Digital Hawala: Hezbollah’s Evolving Financial Infrastructure in the Tri-Border Area
Abstract
Hezbollah’s presence in the Tri-Border Area is usually studied through the lens of recruitment, operational cells, and diaspora support. Our argument takes a different approach: it follows the money. Examining cases from the Barakat network to Operation Hawala, we trace how Hezbollah-linked actors have operated within a financial environment where formal and informal economies increasingly intersect. These infrastructures are not necessarily Hezbollah-specific; they can be accessed by Hezbollah-linked financiers alongside organized-crime actors, without implying direct organizational cooperation.
Introduction
While Hezbollah experienced significant blows against its financial infrastructure after successive rounds of open conflict and fragile ceasefires with Israel starting in 2023, the terrorist organization has also demonstrated resilience. The group has been able to mobilize a decentralized global system of diasporic networks, money-laundering operations, shell companies, and business intermediaries, which has allowed it to withstand significant setbacks. Although Hezbollah’s operations are global, its presence in South America’s Tri-Border Area (TBA)—the region where Argentina, Brazil, and Paraguay meet—provides a useful case study on how the organization has leveraged local commercial and financial infrastructure in an environment where the boundaries between formal, informal, and illicit economic activity are often blurred.
The TBA spans approximately 2500 km², encompassing formal border control zones, interconnected cities, and sparsely populated open areas. Economic activities are essentially transnational, with legal and illegal commerce often moving through the same commercial and logistical channels. Its porous borders, uneven enforcement, and the coexistence of formal and informal markets create an environment in which actors can move between formal, informal, and illicit economic activities with relative ease.
International attention to Hezbollah’s presence in the region intensified after the 1992 bombing of the Israeli Embassy in Buenos Aires and the 1994 Asociación Mutual Israelita Argentina (AMIA) attack. Since then, the TBA has increasingly been viewed through a counterterrorism lens, with research focusing mostly on two competing hypotheses: the existence of operational Hezbollah cells and the presence of financial and logistical networks supporting the organization from abroad. While the first hypothesis has remained the subject of considerable debate, this article focuses on the second, arguing that examining the evolution of the financial facilitation ecosystem provides greater explanatory power for Hezbollah’s enduring presence in the region. By operating remotely and distributing its operations across different networks, blending itself with criminal networks and the formal economy, Hezbollah has been able to generate, move, and conceal funds beyond a traditional structure of operational cells.
This approach shifts the focus from Hezbollah as an organization to the financial infrastructure through which Hezbollah-linked actors can operate. The cases examined below show how commercial businesses, intermediaries, informal value-transfer mechanisms, and digital financial services can overlap with infrastructure used by organized crime. Tracing these mechanisms over time provides a basis for understanding how Hezbollah-linked financial activity has persisted and adapted within the region.
Hezbollah’s footprint in the Tri-Border Area
The TBA’s economic growth is linked to the construction of the Itaipu hydroelectric dam in 1974, which brought thousands of workers to the region. The creation of a common economic market in the early 1990s further deepened commercial ties. Ciudad del Este became a free-trade zone in 1995 and subsequently a center for smuggling activities. The region had also attracted foreign merchants since the 1950s, as trade between Brazil and Paraguay intensified, including Arab peddlers and merchants who began establishing businesses and transnational family and commercial networks.
A second, predominantly Shi’a Lebanese migration followed the Lebanese Civil War (1975-1990), particularly after the 1982 Israeli invasion of Lebanon. This period coincided with the emergence of Hezbollah and Iran’s expanding regional influence following the 1979 Islamic Revolution. Hezbollah subsequently established a presence within segments of the Lebanese diaspora in Brazil and surrounding countries, leveraging the existing commercial environment to establish logistical, financial, and fundraising infrastructure. According to Brazilian counterterrorism agent Christian Vianna de Azevedo, Hezbollah has exploited local communities and businesses since the late 1980s. For example, after the AMIA terrorist attack, Brazilian-Lebanese citizen Farouk Omairi was accused of using his travel agency to issue plane tickets to Hezbollah agents. He was sanctioned by Office of Foreign Assets Control (OFAC) in 2006, and subsequently convicted of drug-trafficking offenses by Brazilian authorities.
Beyond these specific cases, the region’s Arab population—around 90% of whom are Lebanese—maintains longstanding family, religious, and commercial ties that extend across borders. Their businesses are embedded in the wider regional economy, providing access to banking services, cash exchanges, fintech platforms, and informal value-transfer mechanisms such as hawala. These networks are not inherently linked to Hezbollah and extend beyond the Lebanese community. Their importance lies in the financial and commercial infrastructure they provide, which can be exploited by criminal and terrorist actors without requiring direct organizational cooperation.
Financial Facilitation Ecosystems: How Money Moves
The foregoing discussion suggests that shifting the analytical focus from organizations to the financial infrastructures that sustain them may offer a more useful lens for understanding Hezbollah’s footprint in the TBA. To that end, this article uses the concept of financial facilitation ecosystems to describe the financial, commercial, and logistical actors and mechanisms that enable the generation, movement, concealment, and transfer of illicit funds. These include hawaladars, exchange houses, import-export companies, cash couriers, commercial brokers, financial institutions, and increasingly, fintech and cryptocurrency platforms. These resources are not necessarily Hezbollah-specific and may be accessed by Hezbollah-linked financiers alongside transnational criminal actors, without requiring direct organizational cooperation.
The analysis below traces the intermediaries, businesses, and mechanisms through which illicit value moves across jurisdictions and formal and informal channels, and how their use has evolved over time.
From Barakat to Digital Wallets, via Hawala: The Evolution of the Ecosystem
The Barakat network provides the clearest early example of Hezbollah’s ability to exploit the TBA’s commercial environment. Ahmad Barakat, designated by OFAC in 2004, was described as closely connected to Hezbollah’s leadership and operated as legitimate businesses, including Barakat Import Export and Casa Apollo, which were allegedly used for transferring money and information to the organization. His activities also extended beyond the TBA, including business interests in the United States. Barakat was indicted in Paraguay in 2001, arrested in Brazil in 2002, and, after his release in 2009, returned to the region only to be arrested again in 2018 on money-laundering charges. The network outlasted him: his brother Hamzi was arrested in 2013 over fraudulent schemes targeting recent Lebanese immigrants, with proceeds reportedly transferred to Hezbollah, while his cousin Mohammed Fayez Barakat continued operating in Ciudad del Este despite OFAC sanctions and Paraguayan investigations over alleged transfers to Hezbollah.
The Barakat case also illustrates the limits of targeting individual facilitators: removing a prominent figure does not necessarily disrupt the infrastructure on which they rely. The Barakat case was relatively easy to identify in retrospect: a prominent individual, a recognizable family network, and several businesses provided investigators with nodes around which the network could be mapped. Subsequent cases point to a more diverse set of actors and illicit markets.
In 2020, Lebanese national Ali Issa Chamas was extradited from the United States to Paraguay over alleged drug-trafficking and links to terrorism. In 2022, Kassem Mohamad Hijazi was extradited to the United States after being accused of using import-export companies to move goods between the United States and Paraguay and laundering the resulting proceeds; US authorities had also identified links between Hijazi, Hezbollah, and the wider Barakat network. Other investigations during this period involved cocaine trafficking, tobacco smuggling, and counterfeit goods, illustrating how proceeds generated through criminal markets could enter the same commercial and financial infrastructure used for other illicit finance.
Brazilian justice officials have also pointed to cases in which Hezbollah allegedly shared shell companies with local criminal groups, with false identities used to launder proceeds. During Operation Colossus, for example, authorities shut down stores selling counterfeit and smuggled e-cigarettes, with profits reportedly deposited into accounts opened using the identities of recent immigrants. These cases do not establish a single Hezbollah-controlled network, yet they show how different illicit revenue streams can enter overlapping commercial and financial channels.
The range of mechanisms has continued to expand. Argentine authorities investigated a network allegedly serving Hezbollah and Hamas involving hawala operator Tawfiq Muhammad Sa’id Al-Law, who reportedly transferred more than $1.5 million to wallets in Brazil. Brazilian investigations likewise identified networks involving shell companies, financial institutions, and cryptocurrency transactions allegedly serving both the Primeiro Comando da Capital (PCC) and Hezbollah.
Since 2017, Brazilian authorities have conducted major investigations into cryptocurrency-based money laundering involving hundreds of shell companies and networks reportedly serving both the PCC and Hezbollah. In one case, a bank reportedly transferred funds to cryptocurrency wallets flagged by the Israeli Ministry of Defense as linked to Hezbollah. These developments do not replace the businesses, cash-based mechanisms, or intermediaries seen in earlier cases; they add channels for moving value through the formal and informal financial system.
At the same time, the ecosystem’s geography has expanded beyond the TBA itself. Operation Hawala, launched in 2026, uncovered a network allegedly moving more than 100 million Brazilian Reais through legitimate and shell companies across several Brazilian states, including São Paulo and Rio de Janeiro. Cellphone stores, import-export companies, and other businesses were reportedly used to facilitate money laundering involving both the PCC and Hezbollah.
Individuals linked to the Lebanese-Brazilian Zayoun family allegedly connected operations in the TBA with networks elsewhere in Brazil, suggesting that the TBA functions as one node within a wider financial ecosystem. A similar concern has emerged on Brazil’s southern border: Uruguay’s 2025-2030 National Strategy against Money Laundering and Terrorist and Proliferation Financing identifies intelligence reporting suggesting that some illicit activities may be shifting from the TBA towards the Santana do Livramento-Rivera border, citing its dry-border geography, cross-border commerce, and Arab communities as relevant similarities.
The evolution from Barakat to digital finance, therefore, reflects a broader diversification of the initial network. Barakat’s network represents a relatively identifiable and traditional model, while the more recent cases involve specialized intermediaries, legitimate businesses, financial institutions, fintech services, and cryptocurrency platforms that perform different functions without necessarily belonging to a single organization. The overlap between Hezbollah-linked actors and criminal groups such as the PCC further illustrates this model. The TBA is therefore best understood not as a self-contained Hezbollah hub, but as one node within a wider ecosystem through which different actors can access and combine financial and commercial capabilities.
Conclusion
The different cases examined in this paper indicate that Hezbollah’s financial ecosystem has become more distributed, diversified, and geographically expansive over the years, evolving from relatively identifiable family and business networks into a broader infrastructure involving commercial enterprises, hawala, fintechs, and, increasingly, digital financial mechanisms. This evolution does not necessarily indicate a corresponding increase in Hezbollah’s operational presence, nor does overlap with criminal networks demonstrate direct organizational cooperation. It does, however, highlight the TBA’s importance as an environment where various illicit actors can access and exploit the same financial and commercial capabilities.
This perspective has implications for how authorities investigate terrorist financing in the region. The evolution from the relatively identifiable Barakat network to a more distributed ecosystem means that an organization-centric approach may overlook the infrastructure that enables illicit value to move across jurisdictions. The fact that many of the cases examined resulted in arrests or prosecutions for financial or criminal offenses rather than terrorism-related charges should not be interpreted as evidence of the absence of terrorist financing. It may instead reflect the evidentiary and legal difficulties of establishing a direct connection between a financial transaction and a terrorist organization. Financial and criminal investigations can therefore provide an alternative entry point for identifying Hezbollah-linked activity, particularly where actors operate through legitimate businesses, intermediaries, or infrastructures also used by organized crime.
Recent Brazilian efforts to strengthen oversight of fintechs and other financial vehicles following Operations Fluxo and Carbono Oculto illustrate the broader relevance of this approach, as illicit networks can penetrate both highly formalized financial environments and informal markets. A network-based investigative posture should therefore focus not only on identifying Hezbollah operatives but also on mapping the businesses, intermediaries, financial mechanisms, cross-border connections, and regulatory gaps that allow illicit value to circulate through the TBA and beyond. This requires stronger cross-border financial intelligence and information-sharing as financial activity becomes increasingly distributed across formal institutions, informal mechanisms, and digital platforms.
