The Money Exchanger and the Digital Dollar

CN-24

Published by Cartel DocsAbout 11 minutes to read

Investigations

Contents

Before the wallet
A name attached to an address
The businesses across the Atlantic
Gold before it becomes money
The customers who are not part of the network
The broker remains
Sources

On a hot June morning in 2023, Israeli defense officials in Tel Aviv watched digital ledgers update in real time as approximately $1.7 million in cryptographic tokens was frozen and confiscated across dozens of virtual accounts^[4]. The assets were Tether (USDT), a dollar-pegged stablecoin flowing rapidly across the TRON blockchain, destined for the operational coffers of Hezbollah and Iran’s Islamic Revolutionary Guard Corps–Quds Force^[4]. At the epicenter of this modern digital web sat Tawfiq Muhammad Said al-Law, an elusive Syrian money exchanger operating out of Lebanon^[1],^[4]. The technology—immutable distributed ledgers, algorithmic settlement, and decentralized wallet addresses—was cutting-edge; his profession, however, was as old as commerce itself^[1],^[4].

Al-Law occupied a vantage point that generations of merchant bankers and informal brokers would have immediately recognized: bridging the gap between individuals who held wealth in one form and those who desperately required it in another^[1]. In March 2024, the U.S. Department of the Treasury formally designated al-Law, accusing him of providing Hezbollah with specialized digital wallets to absorb proceeds from illicit Quds Force commodity sales^[1]. Treasury specifically linked his services to senior Hezbollah financial commanders, including Muhammad Jafar Qasir and Muhammad Qasim al-Bazzal^[1]. Blockchain analytics firm Chainalysis subsequently mapped 904 transfers through a single known al-Law wallet in under a year, with 145 transactions flowing through mainstream centralized cryptocurrency exchanges^[13]. The digital network survived by embedding itself within the high-volume traffic of everyday global finance^[5],^[13].

For investigators tracking Hezbollah-linked money across the Americas, this digital evolution presents a pivotal question^[3],^[8]. What happens when revenues generated through Latin American commercial fronts, contraband trade, and narcotics pipelines can be instantly converted into cryptographic dollars without shedding the trusted human brokers who have moved them for decades?^[3],^[8] Deciphering this shift requires examining how the underlying financial architecture has adapted—and why the human intermediary remains irreplaceable^[1],^[19].

Before the wallet

In February 2015, European authorities launched a coordinated inquiry based on intelligence provided by the U.S. Drug Enforcement Administration^[26]. A year later, the DEA publicly unmasked Operation Cedar, detailing an intricate pipeline where couriers collected street-level cocaine proceeds across European capitals, routed value through Beirut, and settled debts with Colombian cartels via informal brokers^[26]. At the center of this mechanism stood Mohamad Noureddine and his firm, Trade Point International^[26]. The DEA characterized the syndicate as the Business Affairs Component of Hezbollah’s External Security Organization, asserting that profits purchased armaments for operations in Syria^[26].

The system resolved a fundamental friction of transnational commerce: a drug sale in Paris or Madrid generated physical European banknotes thousands of miles away from a cartel supplier awaiting payment in Medellín^[26]. Flying suitcases of physical cash back to South America was fraught with logistical peril and customs interdiction^[19]. Instead, informal value transfer systems—known broadly as hawala—enabled financial intermediaries to net out counterparty balances across dispersed geographic jurisdictions without moving physical banknotes across borders^[19].

While popular imagination often depicts hawala as an archaic network resting purely on clan trust, a landmark 2013 study by the Financial Action Task Force (FATF) dismantled that myth^[19]. FATF documented that commercial hawala relies on systematic accounting ledgers, formal bank interfaces, and trade-based settlements involving real commodities^[19]. The essential service was liquidity reconciliation: clearing debts through offset accounts and physical merchandise^[19].

This structural foundation illuminates the digital evolution^[19]. A broker who adopts cryptocurrency has not abandoned his core trade; he has merely adopted a faster, bearer-negotiable rail to balance his books^[19]. Stablecoins function as digital bearer drafts^[16]. The transition from cash couriers to digital wallets does not eliminate the human broker—it enhances his operating speed^[13],^[19].

As early as 2017, RAND Corporation researchers identified Hezbollah as a prime candidate for cryptocurrency experimentation due to its established footprint in global shadow markets like Latin America^[14]. Yet RAND analysts also noted countervailing factors: substantial state subsidies from Iran and entrenched access to conventional banking softened the imperative for wholesale crypto migration^[14]. In an expanded 2019 report, RAND framed virtual asset adoption as a calculated operational trade-off: digital tokens offer rapid cross-border transmission, but their ultimate utility hinges on off-ramps—the ability to convert virtual coins into fiat currency, armaments, and local payrolls^[15].

A name attached to an address

When the Treasury sanctioned al-Law on March 26, 2024, it exposed the specific mechanics linking physical commodities to digital tokens^[1]. Operating from Beirut, al-Law allegedly cleared cryptocurrency transactions for the Syrian Qatirji conglomerate—a sanctioned corporate behemoth involved in smuggling Iranian and Syrian petroleum—alongside his services for Hezbollah leadership^[1]. His business straddled the boundary between macro-commodity trading and illicit organizational financing^[1].

In its formal notice, OFAC appended a specific TRON-based USDT wallet address directly to al-Law’s entry on the Specially Designated Nationals (SDN) list^[12]. This administrative designation unified two distinct planes of intelligence: a verifiable individual in Lebanon and an alphanumeric address visible on a public blockchain ledger^[12]. While the ledger transparently displayed every token transfer, it could not, on its own, disclose the commercial counterparty behind each transaction^[5],^[12].

The scale of this pipeline widened considerably in September 2025, when Treasury unsealed sanctions against Iranian financial facilitators Alireza Derakhshan and Arash Estaki Alivand^[23]. Between 2023 and 2025, the pair allegedly coordinated over $100 million in digital asset acquisitions funded by Iranian oil revenue, with Alivand executing multi-million-dollar stablecoin transactions directly through al-Law^[23]. Derakhshan managed bank accounts and shell entities across multiple countries, shielding his name from formal registration documents^[23]. Blockchain analytics from Elliptic revealed that addresses associated with Alivand had absorbed $300 million, while Derakhshan-linked clusters processed $442 million, predominantly in USDT^[29].

Yet these figures highlight an acute analytical trap^[5],^[29]. As Chainalysis cautioned in an October 2023 briefing, a professional money exchanger handles capital for diverse clienteles, including legitimate merchants and third-party traders^[5]. Tallying the total gross volume flowing through an exchange wallet and attributing every cent to a terrorist end-user fundamentally distorts reality^[5]. Traditional cash and banking routes remain the dominant backbone of terrorist finance^[5],^[25]. An on-chain address can trace token movement, but establishing who owned the money requires off-chain corroboration^[5],^[12].

The key distinctions

A visible transfer is not a visible beneficiary

What different records can establish.

Blockchain

Token movement

An address shows transfers and balances. [5] [12]

Designation

Attributed operator

OFAC links a named person to a specified address. [12]

Off-chain records

Whose money?

Customer and transaction evidence identifies the beneficiary. [5]

Total wallet throughput cannot be assigned wholesale to one client or organization.

The businesses across the Atlantic

Three months after the Israeli crypto seizure, Treasury struck another transnational corridor^[2]. In September 2023, OFAC sanctioned a network spanning Colombia, Venezuela, and Lebanon centered on the Akil Rada family^[2]. Treasury alleged that Amer Mohamed Akil Rada managed commercial ventures, including charcoal shipments from Colombia to Lebanon, remitting up to 80 percent of his business profits to Hezbollah^[2].

His brother Samer Akil Rada was designated for international narcotics trafficking and laundering, linked to a 500-kilogram cocaine shipment intercepted in El Salvador^[2]. Samer served as chief executive and general manager of BCI Technologies, a Venezuelan commercial enterprise^[2]. Treasury sanctioned BCI strictly based on its corporate control by Samer, without citing digital asset transactions or crypto wallets^[2].

This distinction proved critical as researchers evaluated technological risks^[3]. In a July 2025 study for GNET, researcher Adam Rousselle assessed the potential convergence between Hezbollah-linked commercial fronts and Latin America’s surging stablecoin adoption^[3]. While identifying BCI Technologies as a case study in corporate vulnerability, Rousselle acknowledged the absence of disclosed, company-specific cryptocurrency transactions^[3]. Moreover, he explicitly highlighted the lack of direct evidence confirming Hezbollah crypto utilization in the Tri-Border Area of Argentina, Brazil, and Paraguay^[3]. The verifiable reality remained anchored in commercial fronts, shipping routes, and banking channels; digital assets represented an emerging risk profile rather than an established paper trail across every designated company^[2],^[3].

Gold before it becomes money

In South America’s extractive economies, physical commodities provide another vital avenue for value generation^[6],^[7]. In a March 2025 study, RAND analyst Marzia Giambertoni examined reported Iranian and Hezbollah involvement in illicit gold mining across Venezuela’s Orinoco Mining Arc, reviewing congressional testimony from 2019 and 2023^[6]. Giambertoni contextualized these activities within an opaque spectrum of state-tolerated enterprises whose precise financial mechanics remain challenging to quantify^[6].

The human reality at the extraction point is severe^[22]. Human Rights Watch documented rampant exploitation in the mining settlements of Bolívar state, interviewing a 16-year-old boy whose spine was shattered when struck by a tree log while blasting a pit with high-pressure water hoses without protective gear^[22]. Armed syndicates—known locally as prindicatos—and Colombian guerrilla groups exercise brutal dominion over mining camps with tacit official acquiescence^[22]. A July 2020 United Nations report detailed the predatory revenue splits: miners paid 10 to 20 percent of their yields to criminal gangs controlling the turf, and a further 15 to 30 percent to mill operators^[27]. Physical labor generated raw mineral wealth, partitioned across predatory layers long before reaching an export broker^[27].

A comprehensive 2021 study by the Organisation for Economic Co-operation and Development (OECD) characterized Venezuelan gold as a classic conflict supply chain contaminated by corruption, armed extortion, and systemic money laundering^[7]. High intrinsic value, complete anonymity upon melting, and ease of physical transport make gold ideal for obscuring origin^[7]. Once smelted and blended into legitimate regional bullion flows, the metal’s violent extraction history is erased^[7].

In July 2026, an INSS analysis by Danny Citrinowicz, Snir Levi, and Charlotte Cobb mapped how this physical resource interfaces with virtual finance^[8]. Utilizing open-source intelligence and proprietary blockchain analytics from NOMINIS, they concluded that Hezbollah-linked facilitators rarely operate the dangerous mining pits themselves; instead, they function as financial intermediaries, earning commissions by brokering transactions and off-taking raw bullion^[8]. Their study identified an operational pipeline where wholesale gold sales in regional hubs are settled in fiat cash and converted into stablecoins, operating in tandem with Iranian oil-clearing channels^[8]. This research illustrates the modern bridge: physical commodities mined under primitive conditions are converted into frictionless digital dollars, enabling capital flight and sanctions evasion across borders^[7],^[8].

How it works

From a physical commodity to digital settlement

The pipeline alleged in the July 2026 INSS analysis.

Commodity

Gold sales

Brokers arrange sales of physical bullion. [8]

Settlement

Fiat value

Sales are settled through cash and intermediaries. [8]

Conversion

Stablecoins

Value moves through a digital payment instrument. [8]

This illustrates the research account; it is not a traced journey for the photographed bars.

The customers who are not part of the network

The economic conditions that foster shadow finance also generate widespread civilian demand for digital dollars^[24],^[30]. Chainalysis calculated that Latin America absorbed approximately $415 billion in cryptocurrency transactions between July 2023 and June 2024, identifying Venezuela as one of the regional leaders in per-capita adoption^[24]. Driven by triple-digit inflation, recurring currency devaluations, and severe shortages of physical dollar banknotes, ordinary citizens turned to stablecoins as an indispensable hedge to preserve their purchasing power^[24],^[30].

In December 2024, El País reported on the everyday reality of this “digital gray dollar” across Venezuelan cities^[30]. Stablecoins represented roughly 47 percent of all retail crypto transactions under $10,000, functioning as a primary medium for family remittances, freelance earnings, and grocery purchases^[30]. For ordinary citizens navigating monetary collapse, low transaction fees and price stability outweighed ideological or technological considerations^[30].

The technology was also leveraged for humanitarian assistance^[28]. A Wilson Center report by Leopoldo López and Kristofer Doucette detailed the pandemic-era “Health Heroes” initiative, which distributed $100 monthly stipends to over 60,000 frontline medical workers for three months^[28]. By pairing digital wallets with trusted local off-ramps, the program bypassed regime-controlled banks to deliver emergency aid directly to nurses and doctors^[28]. Even in this context, the system relied on local brokers who could convert digital tokens into spendable fiat currency^[28].

In a December 2025 assessment, the IMF highlighted both the potential benefits of stablecoins in slashing remittance costs and their systemic risks, including run risks on unverified reserves and accelerated currency substitution^[16]. The widespread civilian adoption of stablecoins complicates law enforcement attribution^[9],^[16]. In its 2024 National Terrorist Financing Risk Assessment, Treasury noted that money-service businesses and crypto exchanges provide vital services to unbanked populations^[9]. De-risking entire jurisdictions risks driving transactions into unregulated peer-to-peer shadows^[9]. Investigators cannot rely on blunt geographic filters; they must follow specific suspicious flows^[9].

The broker remains

The reliance on conventional financial intermediaries persists alongside digital tools^[20],^[21]. In January 2023, Treasury sanctioned prominent Lebanese economist and money changer Hassan Moukalled, his exchange business CTEX, and his sons, accusing them of operating as financial conduits for Hezbollah^[20]. Moukalled vehemently denied the allegations, telling the Associated Press that his business operated legitimately within Lebanon’s formal banking regulations^[21]. The dispute centered on a licensed brick-and-mortar money exchange navigating Lebanon’s financial collapse^[20],^[21].

In May 2024, FinCEN issued a comprehensive advisory on Iran-backed terrorist financing, highlighting that while digital assets receive intense public scrutiny, Hezbollah’s financial architecture remains diversified across Iranian state subsidies, oil smuggling, real estate holdings, and commercial enterprises^[10]. A July 2026 assessment by the Foundation for Defense of Democracies (FDD) reached a similar conclusion: as Hezbollah reconstructs its infrastructure following military conflict with Israel, physical cash remains indispensable for paying fighter salaries, compensating displaced families, and purchasing local supplies^[25]. Whatever cryptographic rails are utilized in transit, money must ultimately touch the physical world^[25].

Nevertheless, the digital dollar offers new enforcement levers^[11]. In October 2023, Tether disclosed that it had collaborated with law enforcement to freeze thirty-two blockchain addresses containing approximately $873,118 tied to illicit finance in Israel and Ukraine^[11]. Unlike physical cash, centralized stablecoin smart contracts contain administrative functions that permit the issuer to blacklist and freeze token balances remotely^[11].

Regulators are moving to close the remaining jurisdictional gaps^[17],^[18]. FATF reported in June 2025 that ninety-nine jurisdictions had passed or were drafting Travel Rule legislation to mandate customer identification for virtual asset transfers^[18]. In a March 2026 report, FATF turned its attention to unhosted private wallets and stablecoins, recommending that issuers implement robust counter-illicit finance controls and share cross-border intelligence^[17].

The June 2023 seizure in Tel Aviv removed $1.7 million from circulation, but the subsequent investigative trail led directly back to an enduring archetype: a professional money exchanger managing risk across physical and digital boundaries^[1],^[4],^[23]. Cryptographic ledgers can record the velocity of digital tokens, but uncovering the real networks behind them requires following the human brokers who translate code into power^[1],^[13],^[23].

The Money Exchanger and the Digital Dollar

Before the wallet

A name attached to an address

A visible transfer is not a visible beneficiary

The businesses across the Atlantic

Gold before it becomes money

From a physical commodity to digital settlement

The customers who are not part of the network

The broker remains

Sources

Related case files

Venezuela’s Brokers: The Networks That Outlasted Maduro

The Plane That Burned in the Desert

The King of Captagon: The Shipment Stopped, the Network Survived

The Men Who Looked: Hezbollah’s American Surveillance Cases