Cash on Commercial Flights: Hezbollah's Courier Problem After 2024

CN-36

Published by Cartel DocsAbout 11 minutes to read

Investigations

Contents

A route disappears
The bag and the file
People behind the transfers
The billion-dollar question
A cheque that could not be cashed
Beyond the scanner
Sources

When the passenger identified in Lebanese court files as M.H. stepped into Beirut’s Rafic Hariri International Airport on a chilly morning in late February 2025, he traveled without so much as a single checked suitcase^[4]. According to a detailed reconstruction broadcast by Lebanese network LBCI, his itinerary was as brief as it was purposeful: a commercial flight to Istanbul, a rapid transit crossing between the Turkish metropolis’s two international airports, the collection of a solitary carry-on bag, and an immediate return ticket booked back to Lebanon^[4]. He had left his homeland empty-handed; he returned carrying a dense, brick-like cargo of $2.5 million in physical greenbacks^[2],^[4]. On February 28, 2025, as M.H. crossed customs clearance, Lebanese authorities intercepted the passenger and impounded the cash, marking an extraordinary domestic enforcement strike confirmed by the Finance Ministry^[2],^[4]. Yet between the physical seizure on the arrivals concourse and the geopolitical maelstrom that followed, the haul exposed a profound transformation: with overland smuggling corridors shattered across Syria and formal banking conduits severed by sanctions, an embattled Hezbollah was forced to rely on the ancient, vulnerable art of cash couriering aboard commercial airliners, transforming airport luggage belts into the front line of a desperate regional financial war^[2],^[3],^[1].

How it works

A return trip with one additional bag

The itinerary described by LBCI in the M.H. case.

Departure

Beirut

The passenger left without checked luggage. [4]

Collection

Istanbul

A transfer between airports and collection of a carry-on bag. [4]

Return

Beirut customs

Authorities seized $2.5 million on 28 February 2025. [2] [4]

A schematic itinerary. The identity of the intended recipient was disputed in the reporting that followed.

Who was supposed to receive the money instantly ignited a fierce political dispute^[2],^[3]. Three separate intelligence sources informed Reuters that the cash was intended directly for Hezbollah’s operational coffers; the Finance Ministry’s official press release, however, maintained institutional caution, conspicuously omitting the intended recipient’s identity^[2]. The Higher Shiite Council subsequently entered the fray, formally claiming the $2.5 million as lawful charitable donations collected from diaspora organizations abroad and demanding its immediate return^[2],^[3]. In interrogation, M.H. adamantly denied any organizational connection to Hezbollah^[3]. By mid-March 2025, L’Orient Today reported that investigative judge Kamal Nassar had indicted M.H. and transferred the docket to the single criminal judge of Mount Lebanon for trial^[3]. The banknotes were secured in state vaults; their legal ownership and ultimate purpose were being fiercely litigated in an open court^[2],^[3].

The institutional shockwaves rippled outward within twenty-four hours^[5]. On March 1, three cabinet ministers—representing Interior, Transport, and Finance—staged a joint inspection visit to the airport, descending on customs checkpoints to review luggage scanning protocols and security screening^[5]. A facility designed to facilitate commercial transit had become a high-profile arena where a fragile Lebanese state had to demonstrate that it could physically enforce its borders^[5].

A route disappears

The airport seizure occurred against a backdrop of severe geopolitical rupture^[6]. In December 2024, Hezbollah Secretary-General Naim Qassem openly acknowledged a catastrophic strategic setback: following the stunning collapse and overthrow of Bashar al-Assad’s regime in Damascus, Hezbollah had lost its land supply corridor through Syria^[6]. For over a decade, the Assad government had safeguarded a continuous pipeline funneled from Tehran through Iraq into the Bekaa Valley, ferrying advanced missiles, military technicians, and cash^[6]. With Syrian rebel factions controlling the border crossings and international forces patrolling the perimeter, that protected corridor had vanished^[6].

At the diplomatic level, the United Nations cessation-of-hostilities framework placed binding obligations upon Beirut^[27]. Paragraph 11 of UN Security Council document S/2024/870 explicitly mandated Lebanese military and security deployment to monitor and secure all regulated and unregulated land, air, and sea points of entry^[27]. The enforcement mandate extended far beyond the southern frontier with Israel: Beirut’s airport was now under international surveillance to prevent unauthorized rearmament and funding^[27].

In a May 2025 assessment for the Institute for National Security Studies (INSS), researcher Orna Mizrahi observed that intensified surveillance over ports and airports had imposed unprecedented structural bottlenecks on Hezbollah’s reconstruction^[7]. Yet Mizrahi cautioned that Lebanese state authorities operated within strict political boundaries, balancing enforcement against the perpetual peril of sparking sectarian civil strife^[7]. The friction was operational: enforcing a border checkpoint required interdicting cargo, weathering diplomatic blowback, and managing potential violence beyond the terminal gates^[7],^[25].

Retaliation materialized immediately in civil aviation^[25]. When Lebanese aviation authorities barred an Iranian flight suspected of transporting illicit personnel from landing in Beirut, Tehran retaliated by blocking Lebanese commercial repatriation flights, leaving hundreds of Lebanese pilgrims stranded abroad^[25]. Simultaneously, the conflict spilled onto the tarmac access roads^[12]. On February 14, 2025, a UNIFIL peacekeeper convoy en route to the airport was ambushed on the highway; one military vehicle was torched, and UNIFIL’s outgoing deputy force commander was injured on his journey home^[12].

The political response was swift^[13],^[26]. Hezbollah’s Al-Manar television condemned the assault, deflecting blame toward unruly, suspicious elements, while its political ally Amal called for immediate prosecution^[13]. The Lebanese Army executed security sweeps, detaining several suspects under judicial warrants^[26]. The ambush demonstrated how quickly disputes over airport control could turn violent on the streets^[13],^[26].

The bag and the file

The February 28 seizure was governed by basic statutory rules^[9]. Under Lebanese customs regulations, incoming passengers are legally required to file written declarations for all physical cash and negotiable financial instruments exceeding $15,000 in value^[9]. Failing to declare does not automatically establish terrorism; it triggers formal inquiries regarding source of wealth, commercial justification, and beneficial ownership^[9]. Intercepting the bag merely opens the investigative docket^[9].

International evaluators had highlighted historical shortcomings in this enforcement regime^[10]. In its December 2023 mutual evaluation report, MENAFATF observed that while customs authorities occasionally froze funds, moving from border cash seizures to final judicial money-laundering confiscations remained rare^[10]. Between 2017 and 2021, Lebanon recorded only twenty cash non-declaration cases totaling $15 million, almost exclusively concentrated at Beirut’s airport rather than land borders^[10]. MENAFATF’s audit captured the institutional bottleneck: seizing physical banknotes on a terminal floor is straightforward; proving its illicit lineage in court requires cross-border evidence that is far more difficult to secure^[10].

A joint typology report by FATF and MENAFATF underscored the operational limits of physical cash controls^[11]. While cash breaks the electronic audit trail of SWIFT wires, it serves diverse criminal activities—from narcotics trafficking to tax evasion and sanctions busting^[11]. The study found no single physical concealment method uniquely indicative of terrorist finance^[11]. Uncovering intent requires documenting communications, booking receipts, and financial relationships rather than inspecting the banknotes alone^[11]. A carry-on bag carries no organizational label^[11].

Transporting physical currency also carries steep commercial costs^[28]. In a study of six Dutch narcotics prosecutions involving 181 cash couriers, criminologists Melvin Soudijn and Peter Reuter calculated that physical courier fees routinely consumed between 10 and 17 percent of the principal^[28]. While these metrics reflect Colombian cartel operations in Europe, they illustrate that moving cash is an expensive logistics business^[28]. For a financial commander, money seized at customs is an operational loss, but it says little about shipments that slipped through unhindered^[11],^[28].

People behind the transfers

The broader international courier system was targeted by the U.S. Treasury on August 20, 2026, when OFAC sanctioned a ten-person commercial-flight courier syndicate operating across Lebanon, Turkey, the United Arab Emirates, and Iran^[1]. Treasury alleged that the network moved hundreds of millions of dollars in physical cash and gold for the IRGC-Quds Force and Hezbollah^[1]. The administrative action detailed specialized division of labor: Turkish businessman Yunus Alper Yilmaz allegedly provided front companies and corporate bank accounts, Halil Ibrahim Kacmaz and Onder Dede collected bulk cash, and Vasfi Akyuz coordinated logistics while flying as a personal courier^[1]. The designation documented an elaborate international infrastructure; it did not allege that M.H. was an operative of this specific cell^[1].

The key distinctions

Different jobs inside the alleged courier network

Roles attributed by Treasury in its August 2026 designation.

Yunus Alper Yilmaz

Company access

Allegedly provided front companies and bank accounts. [1]

Kacmaz and Dede

Cash collection

Allegedly gathered bulk currency. [1]

Vasfi Akyuz

Travel and logistics

Allegedly coordinated movement and acted as a courier. [1]

This was a separate designated network. Treasury did not identify M.H. as a member of this cell.

Concurrently, Treasury redesignated Hezbollah under Executive Order 13224 for acting on behalf of the Quds Force^[1]. Having originally designated Hezbollah as a Foreign Terrorist Organization in 1997, the new action codified a specific relationship of operational command and control^[1].

The courier network operated alongside corporate commercial fronts^[15]. In March 2025, Treasury sanctioned corporate entities that funneled Iranian oil revenues and formal financial services to Hezbollah^[15]. The enforcement action highlighted corporate adaptation: after primary financiers were blacklisted, family members assumed formal executive titles while designated figures maintained clandestine control^[15]. Corporate registries were manipulated to maintain access to Western commerce^[15].

Hezbollah’s financial command was simultaneously undergoing internal restructuring^[16]. Following the death of veteran financial commander Muhammad Jafar Qasir in October 2024, Treasury reported in November 2025 that his portfolio was decentralized across multiple deputies^[16]. Treasury alleged that facilitator Ossama Jaber alone converted and moved tens of millions of dollars through Beirut currency exchange houses between late 2024 and early 2025^[16]. Exchange bureaus, commercial fronts, and airport couriers formed overlapping nodes of an elastic financial network^[15],^[16].

In a July 2026 assessment for the Foundation for Defense of Democracies (FDD), researcher Iftah Burman analyzed the structural demands confronting Hezbollah’s post-war apparatus^[23]. Burman described a hybrid funding model combining petroleum trade, trade offsets, and cash couriers, balanced against urgent commitments: fighter stipends, military rebuilding, and community relief^[23]. An organization can hold valuable assets abroad while facing acute, immediate cash shortages in Beirut^[23].

The billion-dollar question

Evaluating the true volume of these financial flows exposes contrasting assessments across official statements^[14],^[16]. On November 6, 2025, the Treasury Department declared that the Quds Force had funneled over $1 billion to Hezbollah since the beginning of the year, primarily via commercial exchange houses^[16]. Four days later, however, the Associated Press quoted Treasury Under Secretary John Hurley stating that Hezbollah was aiming to secure $1 billion by the end of the year, while conceding that the exact amount successfully transferred remained uncertain^[14]. Hurley cited couriers carrying cash and gold, digital assets, and transactions clearing through commercial banks^[14]. The two statements reflected different degrees of certainty, illustrating the difficulty of auditing shadow flows^[14],^[16].

Lebanon’s domestic financial collapse provided fertile ground for cash couriers^[18]. The World Bank calculated that Lebanon’s cash economy surged to $9.9 billion in 2022, accounting for 45.7 percent of national GDP^[18]. In an economy where banks are frozen, commercial transactions and remittances are conducted in physical cash^[18]. Distinguishing illicit money from legitimate business receipts requires establishing specific intent and counterparties^[18].

Lebanese banking regulators moved to erect institutional barriers^[19]. In July 2025, Banque du Liban issued Basic Circular 170, forbidding regulated financial institutions from conducting transactions with designated Hezbollah-linked entities, including Al-Qard al-Hassan, Yousser, and Bayt al-Mal^[19]. The circular barred domestic banks from servicing these networks^[19].

The network adapted by diversifying into commodities^[21]. In February 2026, Treasury designated Jood SARL, alleging that Al-Qard al-Hassan personnel established commercial gold-trading shops near branch offices to maintain liquidity^[21]. Concurrently, INSS researchers Binstok, Mizrahi, and Klor concluded that while military strikes disrupted physical infrastructure, flexible intermediaries cushioned the operational blow^[17]. The authors emphasized that the vast majority of diaspora commerce is entirely legitimate, warning that blunt financial derisking risks cutting off Lebanese families from vital family remittances^[17].

A cheque that could not be cashed

The human reality of this liquidity crisis was captured in Beirut in July 2025^[24]. Reuters reported the account of a Lebanese homeowner whose damaged apartment was destroyed in an airstrike; while Hezbollah issued him reconstruction cheques, Al-Qard al-Hassan lacked the physical cash to honor them^[24]. The resident withheld his name for fear of losing compensation^[24]. A paper promissory note could not clear a physical bill^[24].

The scale of national devastation was staggering^[22]. The World Bank’s Rapid Damage and Needs Assessment (RDNA) calculated Lebanon’s reconstruction requirements at $11 billion for the conflict period through December 2024, including $4.6 billion in destroyed housing^[22]. These macroeconomic figures frame the environment: rebuilding demanded immense liquid capital at a time when traditional credit had vanished^[22].

Yet financial stress did not dissolve political control^[24]. Reuters noted that Hezbollah and Amal swept the May 2025 municipal elections, with many races uncontested^[24]. Institutional influence, public dependence, and liquidity moved on separate axes^[24]. By August 2026, the World Bank projected a 6.4 percent economic contraction following renewed hostilities, underscoring that the underlying economic crisis was deepening^[29].

In congressional testimony delivered in October 2025, Matthew Levitt warned that financial depletion would push Hezbollah to rely more heavily on transnational criminal funding, including narcotics money laundering and cash couriers from South America^[8]. While drawing upon historical cases, Levitt’s analysis provided an expert threat forecast; it did not establish that the $2.5 million seized from M.H. was derived from cocaine^[8]. The rigorous question is whether heightened enforcement drives groups toward criminal logistics, rather than assuming every seized bag is narcotics cash^[8].

Beyond the scanner

FATF’s action plan for Lebanon combined cross-border cash controls, precious metals oversight, beneficial ownership transparency, and targeted sanctions^[20]. The initiative urged authorities to protect legitimate non-profit operations while targeting illicit financing risks^[20]. The dispute surrounding M.H.’s seizure highlights why this distinction is vital: evidence must substantiate whether cash represents terrorist financing or lawful donations^[3],^[20].

Reforming the formal banking sector remains the fundamental solution^[30]. In February 2026, IMF staff described a cabinet-approved banking recovery strategy as an essential preliminary step to allocate losses and protect depositors^[30]. Restoring trust in commercial banks would diminish reliance on physical cash, narrowing the operating space available for illicit couriers^[30].

Beirut’s airport concourse brings this institutional challenge into sharp relief^[5],^[10]. When cabinet ministers reviewed security screening after the February bust, they confronted a delicate balance: interdicting illicit capital without paralyzing passenger movement^[5],^[10]. A customs seizure makes headlines, but an effective legal regime requires judicial proof that withstands a courtroom^[5],^[10].

M.H.’s journey began without checked luggage and ended with $2.5 million held in a central bank vault^[2],^[4]. Around that interception arose competing claims from religious authorities, formal denials, and a judicial indictment^[2],^[3]. The customs checkpoint stopped the banknotes; determining whose money it was required following the paper trail far beyond the carry-on bag^[2],^[3],^[4].

Cash on Commercial Flights: Hezbollah’s Courier Problem After 2024

A return trip with one additional bag

A route disappears

The bag and the file

People behind the transfers

Different jobs inside the alleged courier network

The billion-dollar question

A cheque that could not be cashed

Beyond the scanner

Sources

Related case files

The Men Who Looked: Hezbollah’s American Surveillance Cases

The Shipment and the Missing Name

The Name That Survived the Blast

The Companies Behind the Concrete