across the Tron network.
Tether, the world's biggest so-called stablecoin, is backed by reserves and aims to keep a 1:1 peg with the dollar. The company said in a statement that it regularly traced and froze tokens "used for nefarious purposes," and coordinated these efforts with law enforcement.
Tether is the third-largest crypto token, with a market value of $89 billion, up by around a third in the past year, according to CoinGecko data.
Despite its lack of name recognition outside crypto circles, Tron is the dominant blockchain for Tether transactions, currently hosting $48 billion of the tokens, according to Tether's website. Average daily transactions on Tron hit 9.1 million from April-June, according to data firm Messari, up over 70% from the same period last year.
Justin Sun, who founded Tron in 2017, was sued by the US Securities and Exchange Commission in March for allegedly artificially inflating trading volumes and selling Tron tokens as an unregistered security. Sun said the SEC charges "lack merit."
Binbin Deng, a representative of Sun, referred Reuters to Tron spokesperson Wong's statement.
'Blindspot'
Since its 2008 birth, the Bitcoin blockchain, and since then crypto more widely, have been magnets for criminals drawn by liquidity and a reputation for anonymity. Of all crypto transaction volumes, the illicit share was 0.2% in 2022, down from 2% three years earlier, according to blockchain tracker Chainalysis.
In Israel, Bitcoin seizures have been scarce by comparison with Tron. In 2021, the first year NBCTF published seizure notices, it froze 30 Bitcoin wallets. No Bitcoin wallets appear in notices in the subsequent years.
The Financial Action Task Force, a Paris-based G7 body that fights illicit finance, warned last month that terrorist organizations were seeking to further boost donor anonymity, citing the growing popularity of Tether transfers on Tron.
Four of the people consulted by Reuters said law enforcement's increased capability to trace transactions on Bitcoin was driving such groups to Tron.
Tron initially drew less attention from blockchain analysis firms, said Shlomit Wagman, a senior fellow at Harvard University who was director-general of the Israel Money Laundering and Terrorism Financing Prohibition Authority from 2016 to 2022.
"There was until now this blindspot," she said.
Transaction fees on Tron cost far less than on Bitcoin, US investment firm VanEck says. Militant groups were also using stablecoins on Tron instead of more volatile bitcoin tokens to ensure the "value of their crypto is being preserved," Wagman said.